Permission comparator

• US 10,296,753 B2
• Filed: 04/01/2015
• Issued: 05/21/2019
• Est. Priority Date: 08/26/2014
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Brock, John Arlan, Torman, Adam
• Primary Examiner(s): Patel, Ashokkumar B
• Assistant Examiner(s): Jones, William B
• Application Number:
  US14/676,640
• Publication Number:
  US 20160063270A1
• Time in Patent Office: 1,511 Days
• Field of Search: 726 28
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

A permission management system enables a system administrator to more effectively manage the large number of permissions associated with database systems. The permission management system accumulates groups of permissions associated with selected users, profiles, or permission sets. The permission management system then performs selectable comparisons on the different groups of permissions, such as identifying common permissions, unique permissions, and differing permissions. The permission management system also may identify permissions in a first permission group that do not exist in a second permission group and assign the identified permissions to the second permission group.

Claims

1. A database system for comparing permissions, the database system comprising:

a processor; and

one or more stored sequences of instructions stored on a non-transitory computer-readable media which, when executed by the processor, cause the processor to carry out the steps of;

receiving, at a first time, a first identifier associated with a first user;

retrieving, in response to receiving the first identifier, a first profile associated with the first identifier, the first profile associated with a first plurality of permission lists, wherein each permission list in the first plurality of permission lists includes one or more permissions;

creating, at a second time subsequent to the first time, a first group of permissions by combining together each permission list of the first plurality of permission lists for the first user, and displaying the first group of permissions on a user interface, wherein combining includes resolving conflicting permissions between each permission list in the first plurality of permission lists;

receiving, at a third time, a second identifier associated with a second user;

retrieving, in response to receiving the second identifier, a second profile associated with the second identifier, the second profile associated with a second plurality of permission lists, wherein each permission list in the second plurality of permission lists includes one or more permissions;

creating, at a fourth time subsequent to the third time, a second group of permissions by combining together each permission list of the second plurality of permission lists for the second user, and displaying the second group of permissions on the user interface, wherein the second group of permissions is created and displayed separately from the first group of permissions, and wherein combining includes resolving conflicting permissions between each permission list in the second plurality of permission lists;

receiving a comparator operator;

comparing the first group of permissions with the second group of permissions based on the comparator operator, the comparator operator determining how the comparison is to be carried out;

generating in real-time a new permission list resulting from the comparison of the first group of permissions and the second group of permissions, wherein the new permission list is different from the first group of permissions and the second group of permissions and not assigned to any users;

sending the new permission list as results of the comparison to the user interface to display separately from the first group of permissions and the second group of permissions;

receiving a permission assignment operator; and

assigning the new permission list to one of the first user or second user based on the permissions assignment operator.

2. The database system of claim 1, wherein the instructions further cause the processor to carry out the steps of:

displaying in the new permission list common permissions between the first and second group of permissions;

filtering from the new permission list unique permissions unique to only one of the first group of permissions or the second group of permissions; and

displaying the filtered new permission list of the common permissions as the results of the comparison.

3. The database system of claim 1, wherein the instructions further cause the processor to carry out the steps of:

displaying as the new permission list permissions unique to only one of the first group of permissions or the second group of permissions based on the comparator operator;

filtering from the new permission list differing permissions between the first and second group of permissions; and

displaying the filtered new permission list of the unique permissions as the results of the comparison.

4. The database system of claim 1, wherein the instructions further cause the processor to carry out the steps of:

receiving, at a fifth time, a third identifier associated with a third user;

retrieving, in response to receiving the third identifier, a third profile associated with the third identifier, the third profile associated with a third plurality of permission lists, wherein each permission list in the third plurality of permission lists includes one or more permissions;

creating, at a sixth time subsequent to the fifth time, a third group of permissions by combining together each permission list of the third plurality of permission lists for the third user, and displaying the third group of permissions on the user interface, wherein combining includes resolving conflicting permissions between each permission list in the third plurality of permission lists;

displaying, on the user interface, in the new permission list differing permissions that are not common in all three of the first, second, and third group of permissions;

filtering from the new permission list common permissions that are common to at least two of the first, second, and third group of permissions; and

displaying, on the user interface, the filtered new permission list of the differing permissions as the results of the comparison.

5. The database system of claim 1, wherein the instructions further cause the processor to carry out the steps of:

identifying in the new permission list a set of permissions in the first group of permissions that are not in the second group of permissions; and

assigning the new permission list to the second user.

6. The database system of claim 1, wherein

resolving conflicting permissions for each permission list in the first plurality of permission lists and resolving conflicting permissions for each permission list in the second plurality of permission lists each comprise removing duplicate permissions.

7. The database system of claim 6, wherein

resolving conflicting permissions for each permission list in the first plurality of permission lists and resolving conflicting permissions for each permission list in the second plurality of permission lists each further comprise retaining permissions that are more permissive.

8. The database system of claim 1, wherein the instructions further cause the processor to carry out the steps of:

receiving a first user identifier, first profile identifier, or first permission set identifier as the first identifier;

identifying all permissions associated with the first user identifier, first profile identifier, or first permission set identifier as the first group of permissions;

receiving a second user identifier, second profile identifier, or second permission set identifier as the second identifier; and

identifying all permissions associated with the second user identifier, second profile identifier, or second permission set identifier as the second group of permissions.

9. The database system of claim 1, wherein permission lists include at least one of an object permission, an application permission, a code permission, and a page permission.

