Patent ID: 11954238
Assignee: PURE STORAGE, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC G

Claim 11:
12. A system comprising:
a computer processor;
a storage system comprising a plurality of resources;
a remote management system communicatively coupled to the storage system and comprising a plurality of applications configured to remotely access the storage system; and
an access control system configured to control, based on defined permissions of user roles to access resource types, remote access to the plurality of resources of the storage system by way of the remote management system, the access control system externalized from the plurality of applications and configured to control remote access to the storage system by each application in the plurality of applications, wherein controlling remote access to the plurality of resources of the storage system by way of the remote management system comprises the access control system directing the processor to:
access role permissions configuration data that specifies the user roles and, for each user role of the user roles, a first set of permitted operations on the resource types and a second set of permitted operations on the resource types, wherein the second set of permitted operations on the resource types is a subset of the first set of permitted operations on the resource types;
select, based on a user role of a user requesting access to the storage system and from either the first set of permitted operations or the second set of permitted operations specified by the role permissions configuration data, a permitted operation on a resource type; and
use the permitted operation to control access to a subset of the plurality of resources that are mapped to the resource type;
wherein the plurality of resources of the storage system are mapped to the resource types by code associated with the plurality of resources indicating the types of the resources of the plurality of resources;
wherein the plurality of resources comprise functions of an application program interface (API) configured to be called to interface with storage resources of the storage system.