An Authorization Mechanism for a Document Database
Hannu Peltonen, Kari Alho, Tomi Männistö, Reijo Sulonen · 1994
Abstract A programmable authorization mechanism for an engineering document database is described. The database stores documents and their versions in a commercial relational database. Documents and other objects contain user-defined attributes. Release and approval procedures of the documents are described by means of state graphs that specify the possible states of a document and the transitions between them. The system consists of centralized server and client programs, which communicate with the server using a specific protocol. The database administrator must be able to formulate rules that tell who is allowed to do particular database operations; rules that tell which operations are allowed in particular document states; and rules that describe consistency invariants between attributes. These rules are expressed by means of authorization procedures written in a special language. Whenever the server receives an operation request, it executes the corresponding authorization procedure. The system can thus be easily adapted to an organization without actually modifying the client or server programs.