Privileged access to managed content
AssigneeEMC Corporation
InventorRoger W. Kilday
Life of this patent
Estimating the term…
Abstract
Privileged access to managed content is disclosed. In some embodiments, a privileged portion of application code manages user access to managed content at a level of access greater than the user would otherwise be afforded. The privileged code moves a content management session up or down in levels of access as required to allow a user to perform through the application one or more specific actions it is desired to permit the user to do in a particular context (e.g., at a particular time in the lifecycle of an item of content and/or a particular point in a business process or work flow), including to permit the user to perform an action it is not desired to let the user perform in other contexts, such as write a particular value to a content item it is not desired to allow the user to write to otherwise.
Claims17
A method of controlling access to managed content, comprising:
- reviewing a privileged code access control list (ACL) entry associated with a privileged portion of application code;
- reviewing a user ACL entry associated with a user;
- receiving from a privileged portion of application code an indication that a content management session associated with a user is to be promoted from a first level of access associated with the user ACL entry to a second level of access associated with the privileged code ACL entry based at least in part on the user's particular context;
- wherein receiving from a privileged portion of application code an indication that a session associated with a user is to be promoted from a first level of access associated with the user ACL entry to a second level of access associated with the privileged portion of application code includes receiving from the privileged code ACL entry an indication that the user is to be considered with respect to the session a member of a dynamic group associated with the privileged portion of code;
- and
- using a processor to allow a request associated with the content management session to perform with respect to a content item an operation that requires the second level of access through an application associated with the privileged portion of application code.
A content management system, comprising:
- a communication interface configured to receive from a privileged portion of application code an indication that a content management session associated with a user is to be promoted from a first level of access associated with a user ACL entry to a second level of access associated with a privileged code ACL entry based at least in part on the user's particular context,
- wherein receiving from a privileged portion of application code an indication that a session associated with a user is to be promoted from a first level of access associated with the user ACL entry to a second level of access associated with the privileged code ACL entry includes receiving from the privileged portion of application code an indication that the user is to be considered with respect to the session a member of a dynamic group associated with the privileged portion of code;
- a processor coupled to the communication interface and memory, and configured to:
- review the privileged code ACL entry associated with the privileged portion of application code;
- review the user ACL entry associated with the user;
- and
- allow a request associated with the content management session to perform with respect to a content item an operation that requires the second level of access through an application associated with the privileged portion of application code;
- and
- a memory coupled to the processor and configured to provide the processor with stored instructions.
A computer program product for controlling access to managed content, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
- reviewing a privileged code access control list (ACL) entry associated with a privileged portion of application code;
- reviewing a user ACL entry associated with a user;
- receiving from a privileged portion of application code an indication that a content management session associated with a user is to be promoted from a first level of access associated with the user ACL entry to a second level of access associated with the privileged code ACL entry based at least in part on the user's particular context;
- wherein receiving from a privileged portion of application code an indication that a session associated with a user is to be promoted from a first level of access associated with the user ACL entry to a second level of access associated with the privileged code ACL entry includes receiving from the privileged portion of application code an indication that the user is to be considered with respect to the session a member of a dynamic group associated with the privileged portion of code;
- and
- allowing a request associated with the content management session to perform with respect to a content item an operation that requires the second level of access through an application associated with the privileged portion of application code.
Dependencies are inferred from the claim text.