Techniques for processing group membership data in a multi-tenant database system

• US 9,411,852 B2
• Filed: 06/12/2013
• Issued: 08/09/2016
• Est. Priority Date: 07/03/2008
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Yancey, Scott, Doshi, Kedar, Wu, Yongsheng
• Primary Examiner(s): VU, BAI DUC
• Application Number:
  US13/916,441
• Publication Number:
  US 20130346389A1
• Time in Patent Office: 1,154 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 16/176 Support for shared access to files; File sharing support
• CPC Class Codes: G06F 16/21 Design, administration or maintenance of databases
• CPC Class Codes: G06F 16/2453 Query optimisation
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems

Abstract

In accordance with embodiments, there are provided techniques for processing group membership data in a multi-tenant database system. These techniques for processing group membership data in a multi-tenant database system may enable embodiments to provide great flexibility to a tenant of the architecture to select the content that may be perceived by the tenant users while allowing the owner of the architecture control over the content.

Claims

1. A system having at least a processor and a memory therein to execute instructions to process group membership data of a database system, wherein the system comprises:

a portal user interface to allow users access to the database system over a network;

the database system to store content;

the database system to store the group membership data within a first dataset at the database system associating individual users as members of one or more groups or sub-groups;

the database system to store Access Authorization Relationship (AAR) data within a second dataset at the database system, wherein the AAR data defines additional access rights for one or more users of a first sub-group to data which is accessible to one or more users of a second sub-group due to a managerial relationship between the one or more users of the first and second sub-groups;

wherein the AAR data is independent of the group membership data stored by the first dataset which associates the individual users to the one or more groups or sub-groups and further wherein the AAR data exists independent of any individual users associated with the first and second sub-groups;

the system to receive a request for access to a sub-portion of the content stored within the database system, wherein the request includes requester identification data uniquely identifying an individual user of the database system;

the database system to determine the one or more groups and sub-groups having access to the sub-portion of the content stored at the database system;

the database system to determine the users associated with the one or more groups and sub-groups via a join operation between the first dataset having the group membership data and the second dataset having the AAR data; and

the database system to compare the identification of the user that provided the request for access to the sub-portion of the content with the users associated with the determined users associated with the one or more groups and sub-groups to determine whether access should be granted; and

the portal user interface to transmit the sub-portion of the content in response to the request for access when determined that access should be granted.

2. The system of claim 1, wherein the portal user interface comprises:

a plurality of virtual portals, each to provide an instance of the portal user interface, coupled to allow access to the database system on behalf of multiple users.

3. The system of claim 2, further comprising:

architecture of the system providing access to the multiple users via the plurality of virtual portals to access information on the database system through a common network address.

4. The system of claim 3, wherein the common network address embodies a Universal Resource Locator (URL) through which web-pages and at least the sub-portion of the content stored within the database system is provided to the multiple users by the system depending on each of the multiple users'"'"' respective security or permission level and/or tenant association.

5. The system of claim 1:

wherein a user of the first sub-group is a management representative of a tenant having information stored as the content within the system and wherein other users within the second sub-group are users of a lower permission level, wherein the users of the second sub-group are each salespersons of a salesforce employed by a company affiliated with the tenant having information stored as the content within the system;

wherein each salesperson maintains information applicable to that salesperson'"'"'s sales process and is different from information related to other salespersons'"'"' sales processes including any one or more of contact data, leads data, customer follow-up data, performance data, and goals and progress data applicable to that salesperson'"'"'s personal sales processes; and

wherein a manager of the salespersons of the salesforce employed by the company according to the contractual relationship of the user with other users within the group of the lower permission level is able to view all sale process information for all salespersons as part of the contractual relationship to effectuate a managerial/supervisory relationship with the salespersons.

6. The system of claim 5:

wherein the other users within the group of a lower permission level are each located in a geographic region defined as a geographic sub-group and wherein the other users within the group of a lower permission level have a managerial relationship with respect to the user of a higher permission level by virtue of an association with the geographic sub-group.

7. The system of claim 5:

wherein the contractual relationship of the user with other users within the group of a lower permission level is transitive according to a business environment in which an individual user'"'"'s change to occupation within a tenant or disassociation from the tenant results in at least one of the users'"'"' right to access information based upon the contractual relationship changing corresponding to the change in occupation within the tenant or the disassociation from the tenant.

8. The system of claim 1:

wherein the system implements a web-based customer relationship management (CRM) system having a plurality of application servers therein, each configured to implement and execute CRM software applications as well as provide related data, code, forms, webpages, and the sub-portion of the content stored within the database system to and from a plurality of users of the system.

9. The system of claim 8:

wherein the system implements applications in addition to the CRM software applications to provide tenant access to multiple hosted standard and/or custom applications including the CRM software applications, user applications, and/or third party developer applications;

wherein the system manages creation and storage of the applications into one or more database system objects and executes the applications within a virtual machine inside a process space of the system.

