Dynamic permission roles for cloud based applications

A system, comprising:

• a processor programmed to initiate executable operations comprising:
• receiving, during development of an application, an association between at least one window or pane of the application and at least one data service, wherein the application is provided as a service in a cloud computing environment;
• receiving rules applicable to the at least one window or pane of the application, the rules comprising:
• information indicating a first security role assigned to at least a first user who is allowed to access the window or pane of the application and at least a second security role assigned to at least a second user who is allowed to access the window or pane;
• and
• information indicating whether the window or pane is allowed to access the data service based on the first security role assigned to at least the first user and indicating whether the window or pane is allowed to access the data service based on the second security role assigned to at least the second user;
• based on the rules applicable to the at least one window or pane, automatically extrapolating, by a software development tool executed by a processor, permissions for accessing the data service by the at least one window or pane;
• based on the permissions extrapolated for accessing the data service by the at least one window or pane, automatically creating, by the software development tool, a first binding credential configured to be processed to determine whether the window or pane of the application is granted access to data provided by the data service at runtime while the window or pane is being accessed by at least the first user assigned the first security role, and automatically creating, by the software development tool, at least a second binding credential configured to be processed to determine whether the window or pane of the application is granted access to the data provided by the data service at runtime while the window or pane is being accessed by at least the second user assigned the second security role, wherein the first binding credential specifies a mapping of permissions of users who are assigned the first security role to access the window or pane and a mapping of permissions of the window or pane to access the data provided by the data service while the window or pane is being accessed by the users who are assigned the first security role, and the second binding credential specifies a mapping of permissions of users who are assigned the second security role to access the window or pane and a mapping of permissions of the window or pane to access the data provided by the data service while the window or pane is being accessed by the users who are assigned the second security role;
• and
• assigning the first binding credential and the second binding credential to the window or pane of the application, wherein the application functions as a proxy for access to the data provided by the data service, the application determines, based on the first binding credential, whether the window or pane is granted access to the data provided by the data service at runtime while the window or pane is being accessed by at least the first user who is assigned the first security role, and the application determines, based on the second binding credential, whether the window or pane is granted access to the data provided by the data service at runtime while the window or pane is being accessed by at least the second user who is assigned the second security role;
• responsive to detecting the first user requesting access to the window or pane of the application, accessing the first security role assigned to the first user;
• based on the first security role assigned to the first user, determining whether the first user is allowed to access the window or pane of the application;
• responsive to determining that the first user is allowed to access the window or pane of the application:
• presenting the window or pane of the application to the first user;
• and
• based on the first binding credential, determining whether the window or pane of the application is granted access to the data provided by the data service at runtime;
• and
• responsive to determining that the window or pane of the application is granted access to the data provided by the data service at runtime for the first user, granting, to the window or pane of the application, access to the data provided by the data service as specified by the first binding credential.

A computer program product comprising a computer readable storage medium having program code stored thereon, wherein the computer readable storage medium is not a transitory, propagating signal per se, the program code executable by a processor to perform a method comprising:

• receiving, by the processor, during development of an application, an association between at least one window or pane of the application and at least one data service, wherein the application is provided as a service in a cloud computing environment;
• receiving, by the processor, rules applicable to the at least one window or pane of the application, the rules comprising:
• information indicating a first security role assigned to at least a first user who is allowed to access the window or pane of the application and at least a second security role assigned to at least a second user who is allowed to access the window or pane;
• and
• information indicating whether the window or pane is allowed to access the data service based on the first security role assigned to at least the first user and indicating whether the window or pane is allowed to access the data service based on the second security role assigned to at least the second user;
• based on the rules applicable to the at least one window or pane, automatically extrapolating, by a software development tool executed by a processor, permissions for accessing the data service by the at least one window or pane;
• based on the permissions extrapolated for accessing the data service by the at least one window or pane, automatically creating, by the software development tool, a first binding credential configured to be processed to determine whether the window or pane of the application is granted access to data provided by the data service at runtime while the window or pane is being accessed by at least the first user assigned the first security role, and automatically creating, by the software development tool, at least a second binding credential configured to be processed to determine whether the window or pane of the application is granted access to the data provided by the data service at runtime while the window or pane is being accessed by at least the second user assigned the second security role, wherein the first binding credential specifies a mapping of permissions of users who are assigned the first security role to access the window or pane and a mapping of permissions of the window or pane to access the data provided by the data service while the window or pane is being accessed by the users who are assigned the first security role, and the second binding credential specifies a mapping of permissions of users who are assigned the second security role to access the window or pane and a mapping of permissions of the window or pane to access the data provided by the data service while the window or pane is being accessed by the users who are assigned the second security role;
• and
• assigning the first binding credential and the second binding credential to the window or pane of the application, wherein the application functions as a proxy for access to the data provided by the data service, the application determines, based on the first binding credential, whether the window or pane is granted access to the data provided by the data service at runtime while the window or pane is being accessed by at least the first user who is assigned the first security role, and the application determines, based on the second binding credential, whether the window or pane is granted access to the data provided by the data service at runtime while the window or pane is being accessed by at least the second user who is assigned the second security role;
• responsive to detecting the first user requesting access to the window or pane of the application, accessing the first security role assigned to the first user;
• based on the first security role assigned to the first user, determining whether the first user is allowed to access the window or pane of the application;
• responsive to determining that the first user is allowed to access the window or pane of the application:
• presenting the window or pane of the application to the first user;
• and
• based on the first binding credential, determining whether the window or pane of the application is granted access to the data provided by the data service at runtime;
• and
• responsive to determining that the window or pane of the application is granted access to the data provided by the data service at runtime for the first user, granting, to the window or pane of the application, access to the data provided by the data service as specified by the first binding credential.