User-customizable permissions in a computing environment

• US 9,710,127 B2
• Filed: 12/03/2014
• Issued: 07/18/2017
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Brock, John Arlan, Dubey, Anjesh, Chang, Aris, Torman, Adam, Hua, Jimmy, Pareek, Bharath Kumar, Bhadouria, Sukrutha Raman, Wong, Belinda
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): GYORFI, THOMAS A
• Application Number:
  US14/559,749
• Publication Number:
  US 20160105409A1
• Time in Patent Office: 958 Days
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers

Abstract

Disclosed are examples of systems, apparatus, methods and computer program products for providing user-customizable permissions governing user access to computing resources in a computing system. For example, a database storing data objects identifying permissions of users, sets of the permissions, and users can be maintained. One or more fields can be displayed on a display of a user device. The one or more fields can be configured to receive input to perform one or more operations. Input can be received from a user via the user interface on the display of the user device. One or more operations can be performed. The database can be updated such that the data objects identify a custom permission or a permission set to which a custom permission has been assigned.

Claims

1. A system comprising:

a database storing data objects identifying permissions of users governing user access to computing resources in a computing system, sets of the permissions, and users; and

a server system in communication with the database, the server system comprising one or more processors configurable to cause;

displaying, in a user interface on a display of a user device, one or more fields configured to receive input to perform one or more of;

defining or updating a custom permission definable by an authorized user of the computing system, associating a custom permission with a computing resource, assigning a custom permission to a permission set, or assigning a permission set to which a custom permission has been assigned to a user;

defining or updating, based on first input from a first user via the user interface on the display of the user device, a custom permission;

associating, based on second input from the first user via the user interface on the display of the user device, the custom permission with a first computing resource, the first computing resource only being accessible to users of the computing system having at least one of a plurality of designated licenses;

processing a request from the first user via the user interface on the display of the user device to assign the custom permission to a first permission set;

determining, responsive to processing the request, that each user to whom the first permission set is assigned has at least one of the plurality of designated licenses; and

assigning, responsive to determining that each user to whom the first permission set is assigned has at least one of the plurality of designated licenses, the custom permission to the first permission set.

2. The system of claim 1, wherein an operational characteristic of a permission is independent of whether the permission is user-defined.

3. The system of claim 1, the one or more processors further configurable to cause:

determining, responsive to a further request from a third user to access a second computing resource, based on one or more data objects in the database, that the third user is not authorized to access the second computing resource; and

denying, responsive to determining that the third user is not authorized to access the second computing resource, the third user access to the second computing resource.

4. The system of claim 1, wherein the custom permission identifies one or more of:

a validation rule blocking designated actions unless a user has the custom permission, a rule defining whether a user can make a selection, a rule defining whether a user can view a page or a section of a page, a workflow rule, a rule governing creation, reading, or editing of a record, or a numeric permission governing an amount of user activity.

5. The system of claim 1, the one or more processors further configurable to cause:

determining that a first permission has been enabled; and

enabling, responsive to determining that the first permission has been enabled, a second permission.

6. The system of claim 1, wherein the first computing resource is associated with one or more customer relationship management (CRM) records stored in a CRM database.

7. The system of claim 1, the one or more processors further configurable to cause:

associating a subset of a permission set with one or more objects in a system external to the computing system; and

assigning one or more users to the subset of the permission set.

8. The system of claim 7, the one or more processors further configurable to cause:

providing, responsive to receiving a further request from the external system to access the database, the external system access to the database.

9. The system of claim 7, wherein the subset of the permission set defines a first license associated with the external system.

10. A computer-implemented method for providing user-customizable permissions governing user access to computing resources in a computing system the method comprising:

maintaining, by one or more servers, a database storing data objects identifying permissions of users, sets of the permissions, and users;

causing to be displayed, in a user interface on a display of a user device of a first user of the computing system, one or more fields configured to receive input to perform one or more of;

defining or updating a custom permission definable by an authorized user of the computing system, associating a custom permission with a computing resource, assigning a custom permission to a permission set, or assigning a permission set to which a custom permission has been assigned to a user;

defining or updating, based on first input from the first user via the user interface on the display of the user device, a custom permission

associating, based on second input from the first user via the user interface on the display of the user device, the custom permission with a first computing resource, the first computing resource only being accessible to users of the computing system having at least one of a plurality of designated licenses;

processing a request from the first user via the user interface on the display of the user device to assign the custom permission to a first permission set;

determining, responsive to processing the request, that each user to whom the first permission set is assigned has at least one of the plurality of designated licenses; and

assigning, responsive to determining that each user to whom the first permission set is assigned has at least one of the plurality of designated licenses, the custom permission to the first permission set.

11. The method of claim 10, wherein an operational characteristic of a permission is independent of whether the permission is user-defined.

12. The method of claim 10, further comprising:

receiving a further request from a third user to access a second computing resource;

determining, based on one or more data objects in the database, that the third user is not authorized to access the second computing resource; and

denying, responsive to determining that the third user is not authorized to access the second computing resource, the third user access to the second computing resource.

13. The method of claim 10, wherein the custom permission identifies one or more of:

a validation rule blocking certain actions unless a user has the custom permission, a rule defining whether a user can make a selection, a rule defining whether a user can view a page or a section of a page, a workflow rule, a rule governing creation, reading, or editing of a record, or a numeric permission governing an amount of user activity.

14. The method of claim 10, further comprising:

determining that a first permission has been enabled; and

enabling, responsive to determining that the first permission has been enabled, a second permission.

15. A computer program product comprising computer-readable program code capable of being executed by one or more processors when retrieved from a non-transitory computer-readable medium, the program code including instructions configurable to cause:

maintaining, by one or more servers, a database storing data objects identifying permissions of users governing user access to computing resources in a computing system, sets of the permissions, and users;

displaying, in a user interface on a display of a user device, one or more fields configured to receive input to perform one or more of;

defining or updating a custom permission definable by an authorized user of the computing system, associating a custom permission with a computing resource, assigning a custom permission to a permission set, or assigning a permission set to which a custom permission has been assigned to a user;

defining or updating, based on first input from a first user via the user interface on the display of the user device, a custom permission;

associating, based on second input from the first user via the user interface on the display of the user device, the custom permission with a first computing resource, the first computing resource only being accessible to users of the computing system having at least one of a plurality of designated licenses;

processing a request from the first user via the user interface on the display of the user device to assign the custom permission to a first permission set;

determining, responsive to processing the request, that each user to whom the first permission set is assigned has at least one of the plurality of designated licenses; and

assigning, responsive to determining that each user to whom the first permission set is assigned has at least one of the plurality of designated licenses, the custom permission to the first permission set.

16. The computer program product of claim 15, wherein an operational characteristic of a permission is independent of whether the permission is user-defined.

17. The computer program product of claim 15, the instructions further configurable to cause:

determining, responsive to a further request from a third user to access a second computing resource, based on one or more data objects in the database, that the third user is not authorized to access the second computing resource; and

denying, responsive to determining that the third user is not authorized to access the second computing resource, the third user access to the second computing resource.

18. The computer program product of claim 15, wherein the custom permission identifies one or more of:

a validation rule blocking certain actions unless a user has the custom permission, a rule defining whether a user can make a selection, a rule defining whether a user can view a page or a section of a page, a workflow rule, a rule governing creation, reading, or editing of a record, or a numeric permission governing an amount of user activity.

19. The computer program product of claim 15, the instructions further configurable to cause:

determining that a first permission has been enabled; and

enabling, responsive to determining that the first permission has been enabled, a second permission.