10. The system of claim 1, further comprising:

a security mechanism to keep each of a plurality of tenants'"'"' data separate unless the data is shared or made accessible to the user of a given tenant subject to a contractual relationship of users of the first sub-group with users of the second sub-group.

11. A computer-implemented method to execute within a system having at least a processor and a memory therein to execute instructions for processing group membership data, wherein the method comprises:

allowing users access to the database system over a network via a portal user interface;

storing content at the database system;

storing the group membership data within a first dataset at the database system associating individual users as members of one or more groups or sub-groups;

storing Access Authorization Relationship (AAR) data within a second dataset at the database system, wherein the AAR data defines additional access rights for one or more users of a first sub-group to data which is accessible to one or more users of a second sub-group due to a managerial relationship between the one or more users of the first and second sub-groups;

wherein the AAR data is independent of the group membership data stored by the first dataset which associates the individual users to the one or more groups or sub-groups and further wherein the AAR data exists independent of any individual users associated with the first and second sub-groups;

receiving a request for access to a sub-portion of the content stored within the database system, wherein the request includes requester identification data uniquely identifying an individual user of the database system;

determining the one or more groups and sub-groups having access to the sub-portion of the content stored at the database system;

determining the users associated with the one or more groups and sub-groups by joining the first dataset having the group membership data and the second dataset having the AAR data; and

comparing the identification of the user that provided the request for access to the sub-portion of the content with the users associated with the determined users associated with the one or more groups and sub-groups to determine whether access should be granted; and

transmitting the sub-portion of the content in response to the request for access when determined that access should be granted.

12. The computer-implemented method of claim 11, wherein determining that access should be granted further includes generating a results table and ascertaining whether the requestor identification data matches an entry in the results table.

13. The computer-implemented method of claim 11, wherein an Associational Data Registry associates individual users with groups and organizes relationships between groups and users amongst multiple tables.

14. The computer-implemented method of claim 11, further comprising:

processing the request for access to the sub-portion of the content as a query, wherein query includes;

(i) the determining the one or more groups and sub-groups having access to the sub-portion of the content stored at the database system, (ii) the determining the users associated with the one or more groups and sub-groups by joining the first dataset having the group membership data and the second dataset having the AAR data, and (iii) the comparing the identification of the user that provided the request for access to the sub-portion of the content with the users associated with the determined users associated with the one or more groups and sub-groups to determine whether access should be granted.

15. The computer-implemented method of claim 11,

wherein the portal user interface comprises:

a plurality of virtual portals, each to provide an instance of the portal user interface, coupled to allow access to the database system on behalf of multiple users.

16. The computer-implemented method of claim 11:

wherein the sub-portion of the content of the database system for which access is requested is an account, and

wherein determining that access should be granted further comprises referencing an Associational Data Registry associating groups with the account.

17. The computer-implemented method of claim 11, further comprising:

determining that resources and/or content requested to be provided is improper and responsively restricting the resources and/or content requested from being made accessible to the requestor.

18. The computer-implemented method of claim 17, further comprising:

notifying an owner, provider, tenant, or other entity associated with the resources and/or content improperly requested of the improper request by transmitting an e-mail message, an instant message, and/or a letter.

19. Non-transitory machine-readable storage media having instructions stored thereupon for processing group membership data in a system having at least a processor and a memory therein, that, when the instructions are executed by the processor of the system, the instructions cause the system to perform operations including:

allowing users access to the database system over a network via a portal user interface;

storing content at the database system;

storing the group membership data within a first dataset at the database system associating individual users as members of one or more groups or sub-groups;

storing Access Authorization Relationship (AAR) data within a second dataset at the database system, wherein the AAR data defines additional access rights for one or more users of a first sub-group to data which is accessible to one or more users of a second sub-group due to a managerial relationship between the one or more users of the first and second sub-groups;

wherein the AAR data is independent of the group membership data stored by the first dataset which associates the individual users to the one or more groups or sub-groups and further wherein the AAR data exists independent of any individual users associated with the first and second sub-groups;

receiving a request for access to a sub-portion of the content stored within the database system, wherein the request includes requester identification data uniquely identifying an individual user of the database system;

determining the one or more groups and sub-groups having access to the sub-portion of the content stored at the database system;

determining the users associated with the one or more groups and sub-groups by joining the first dataset having the group membership data and the second dataset having the AAR data; and

comparing the identification of the user that provided the request for access to the sub-portion of the content with the users associated with the determined users associated with the one or more groups and sub-groups to determine whether access should be granted; and

transmitting the sub-portion of the content in response to the request for access when determined that access should be granted.

20. The non-transitory machine-readable storage media of claim 19, wherein determining that access should be granted further includes generating a results table and ascertaining whether the requestor identification data matches an entry in the results table.