Methods and systems for provisioning access to customer organization data in a multi-tenant system

摘要

Methods and systems are described for providing support representative access to applications deployed in an enterprise network environment. An access provisioning system defines a support user class in a user profile database for an application executed on an organization partition within the network. The support user is granted read only privileges to metadata of the application. An organization administrator can grant support personnel access to the application as a support user, thus the ability to view, analyze, and possibly modify the metadata. The access provisioning system generates a Security Assertion Markup Language (SAML) assertion upon request by the support personnel to enable access to the data to the extent of the granted privileges. The SAML protocol includes authentication of the support representative as an authorized support user within the system.

主权项

1. A computer-implemented method for controlling access to data for an organization stored in a multi-tenant system hosted on a server computer accessible over a network, the method comprising:
defining administrative privileges for a support user within a management organization that maintains the data for the organization stored in the multi-tenant system on the server computer, wherein the support user is authorized to access the data of the organization according to the defined administrative privileges; defining a support user class of users in an interface to the organization that includes representatives of an independent software vendor (ISV) that provided a multi-tenant database application maintained by a platform provider, wherein a member of the support user class is granted limited privileges with respect to the data; generating a Security Assertion Markup Language (SAML) assertion upon request of an ISV support representative to enable access to the data to the extent of the granted limited privileges, the SAML assertion establishing the identity of the ISV support representative and the platform provider serves as an identity provider under a SAML protocol to authorize the ISV support representative to perform maintenance functions for the multi-tenant database application; initiating a network session to the organization upon request of the ISV support representative, wherein the network session associates the administrative privileges to the support user class to enable access to the data to the extent of the administrative privileges; granting access to the multi-tenant database application to the ISV support representative as an organization user for a limited term, wherein the ISV support representative is granted use privileges of the multi-tenant database application; and allowing the ISV support representative to use the multi-tenant database application as an organization user for the limited term.