METHODS AND SYSTEMS FOR PROVISIONING ACCESS TO CUSTOMER ORGANIZATION DATA IN A MULTI-TENANT SYSTEM

• US 20120096521A1
• Filed: 08/29/2011
• Published: 04/19/2012
• Est. Priority Date: 10/13/2010
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Peddada, Prasad
• Granted Patent: US 8,949,939 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

Embodiments are described for providing support representative access to applications deployed in an enterprise network environment. An access provisioning system defines a support user class in a user profile database for an application executed on an organization partition within the network. The support user is granted read only privileges to metadata of the application. An organization administrator can grant support personnel access to the application as a support user, thus the ability to view, analyze, and possibly modify the metadata. The access provisioning system generates a Security Assertion Markup Language (SAML) assertion upon request by the support personnel to enable access to the data to the extent of the granted privileges. The SAML protocol includes authentication of the support representative as an authorized support user within the system.

Claims

1. A computer-implemented method for controlling access to data for an organization stored on a server computer accessible over a network, the method comprising:

defining administrative privileges for a support user within a management organization that maintains the data for the organization, wherein the support user is authorized to access the data of the organization stored on the server computer;

defining a support user class of users in an interface to the organization, wherein a support user is granted limited privileges with respect to the data; and

initiating a network session to the organization upon request of the support user, wherein the network session associates the administrative privileges to the support user class to enable access to the data to the extent of the administrative privileges.

2. The method of claim 1 wherein the data comprises at least one of:

metadata related to usage parameters of the organization to resources of the system, and metadata of an application installed for use by the organization.

3. The method of claim 2 wherein the network session comprises a web-based http (hypertext transport protocol) session, the method further comprising:

generating a Security Assertion Markup Language (SAML) assertion upon an Internet Protocol request to the organization by the support user initiating a web access to the organization; and

associating the administrative privileges of the support user with the http session for use during access to the organization.

4. The method of claim 3 wherein the server computer supports a multi-tenant database application maintained by a platform provider, and wherein the application is a hosted application comprising part of a package of one or more programs accessible to the organization through login credentials established by the platform provider.

5. The method of claim 4 wherein the application is provided by an independent software vendor (ISV) that provides the application hosted on the server computer for use by the organization.

6. The method of claim 5 wherein the authorized user comprises an ISV support representative performing maintenance functions for the hosted application, and wherein the ISV support representative is granted privileges allowing the support representative to view and modify the metadata in relation to performing debugging functions on the application.

7. The method of claim 6 comprising:

granting access to the application to the ISV as an organization user for a limited term, wherein the organization user is granted use privileges of the application; and

allowing the authorized user to access organization metadata and use the application as the organization user for the limited term if the administrator has granted access to the third party as both a support user and as the organization user.

8. The method of claim 6 wherein the SAML assertion establishes the identity of the ISV support representative and the platform provider serves as an identity provider under a SAML protocol to authorize the ISV support representative as a support user.

9. The method of claim 8 further comprising:

providing a user interface allowing the ISV support representative to select a customer organization to access as a support user; and

generating the SAML assertion upon selection of a uniform resource locator on the user interface by the ISV support representative.

11. A system for controlling access to application program data in a computer network, comprising:

license management means for allowing a support person to access resources utilized by a tenant organization in a multi-tenant system hosted by a server computer;

an index of users listing users that are authorized to access the data of the organization stored on the server computer, wherein a support user class defines users allowed to access the data, wherein a support user is granted limited privileges with respect to the data; and

a data access component configured to generate a Security Assertion Markup Language (SAML) assertion upon request of an authorized user to enable access to the data to the extent of the granted privileges.

12. The system of claim 11 wherein a platform provider maintains the server computer coupled to the network, and wherein the resources include an application provided by a software vendor that provides it to be hosted on the server computer for use by the organization.

13. The system of claim 12 wherein the server computer supports a multi-tenant database application maintained by the platform provider, and wherein the hosted application comprises a package of one or more programs accessible to the organization through login credentials established by the platform provider.

14. The system of claim 12 wherein the data comprises metadata of an application installed for use by the organization.

15. The system of claim 12 wherein the SAML assertion establishes the identity of the support person and the system administrator of the server computer serves as an identity provider to authorize the support person as a support user.

16. The system of claim 15 further comprising an access component configured to:

define administrative privileges of the support user within the platform;

generate a SAML assertion upon an http request to the organization by the support user initiating a web access to the organization; and

associating the administrative privileges of the support user with the http request for use during the web access to the organization.

17. A non-volatile, machine-readable medium containing one or more sequences of instructions for controlling access to an application program on a computer network comprising a plurality of coupled computers, the instructions configured to cause a processor to:

define administrative privileges for a support user within a management organization that maintains the data for the organization, wherein the support user is authorized to access the data of the organization stored on a server computer;

define a support user class of users in an interface to the organization, wherein a support user is granted limited privileges with respect to the data; and

initiate a network session to the organization upon request of the support user, wherein the network session associates the administrative privileges to the support user class to enable access to the data to the extent of the administrative privileges.

18. The medium of claim 17 wherein the data comprises one of:

metadata related to system resource usage by the organization, and metadata of an application installed for use by the organization.

19. The medium of claim 18 wherein the network session comprises a web-based http (hypertext transport protocol) session, the medium further comprising instructions that cause the processor to:

generate a Security Assertion Markup Language (SAML) assertion upon an http request to the organization by the support user initiating a web access to the organization; and

associate the administrative privileges of the support user with the http session or use during the web access to the organization.