10. A computer program stored in a non-transitory media for managing permissions in a database system, the computer program comprising a set of instructions operable to:

display, on a user interface, identifiers associated with different permission categories for different users;

detect selection, at a first time, of a first one of the identifiers;

generate, at a second time subsequent to the first time, a first group of permissions associated with the first one of the identifiers, wherein the first group of permissions include separately grantable read, edit, create, and view permissions for same objects in the database system;

display the first group of permissions on the user interface;

detect selection, at a third time, of a second one of the identifiers;

generate, at a fourth time subsequent to the third time, a second group of permissions separate from the first group of permissions associated with the second one of the identifiers wherein the second group of permissions include separately grantable read, edit, create, and view permissions for the same objects in the database system;

display, separately from the first group of permissions, the second group of permissions on the user interface;

detect selection of a comparison operator;

compare the first group of permissions with the second group of permissions based on the comparison operator, the comparison operator to determine how the comparison is to be carried out;

generate a new group of permissions in real-time resulting from the comparison between the first group of permissions and the second group of permissions, the new group of permissions different from the first group of permissions and the second group of permissions and currently not assigned to any of the users; and

send the new group of permissions as results of the comparison to a user device for displaying on the user interface separately from the first group of permissions and the second group of permissions.

11. The computer program of claim 10, further comprising instructions operable to:

identify a first user identifier, first profile identifier, or first permission set identifier associated with the first one of the identifiers;

identify the permissions associated with the first user identifier, first profile identifier, and first permission set identifier as the first group of permissions;

identify a second user identifier, second profile identifier, or second permission set identifier associated with the second one of the identifiers; and

identify the permissions associated with the second user identifier, second profile identifier, or second permission set identifier as the second group of permissions.

12. The computer program of claim 10, further comprising instructions operable to:

identify he first one of the identifiers as a user identifier;

identify a profile associated with the user identifier;

identify permission sets associated with the user identifier; and

combine permissions associated with the profile and permission sets into the first group of permissions,

wherein conflicting permissions between the profile and each permission set in the permission sets are resolved when the permissions are combined.

13. The computer program of claim 10, further comprising instructions operable to:

detect selection of the first one of the identifiers in response to a cursor dragging and dropping the first one of the identifiers into a first header; and

detect selection of the second one of the identifiers in response to the cursor dragging and dropping the second one of the identifiers into a second header.

14. The computer program of claim 10, further comprising instructions operable to:

identify object permissions, application permissions, code permissions, and page permissions in the first group of permissions;

identify object permissions, application permissions, code permissions, and page permissions in the second group of permissions; and

compare the object permissions, application permissions, code permissions, and page permissions in the first group of permissions with the object permissions, application permissions, code permissions, and page permissions in the second group of permissions.

15. The computer program of claim 10, further comprising instructions operable to:

identify a subgroup of permissions in the first group of permissions not common to the second group of permissions; and

assign the subgroup of permissions to the second one of the identifiers.

16. The computer program of claim 10, further comprising instructions operable to:

display common permissions identified in both the first group of permissions and the second group of permissions in response to the comparison operator indicating a common comparison.

17. The computer program of claim 10, further comprising instructions operable to:

display unique permissions located only in the first group of permissions or located only in the second group permissions in response to the comparison operator indicating a unique comparison.

18. The computer program of claim 10, further comprising instructions operable to:

detect selection, at a fifth time, of a third one of the identifiers;

generate, at a sixth time subsequent to the first time, a third group of permissions associated with the third one of the identifiers;

display, separately from the first and second groups of permissions, the third group of permissions on the user interface; and

display differing permissions that are not located in all three of the first group of permissions, second group of permissions, and third group of permissions in response to the comparison operator indicating a differing comparison.

19. A method for managing permissions in a database system comprising:

detecting, at a first time, selection of a first identifier for a first user, the first identifier associated with a first plurality of permission sets, each of the first plurality of permission sets including at least one permission;

sending a request to a permission management server to automatically create, at a second time subsequent to the first time, and display a first group of permissions associated with the first identifier by combining together each permission set of the first plurality of permission sets, wherein combining includes resolving conflicting permissions between each permission set in the first plurality of permission sets;

detecting, at a third time, selection of a second identifier for a second user, the second identifier associated with a second plurality of permission sets, each of the second plurality of permission sets including at least one permission;

sending a request to the permission management server to automatically create, at a fourth time subsequent to the third time, and display a second group of permissions associated with the second identifier by combining together each permission set of the second pluralit of permission sets, wherein combining includes resolving conflicting permissions between each permission set in the second plurality of permission sets;

detecting selection of a comparator operator; and

sending a request to the permission management server to;

automatically compare in real-time the first group of permissions for the first user with the second group of permissions for the second user based on the comparator operator, the comparator operator determining how the comparison is to be carried out;

automatically generate in real-time a third group of permissions different from the first group of permission and the second group of permissions as results of the comparison between the first group of permissions and the second group of permissions, the third group of permissions not currently assigned to the first user or the second user; and

display the third group of permissions on a user interface separately from the first group of permissions and the second group of permissions,

wherein permissions include at least one of an object permission, an application permission, a code permission, and a page permission.

20. The method of claim 19, further comprising:

receiving a request to add a permission set to the second user that includes permissions from the first group of permissions that are not in the second group of permissions; and

sending the request to the permission management server to assign the permission set to the second user.