COMPUTER IMPLEMENTED METHODS AND APPARATUS FOR MANAGING PERMISSION SETS AND VALIDATING USER ASSIGNMENTS

• US 20140013400A1
• Filed: 07/03/2013
• Published: 01/09/2014
• Est. Priority Date: 07/03/2012
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Warshavsky, Alex, Bitting, Doug, Torman, Adam, Damania, Bhumi, Franger, Carol, Kwong, Herman, Hua, Jimmy, Pesenson, Igor
• Granted Patent: US 9,628,493 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Disclosed are methods, apparatus, systems, and computer-readable storage media for modifying permission sets and validating permission set assignments to users. In some implementations, a computing device receives a request to create a permission set containing one or more permissions and assign the permission set to a first user. The first user is associated with a first user constraint that defines a first group of permissions available to the first user. The computing device may determine that the permission set to be assigned to the first user does not violate the first user constraint, and may assign the permission set to the first user.

Claims

1. A computer implemented method for modifying permission sets and validating permission set assignments to users, the method comprising:

receiving, at a server, a request to create a permission set containing one or more permissions;

creating the permission set;

receiving, at the server, a request to assign the permission set to a first user, the first user associated with a first user constraint, the first user constraint defining a first group of permissions available to the first user;

determining that the permission set to be assigned to the first user does not violate the first user constraint associated with the first user; and

assigning the permission set to the first user.

2. The method of claim 1, wherein the server determines that the permission set does not violate the first user constraint by:

determining that each of the one or more permissions of the permission set exists in the first group of permissions defined by the first user constraint.

3. The method of claim 1, wherein the permission set is associated with a permission set constraint, the permission set constraint defining a superset of permissions one or more of which may be included in the permission set.

4. The method of claim 3, wherein the permission set constraint defines the superset of permissions as all of the permissions available to a tenant organization in a multi-tenant environment.

5. The method of claim 1, wherein the permission set is not associated with the first user constraint when the permission set is created by the server, and wherein the permission set is associated with the first user constraint when the permission set is assigned to the first user.

6. The method of claim 1, wherein the first user constraint is a user license specific to the first user.

7. The method of claim 1, wherein the first group of permissions defined by the first user constraint includes one or more permissions associated with one or more of:

an online social network, an application, a line of business, a software vendor package, and a logical grouping of metadata having access controls.

8. The method of claim 1, the method further comprising:

receiving, at the server, a request to modify the permission set by adding one or more permissions to the permission set.

9. The method of claim 8, the method further comprising:

identifying the first user to whom the permission set is assigned;

determining that the one or more permissions to be added violates the first user constraint; and

transmitting data indicating a first error without modifying the permission set as requested.

10. The method of claim 9, wherein the server determines that the additional permission violates the first user constraint by:

determining that the one or more permissions to be added is not included in the first group of permissions.

11. The method of claim 9, wherein the transmitted data includes a message that the permission set was not modified as requested and identifies the one or more permissions to be added as not being included in the first group of permissions.

12. The method of claim 9, wherein the permission set is assigned to more than one user, the method further comprising:

identifying a second user to whom the permission set is assigned, the second user associated with a second user constraint defining a second group of permissions available to the second user;

determining that the one or more permissions to be added violates the second user constraint; and

transmitting data indicating a second error without modifying the permission set as requested.

13. The method of claim 8, the method further comprising:

determining that the request to modify the permission set does not violate any user constraints; and

modifying the permission set to include the one or more permissions to be added.

14. The method of claim 13, wherein the server determines that the request does not violate any user constraints by:

determining that the permission set is not assigned to any users.

15. The method of claim 13, wherein the server determines that the request does not violate the user constraint of a user to whom the permission set is assigned by:

identifying one or more users to whom the permission set is assigned;

identifying one or more user constraints associated with the one or more users;

determining that the one or more permissions to be added are contained in each of the one or more user constraints.

16. One or more computing devices for modifying permission sets and validating permission set assignments to users, the one or more computing devices comprising:

one or more processors operable to execute one or more instructions to;

create a permission set containing one or more permissions in response to receiving a request message;

receive a request to assign the permission set to a first user, the first user associated with a first user constraint, the first user constraint defining a first group of permissions available to the first user;

determine that the permission set to be assigned to the first user does not violate the first user constraint associated with the first user; and

assign the permission set to the first user.

17. A non-transitory computer-readable storage medium storing instructions executable by a computing device to perform a method for modifying permission sets and validating permission set assignments to users, the method comprising:

receiving, at a server, a request to create a permission set containing one or more permissions;

creating the permission set;

receiving, at the server, a request to assign the permission set to a first user, the first user associated with a first user constraint, the first user constraint defining a first group of permissions available to the first user;

determining that the permission set to be assigned to the first user does not violate the first user constraint associated with the first user; and

assigning the permission set to the first user.

18. A computer implemented method for modifying permission sets and validating permission set assignments to users, the method comprising:

receiving, at a server, a request to assign a permission set containing one or more permissions to a first user, the first user associated with a first user constraint, the first user constraint defining a first group of permissions available to the first user;

determining that the permission set to be assigned to the first user does not violate the first user constraint associated with the first user; and

assigning the permission set to the first user.

19. The method of claim 18, wherein the server determines that the permission set does not violate the first user constraint by:

determining that each of the one or more permissions of the permission set exists in the first group of permissions defined by the first user constraint.

20. The method of claim 18, the method further comprising:

receiving, at the server, a request to modify the permission set by adding one or more permissions to the permission set.