Adaptive permission token
Assigneesalesforce.com, inc.
InventorsHarish Balijepalli, Ryan Michael Michela
Life of this patent
Estimating the term…
Abstract
Techniques are disclosed relating to generating permission tokens. A first computer system may store permission information for a user that indicates a plurality of permissions for the user for accessing data within a database system. The first computer system may receive, from a user device, a permission request for permissions to perform actions at a second computer system. In response to authenticating the user, the first computer system may create a token with one or more permissions for the user by selecting the one or more permissions from the plurality of permissions stored for the user such that the created token does not exceed a specified size and may provide the token to the user device.
Claims20
A non-transitory computer readable medium having program instructions stored thereon that are capable of causing a first computer system to perform operations comprising:
- creating, for a user associated with a second computer system, a first token that includes a first set of permissions selected from a plurality of permissions that are maintained for the user, wherein the plurality of permissions indicate actions that the user can request the second computer system to perform, and wherein the first token is created to not exceed a specified size;
- sending the first token to a user device of the user;
- subsequently receiving a permission request for a particular permission of the plurality of permissions that is not indicated in the first token;
- and
- in response to the permission request, creating a second token that includes a second set of permissions having the particular permission, wherein the second token is created to not exceed the specified size.
A method, comprising:
- creating, by a first computer system for a user associated with a second computer system, a first token that includes a first set of permissions selected from a plurality of permissions that are available to the user, wherein the plurality of permissions include actions that the user can request the second computer system to perform, and wherein a number of permissions included in the first set of permissions does not exceed a maximum number of permissions;
- sending, by the first computer system, the first token to a user device of the user;
- subsequently receiving, by the first computer system, a request for a particular permission of the plurality of permissions that is not indicated in the first token;
- and
- in response to the request, the first computer system creating a second token that includes a second set of permissions having the particular permission, and wherein a number of permissions included in the second set of permissions does not exceed the maximum number of permissions.
A method, comprising:
- maintaining, by a security server system, a plurality of permissions for a particular user of an application server system, wherein a given permission of the plurality of permissions allows for the particular user to cause the application server system to perform a corresponding action on behalf of the particular user;
- identifying, by the security server system, a set of the plurality of permissions, wherein the set of permissions does not a maximum number of permissions permissible to include in a token, wherein the maximum number is less than a number of the plurality of permissions;
- creating, by the security server system, a first token that includes the set of permissions;
- in response to receiving a request for a particular permission of the plurality of permissions that is not included in the first token, the security server system modifying the set of permissions to include the particular permission;
- and
- creating, by the security server system, a second token that includes the modified set of permissions.
Dependencies are inferred from the claim text.