Storage application programming interface

• US 20060206510A1
• Filed: 03/14/2005
• Published: 09/14/2006
• Est. Priority Date: 03/14/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Ko, Pak H., Elliott, Paul A., Rosato, Stephen P., Kannan, Suresh, Moulhaud, Patrick E.
• Granted Patent: US 7,546,297 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

Systems, methods, apparatus, data structures, and computer-readable media are described which provide techniques for managing data storage. In an implementation, a method includes examining a role map to determine which of a plurality of roles are applicable to a request to interact with at least one of a plurality of items. The request is received via an application programming interface (API) that is available over a network and one or more of the items reference a respective item of data. Access to the at least one item is permitted based on a role definition which describes differing access rights available for the item based on which of the roles is applicable to the request.

Claims

1. A method comprising:

examining a role map to determine which of a plurality of roles are applicable to a request to interact with at least one of a plurality of items, wherein;

the request is received via an application programming interface (API) that is available over a network; and

one or more said items reference a respective item of data; and

permitting access to the at least one said item based on a role definition which describes differing access rights available for the at least one said item based on which said role is applicable to the request.

2. A method as described in claim 1, wherein the role definition describes a method of the item that is accessible by a first said role and is not accessible by a second said role.

3. A method as described in claim 1, wherein the role definition describes an attribute of the item that is accessible by a first said role and is not accessible by a second said role.

4. A method as described in claim 1, wherein the role is applicable to the request based on an identity of a client that originated the request.

5. A method as described in claim 1, wherein at least two of the one or more said items reference a shared item of data.

6. A method as described in claim 1, wherein two or more of the plurality of items are configured to form a hierarchy.

7. A method as described in claim 1, wherein the request is configured as a method call selected from the group consisting of:

a retrieve item call;

a create item call;

a create relationship between items call;

a change access permission call;

a role map change;

a role definition change;

update item;

delete item; and

a share item call.

8. A method as described in claim 1, wherein the request corresponds to a role selected from a group consisting of:

an administrator;

an owner;

a creator;

a guest;

a contributor; and

a member.

9. A method as described in claim 1, wherein:

at least one said role is stored in a permission record store which is accessible to a storage service module that is executable to perform the permitting; and

another said role is defined by the storage service module without accessing the permission record store.

10. A method comprising:

receiving a plurality of requests at an application programming interface to access a respective one or more of a plurality of items, wherein;

each said request is sent over a network from a respective one of a plurality of clients;

one or more said items reference at least one of a plurality of data;

at least one said item has a defined relationship with another said item; and

one or more said items have one or more role definitions which describe respective access rights that are defined for one or more roles; and

managing access of the plurality of clients to the one or more said items based on which said role is applicable to a respective said client.

11. A method as described in claim 10, wherein:

at least one said role definition describes a method of the item that is accessible by one said role and is not accessible by another said role; and

at least one said role definition describes an attribute of the item that is accessible by the one said role and is not accessible by the other said role

12. A method as described in claim 10, wherein the client is a web server.

13. A method as described in claim 10, wherein:

at least two said items reference a shared item of data; and

another two said items are configured to form a hierarchy.

14. A method as described in claim 10, wherein at least one said request is configured as a method call selected from the group consisting of:

a retrieve item call;

a create item call;

a create relationship between items call;

a change access permission call;

a role map change;

a role definition change; and

a share item call.

15. A method comprising:

forming a request by a client for communication over a network to a storage application programming interface (API), wherein the request includes a unique client identifier and identifies one or more of a plurality of items; and

receiving a response to the request that is formed to include data referenced by the identified said items which is accessible to the client based on;

which of a plurality of roles defined for the identified said items is applicable to the client; and

a role definition which defines differing access rights to the identified said items based on respective said roles.

16. A method as described in claim 15, wherein the role definition is included on the identified said items.

17. A method as described in claim 15, wherein the role definition for the identified said items is inherited from another said item.

18. A method as described in claim 15, wherein at least two said items reference a shared item of data.

19. A method as described in claim 15, further comprising:

receiving the request at the storage API;

determining which said role is applicable to the client based on the unique client identifier; and

retrieving the data based on the determined said role and the role definition of the identified said items.

20. A method as described in claim 15, further comprising:

receiving the request at the storage API;

determining that a plurality of said roles are applicable to the client based on the unique client identifier;

selecting one of the plurality of said roles for use by the client; and

retrieving the data based on the selected said role and the role definition of the identified said items.