Microsoft Technology Licensing, LLC

Caleb Geoffrey Baker

Violet Anna Barhudarian

Oren Jordan Melzer

Anirban Basu

Carlos Adrian Lopez Castro

Jiangfeng Lu

Yordan Ivanov Rouskov

Roberto Anthony Franco

Pui-Yin Winfred Wong

Radhika Kashyap

William Bruce Barr, Iii

John Deurbrouck

Colin Leslie Dellow

Danhua Zhu

Murli D Satagopan

Hervey O Wilson

John Peter Shewchuk

David E Langworthy

Andrew Layman

Alexander Thomas Weinert

Sarat Chandra Subramaniam

Titus Constantin Miron

Gregory C Johnson

Laurentiu Bogdan Cristofor

Dilesh Dhokia

Samuel Devasahayam

Vijayavani Nori

Michael Vincent McLaughlin

Chandra Sekhar Surapaneni

George Adrian Drumea

Etan Micah Basseri

Marcelo Albuquerque Fernandes Mas

Christopher Adam Brooks

Shiung-Vei Yong

Stuart Kwan

Igor Sakhnov

Qian Wang

Zhifeng Wang

Daniel Edward Lee Wood

Pui Yin Winfred Wong

Krishnanand K Shenoy

Abhijeet Kumar Sinha

Robyn Nicole Hicock

Jessica Tian-Hueih Lin

Sandra Jiang

Seng Lin Shee

Jan Lyk Choo

Nitika Gupta

Arturo Huato Lucatero

Adam Edwards

Samantha Kwok

Praveen Erode Murugesan

Charles Edgar Passmore

William Bruce Iii Barr

Murli Dharan Satagopan

Michael V Mclaughlin

Generally discussed herein are devices, systems, and methods for adaptive authorization using a local route as a named location. A method can include defining a local route and a corresponding local route endpoint, associating a compute resource as a destination of the local route endpoint, defining an adaptive authorization policy that limits access to the compute resource to be through the local route endpoint, and enforcing access to the compute resource based on the defined adaptive authorization policy.

Adaptive authorization with local route identifier

Techniques are described herein that are capable of evaluating a result of enforcement of access control policies instead of enforcing the access control policies. For instance, a result of enforcement of an access control policy with regard to sign-in processes is evaluated instead of enforcing the access control policy with regard to the sign-in processes. The evaluation includes monitoring access requests that are received during the sign-in processes. Each access request requests access to a resource. The evaluation further includes comparing attributes of each access request against the access control policy that specifies criteria that are to be satisfied as a prerequisite to granting access to the resource to which access is requested by the respective access request. Metadata associated with the sign-in processes is generated instead of enforcing the access control policy with regard to the sign-in processes.

Evaluating a result of enforcement of access control policies instead of enforcing the access control policies

A computing system configured to support entities having the ability to indicate capability information for capabilities of the entities is illustrated. Embodiments may include an identity provider computer system comprising at least one processor. The identity provider computer system is configured to receive requests for access tokens from entities. The requests include capability information for the entities. The identity provider computer system is further configured to provide access tokens to the entities which include the capability information. The computing system further includes a resource provider computer system comprising at least one processor configured to receive resource requests and access tokens from entities. The access tokens include the capability information. The resource providers are further configured to provide responses to the entities according to the capability information.

Client readiness system

Authenticating computing entities. A method includes at an identity provider, providing a first access token to an entity for use by the entity in obtaining resources from a resource provider. The method further includes, at the identity provider, receiving response information from the entity. The response information from the entity is provided to the entity from the resource provider as a result of the resource provider enforcing policy at the resource provider. At the identity provider, a second access token is provided to the entity. The second access token is provided based on the response information, such that the second access token can be used by the entity to obtain the resources from the resource provider.

Rich token rejection system

Managing an authenticated user session. A method includes a resource provider computer system subscribing to a conditional access termination service for an entity configured to obtain resources from the resource provider computer system through a user session. The resource provider computer system receives an event, related to resource requests, for the entity from the conditional access termination service. The resource provider computer system receives a request for resources from the entity. The resource provider computer system evaluates the request with respect to the event. The resource provider computer system responds to the request based on evaluating the request with respect to the event.

Instant enforcement of centrally configured IT policies

An embodiment disclosed herein is related to computing systems and method for a computing system to generate an access token that includes an IP address from a request. In the embodiment, a request is received for access to one secured data items. The request may include user credentials that specify that a user making the request is permitted to access the secured data items. The user credentials are validated and an Internet Protocol (IP) address that the request was sent from is determined. An access token is generated that includes the IP address that the request was sent from.

Using IP heuristics to protect access tokens from theft and replay

Session lifetime can be adapted based on session reputation. Session reputation can be computed based on sign-in risk and device risk, among other things. Session lifetime corresponds to a length of time a session is valid and can be determined automatically based on the session reputation. Subsequently, a token can be generated and returned in response to successful authentication that identifies a session and is valid for the determined lifetime.

Adaptive session lifetime

Methods, systems, and apparatuses in a computing device enable user access to a resource. The method includes receiving, from a user, a request for access to a resource; accessing an authentication flow for granting access to the resource; obtaining first claims for a user from a first claims provider in the authentication flow; determining a second claims provider in the authentication flow, the second claims provider having a trust relationship with the claims facilitator; directing the user to the second claims provider; receiving second claims for the user from the second claims provider; and enabling the user to access the resource in response to at least the received first and second claims.

Extensible framework for authentication

Described is a technology by which a plug-in (e.g., an ActiveX&#xae; control) instantiated by a web browser calls functions of a credential service to use a set of credential data (e.g., a card file) for logging into a website. If the credential service determines that a previously used card file for the website exists, a representation of that card file is displayed in the browser, and the data of that card file is used to obtain a token for logging in the user. If not found, an icon is presented instead, by which the user can select a user interface that allows selection of another card file that meets that meet the website's requirements.

Browser plug-in for secure credential submission

Authenticating internet application sessions. A method includes downloading client side code that when executed implements one or more client side modules including at least one module with message interception functionality. The method includes executing the client side code to implement the one or more client side modules. A request is sent to an internet application server. In response to the request, a message is received from the internet application server indicating that the request is not authorized. The message from the internet application server indicating that the request is not authorized is intercepted at the one or more client side modules. The one or more client side modules, as a result of the message indicating that the request is not authorized, send a request for authentication in a required format for authentication. Authentication is performed without losing user state associated with the request to the internet application server.

Reauthentication to a web service without disruption

A computer-implemented method for authorizing access by a client application to a resource of a user maintained on a first server computing system, the client application being implemented on a second server computing system, includes receiving a delegation message from the first server computer system to initiate authorization of the access by the client application, issuing an authorization message to the first server computer system, the authorization message comprising an authorization data package for redemption by the client application, the authorization data package comprising first through fourth integral delegation data indicative of the user, the client application, the resource, and a timestamp, respectively, receiving a redemption message from the second server computing system comprising the authorization data package, conducting an analysis of the authorization data package, and sending an access token to the second server computing system based on the analysis.

Authorization messaging with integral delegation data

The subject disclosure relates to authorization based on a determination of permissions that can be granted for an action(s) to be performed on a resource. The determination of the permission is based on a set of rules that represent a theory including a notion of trust that has been divided into different sized tables. The tables are utilized to evaluate two or more input claims and to facilitate a determination of whether access to at least one system resource is to be granted. The evaluation can include matching the two or more input claims to rows in the table, wherein access is allowed if a match is found.

Access control management

Growing community of inventors

Seattle, WA, United States of America

Caleb Geoffrey Baker