User-customizable permissions in a computing environment

• US 10,394,412 B2
• Filed: 06/13/2017
• Issued: 08/27/2019
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Torman, Adam, Brock, John Arlan, Dubey, Anjesh, Hua, Jimmy, Chang, Aris, Pareek, Bharath Kumar, Bhadouria, Sukrutha Raman, Wong, Belinda
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): Gyorfi, Thomas A
• Application Number:
  US15/621,874
• Publication Number:
  US 20180129359A1
• Time in Patent Office: 805 Days
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers

Abstract

Disclosed are examples of systems, apparatus, methods and computer program products for providing user-customizable permissions governing user access to computing resources in a computing system. For example, a database storing data objects identifying permissions of users, sets of the permissions, and users can be maintained. One or more fields can be displayed on a display of a user device. The one or more fields can be configured to receive input to perform one or more operations. Input can be received from a user via the user interface on the display of the user device. One or more operations can be performed. The database can be updated such that the data objects identify a custom permission or a permission set to which a custom permission has been assigned.

Claims

1. A system comprising:

a database system implemented using a server system comprising one or more hardware processors, the database system configurable to cause;

providing user interface data to a user device, the user interface data configured to be processed to cause display, in a user interface on a display of the user device, of one or more fields configured to receive input data for performing one or more of;

defining or updating a custom permission, associating a custom permission with a computing resource, assigning a custom permission to a permission set, or assigning a permission set to a user;

generating or updating, based on first input from a first user via the user interface on the display of the user device, a custom permission;

associating, based on second input from the first user via the user interface on the display of the user device, the custom permission with a first computing resource;

assigning, based on third input from the first user via the user interface on the display of the user device, the custom permission to the first permission set;

identifying a rule associated with the custom permission, the rule governing performance of one or more actions in association with the database system;

providing further user interface data to the user device, the further user interface data configured to be processed to cause display, in the user interface, of one or more user-configurable parameters of the rule; and

generating or updating one or more data objects maintained in a database, the one or more data objects indicating custom permissions, permission sets and permission relationships among entities in a computing system for governing user access to computing resources in the computing system.

2. The system of claim 1, wherein an operational characteristic of a permission is independent of whether the permission is user-defined.

3. The system of claim 1, the database system further configurable to cause:

determining, responsive to a request from a second user to access a second computing resource, using the one or more data objects in the database, that the second user is not authorized to access the second computing resource; and

denying, responsive to determining that the second user is not authorized to access the second computing resource, the second user access to the second computing resource.

4. The system of claim 1, wherein the rule is one of:

a validation rule blocking designated actions unless a user has the custom permission, a rule defining whether a user can make a selection, a rule defining whether a user can view a page or a section of a page, a workflow rule, a rule governing creation, reading, or editing of a record, or a numeric permission governing an amount of user activity.

5. The system of claim 1, the database system further configurable to cause:

determining that a first permission has been enabled; and

enabling, responsive to determining that the first permission has been enabled, a second permission.

6. The system of claim 1, wherein the first computing resource is associated with one or more customer relationship management (CRM) records stored in a CRM database.

7. The system of claim 1, the database system further configurable to cause:

associating a subset of a permission set with one or more objects in a system external to the computing system; and

assigning one or more users to the subset of the permission set.

8. The system of claim 7, the database system further configurable to cause:

providing, responsive to receiving a request from the external system to access the database, the external system with access to the database.

9. The system of claim 8, wherein the subset of the permission set defines a first license associated with the external system.

10. A database-implemented method comprising:

providing user interface data to a user device, the user interface data configured to be processed to cause display, in a user interface on a display of the user device, of one or more fields configured to receive input data for performing one or more of;

defining or updating a custom permission, associating a custom permission with a computing resource, assigning a custom permission to a permission set, or assigning a permission set to a user;

generating or updating, based on first input from a first user via the user interface on the display of the user device, a custom permission;

associating, based on second input from the first user via the user interface on the display of the user device, the custom permission with a first computing resource;

assigning, based on third input from the first user via the user interface on the display of the user device, the custom permission to the first permission set;

identifying a rule associated with the custom permission, the rule governing performance of one or more actions in association with the database system;

providing further user interface data to the user device, the further user interface data configured to be processed to cause display, in the user interface, of one or more user-configurable parameters of the rule; and

generating or updating one or more data objects maintained in a database, the one or more data objects indicating custom permissions, permission sets and permission relationships among entities in a computing system for governing user access to computing resources in the computing system.

11. The method of claim 10, wherein an operational characteristic of a permission is independent of whether the permission is user-defined.

12. The method of claim 10, further comprising:

determining, responsive to a request from a second user to access a second computing resource, using the one or more data objects in the database, that the second user is not authorized to access the second computing resource; and

denying, responsive to determining that the second user is not authorized to access the second computing resource, the second user access to the second computing resource.

13. The method of claim 10, wherein the rule is one of:

a validation rule blocking designated actions unless a user has the custom permission, a rule defining whether a user can make a selection, a rule defining whether a user can view a page or a section of a page, a workflow rule, a rule governing creation, reading, or editing of a record, or a numeric permission governing an amount of user activity.

14. The method of claim 10, further comprising:

determining that a first permission has been enabled; and

enabling, responsive to determining that the first permission has been enabled, a second permission.

15. A computer program product comprising computer-readable program code capable of being executed by one or more processors when retrieved from a non-transitory computer-readable medium, the program code comprising instructions configurable to cause:

providing user interface data at a user device, the user interface data configured to be processed to cause display, in a user interface on a display of the user device, of one or more fields configured to receive input data for performing one or more of;

defining or updating a custom permission, associating a custom permission with a computing resource, assigning a custom permission to a permission set, or assigning a permission set to a user;

generating or updating, based on first input from a first user via the user interface on the display of the user device, a custom permission;

associating, based on second input from the first user via the user interface on the display of the user device, the custom permission with a first computing resource;

assigning, based on third input from the first user via the user interface on the display of the user device, the custom permission to the first permission set;

identifying a rule associated with the custom permission, the rule governing performance of one or more actions in association with the database system;

providing further user interface data to the user device, the further user interface data configured to be processed to cause display, in the user interface, of one or more user-configurable parameters of the rule; and

generating or updating one or more data objects maintained in a database, the one or more data objects indicating custom permissions, permission sets and permission relationships among entities in a computing system for governing user access to computing resources in the computing system.

16. The computer program product of claim 15, wherein an operational characteristic of a permission is independent of whether the permission is user-defined.

17. The computer program product of claim 15, the instructions further configurable to cause:

determining, responsive to a request from a second user to access a second computing resource, using the one or more data objects in the database, that the second user is not authorized to access the second computing resource; and

denying, responsive to determining that the second user is not authorized to access the second computing resource, the second user access to the second computing resource.

18. The computer program product of claim 15, wherein the rule is one of:

a validation rule blocking designated actions unless a user has the custom permission, a rule defining whether a user can make a selection, a rule defining whether a user can view a page or a section of a page, a workflow rule, a rule governing creation, reading, or editing of a record, or a numeric permission governing an amount of user activity.

19. The computer program product of claim 15, the instructions further configurable to cause:

determining that a first permission has been enabled; and

enabling, responsive to determining that the first permission has been enabled, a second permission.

20. The computer program product of claim 15, the instructions further configurable to cause:

providing, responsive to receiving a request from the external system to access the database, the external system with access to the database.