Mandatory access control list for managed content
Restricting access to managed content to users that are both (1) members of one or more required groups identified in an ACL associated a content item to which access is requested and (2) otherwise granted access under the ACL, e.g., by virtue of their individual identity, role, or group membership is disclosed. In some embodiments, an ACL is configured to identify one or more groups as being a “required” group, membership in which is required for a user to be granted access to a content item with which the ACL is associated. If a user is not a member of a required group, the user is denied access (or denied access above a certain level), even if the user is otherwise delegated access rights in the ACL.
1. A method of controlling access to managed content, comprising:
receiving a request to access a content item by a user;
determining using a processor whether access to the content item is limited to members of any required group associated with the content item based on whether an access control list associated with the content item includes a required group entry specifying a required group, wherein the access control list includes one or more other entries that are not required group entries, and wherein each of the other entries specifies a type of access granted;
in the event that access to the content item is limited to members of any required group associated with the content item, determining access based on whether the user is a member of the required group and further based on the one or more other entries of the access control list, wherein any access granted to the user based on the one or more other entries but not based on any required group entries is denied in the event that the user is not a member of the required group, and wherein the user is denied any access in the event that the user is a member of the required group but is not granted any access based on the one or more other entries; and
in the event that access to the content item is not limited to members of any required group, determining access based on the one or more other entries of the access control list.
2. The method as recited in claim 1 , wherein the request is received at a content management system, and wherein the request is received from an application running on a framework associated with the content management system.
3. The method as recited in claim 1 , wherein the determination of access is made by business logic associated with a content management system.
4. The method as recited in claim 1 , wherein the access control list comprises a software object stored persistently in a metadata store associated with a content management system and linked to an implementation object that represents the content item in a body of managed content.
5. The method as recited in claim 1 , wherein determining access based on whether the user is a member of the required group and further based on the one or more other entries of the access control list comprises:
providing access if the user is a member of the required group and further if the user is granted access based on the one or more other entries of the access control list.
6. The method as recited in claim 1 , wherein the requested access comprises one or more of the following types of access: browse, read, relate, version, write, and delete.
7. A content management system, comprising:
a communication interface configured to receive a request to access a content item by a user; and
a processor coupled to the communication interface and configured to:
determine whether access to the content item is limited to members of any required group associated with the content item based on whether an access control list associated with the content item includes a required group entry specifying a required group, wherein the access control list includes one or more other entries that are not required group entries, and wherein each of the other entries specifies a type of access granted;
in the event that access to the content item is limited to members of any required group associated with the content item, determine access based on whether the user is a member of the required group and further based on the one or more other entries of the access control list, wherein any access granted to the user based on the one or more other entries but not based on any required group entries is denied in the event that the user is not a member of the required group, and wherein the user is denied any access in the event that the user is a member of the required group but is not granted any access based on the one or more other entries; and
in the event that access to the content item is not limited to members of any required group, determine access based on the one or more other entries-of the access control list.
8. The system as recited in claim 7 , further comprising a content store configured to store the content item.
9. The system as recited in claim 7 , further comprising a metadata store configured to store the access control list and a linking data associating the access control list with the content item.
10. The system as recited in claim 7 , wherein the request is received from an application running on a framework associated with the content management system.
11. The system as recited in claim 7 , wherein the determination of access is made by business logic associated with the content management system.
12. The system as recited in claim 7 , wherein the access control list comprises a software object stored persistently in a metadata store associated with the content management system and linked to an implementation object that represents the content item in a body of managed content.
13. The system as recited in claim 7 , wherein determining access based on whether the user is a member of the required group and further based on the one or more other entries of the access control list comprises:
providing access if the user is a member of the required group and further if the user is granted access based on the one or more other entries of the access control list.
14. The system as recited in claim 7 , wherein the requested access comprises one or more of the following types of access: browse, read, relate, version, write, and delete.
15. The system as recited in claim 7 , wherein the required group specified by the required group entry comprises a required group set, and wherein the required group set includes a plurality of individual required groups combined together, and wherein a member of the required group set is a member of at least one of the plurality of individual required groups.
16. The system as recited in claim 7 , wherein the access control list includes an additional required group entry specifying an additional required group, and wherein determining access based on whether the user is a member of the required group and further based on the one or more other entries of the access control list comprises:
denying access if the user is not a member of the required group or if the user is not a member of the additional required group.
17. The system as recited in claim 7 , wherein the access control list includes an additional required group entry specifying an additional required group, and wherein determining access based on whether the user is a member of the required group and further based on the one or more other entries of the access control list comprises:
providing access if the user is a member of the required group and also a member of the additional required group, and further if the user is granted access based on the one or more other entries of the access control list.
18. The system as recited in claim 7 , wherein the access control list includes an additional required group entry specifying an additional required group, and wherein determining access based on whether the user is a member of the required group and further based on the one or more other entries of the access control list comprises:
denying access if the user is a member of the required group and also a member of the additional required group, and further if the user is not granted access based on the one or more other entries of the access control list.
19. A computer program product for controlling access to managed content, the computer program product being embodied in a non-transitory computer readable medium and comprising computer instructions for:
receiving a request to access a content item by a user;
determining whether access to the content item is limited to members of any required group associated with the content item based on whether an access control list associated with the content item includes a required group entry specifying a required group, wherein the access control list includes one or more other entries that are not required group entries, and wherein each of the other entries specifies a type of access granted;
in the event that access to the content item is limited to members of any required group associated with the content item, determining access based on whether the user is a member of the required group and further based on the one or more other entries of the access control list, wherein any access granted to the user based on the one or more other entries but not based on any required group entries is denied in the event that the user is not a member of the required group, and wherein the user is denied any access in the event that the user is a member of the required group but is not granted any access based on the one or more other entries; and
in the event that access to the content item is not limited to members of any required group, determining access based on the one or more other entries of the access control list.