Methods and systems for provisioning access to customer organization data in a multi-tenant system

A system for controlling access to application program data in a computer network, comprising:

• a central processing unit (CPU);
• and
• a non-transitory computer readable medium storing a plurality of instructions, which when executed, cause the central processing unit to:
• define administrative privileges for a support user within a management organization that maintains the data for the organization stored in the multi-tenant system on the server computer, wherein the support user is authorized to access the data of the organization according to the defined administrative privileges;
• define a support user class of users in an interface to the organization that includes representatives of an independent software vendor (ISV) that provided a multi-tenant database application maintained by a platform provider, wherein a member of the support user class is granted limited privileges with respect to the data;
• generate a Security Assertion Markup Language (SAML) assertion upon request of an ISV support representative to enable access to the data to the extent of the granted limited privileges, the SAML assertion establishing the identity of the ISV support representative and the platform provider serves as an identity provider under a SAML protocol to authorize the ISV support representative to perform maintenance functions for the multi-tenant database application;
• initiate a network session to the organization upon request of the ISV support representative, wherein the network session associates the administrative privileges to the support user class to enable access to the data to the extent of the administrative privileges;
• grant access to the multi-tenant database application to the ISV support representative as an organization user for a limited term, wherein the ISV support representative is granted use privileges of the multi-tenant database application;
• allow the ISV support representative to use the multi-tenant database application as an organization user for the limited term.

A computer program product comprising machine-readable program code stored on a non-transitory computer-readable medium to be executed by one or more processors, the program code including instructions to:

• define administrative privileges for a support user within a management organization that maintains the data for the organization stored in the multi-tenant system on the server computer, wherein the support user is authorized to access the data of the organization according to the defined administrative privileges;
• define a support user class of users in an interface to the organization that includes representatives of an independent software vendor (ISV) that provided a multi-tenant database application maintained by a platform provider, wherein a member of the support user class is granted limited privileges with respect to the data;
• generate a Security Assertion Markup Language (SAML) assertion upon request of an ISV support representative to enable access to the data to the extent of the granted limited privileges, the SAML assertion establishing the identity of the ISV support representative and the platform provider serves as an identity provider under a SAML protocol to authorize the ISV support representative to perform maintenance functions for the application;
• initiate a network session to the organization upon request of the ISV support representative, wherein the network session associates the administrative privileges to the support user class to enable access to the data to the extent of the administrative privileges;
• grant access to the multi-tenant database application to the ISV support representative as an organization user for a limited term, wherein the ISV support representative is granted use privileges of the application;
• and
• allow the ISV support representative to use the multi-tenant database application as an organization user for the limited term.