Policy enforcement system

A system comprising:

• a client device;
• a file system comprising a first node and a second node;
• a policy enforcement system comprising a processor;
• and a non-transitory computer-readable medium coupled to the processor and having instructions stored thereon, which, when executed by the processor, cause the processor to perform operations comprising:
• storing, by the policy enforcement system, a plurality of policies and data associating a plurality of user credentials with the plurality of policies;
• receiving, from a client device by the policy enforcement system, a request for data from the file system, the request further comprising user credentials;
• forwarding, by the policy enforcement system, the request to the first node;
• receiving, from the first node, a redirect request comprising data specifying the second node that stores the data from the file system;
• appending, by the policy enforcement system, the user credentials to the redirect request to generate a custom redirect request;
• responding to the client device, including sending the custom redirect request to the client device;
• receiving, from the client device, a request for data from the second node, the request for data from the second node having the user credentials;
• forwarding, by the policy enforcement system, the request for data from the second node to the second node that stores the data from the file system;
• receiving the data from the file system from the second node;
• selecting from the plurality of policies, based on the received user credentials and the data associating the plurality of user credentials with the plurality of policies, one or more policies that correspond to the received user credentials;
• filtering, by the policy enforcement system, the data from the file system based on the one or more policies;
• and
• sending the filtered data to the client device.

A non-transitory computer-readable medium having instructions stored thereon, which, when executed by a processor, cause the processor to perform operations comprising:

• storing, by a policy enforcement system, a plurality of policies and data associating a plurality of user credentials with the plurality of policies;
• receiving, from a client device by the policy enforcement system, a request for data from a file system, the request further comprising user credentials;
• forwarding, by the policy enforcement system, the request to a first node;
• receiving, from the first node, a redirect request comprising data specifying a second node that stores the data from the file system;
• appending, by the policy enforcement system, the user credentials to the redirect request to generate a custom redirect request;
• responding to the client device, including sending the custom redirect request to the client device;
• receiving, from the client device, a request for data from the second node, the request for data from the second node having the user credentials;
• forwarding, by the policy enforcement system, the request for data from the second node to the second node that stores the data from the file system;
• receiving the data from the file system from the second node;
• selecting from the plurality of policies, based on the received user credentials and the data associating the plurality of user credentials with the plurality of policies, one or more policies that correspond to the received user credentials;
• filtering, by the policy enforcement system, the data from the file system based on the one or more policies;
• and
• sending the filtered data to the client device.