Microsoft Technology Licensing, LLC

Shiung-Vei Yong

John Peter Shewchuk

Yordan Ivanov Rouskov

David E Langworthy

Andrew Layman

Hervey O Wilson

Caleb Geoffrey Baker

Adrian Frei

Yavor Vesselinov Angelov

Ross Peter Adams

Hirsch Patrick Singhal

Prithviraj Sanjeev Kanherkar

Pavel Michailov

Arieh Bibliowicz

Thomas Lyle Norling

Qian Wang

Jason Donchey Nutter

William Alden Bartlett

Charles Edgar Passmore

Hagar Romach

Edan Doitch

The disclosed technology is generally directed to web authentication. In one example of the technology, authentication of a broker with an identity provider is initiated. The broker is a first application that is executing in a top-level frame. At the broker, from a second application that is executing on a first descendent frame that is a descendant frame of the top-level frame, a token request is received. Via the broker, a first token is requested from the identity provider on behalf of the second application. The first token is associated with an authorization of secure delegated remote access of at least one resource by the second application. At the broker, from the identity provider, the first token is received. Via the broker, the first token is provided to the second application.

Token brokering in parent frame on behalf of child frame

Single sign-on identity management between local and cloud-based systems is provided. A remote or cloud-based authentication endpoint is registered as a local device, service or resource in a user's local directory services system. A local device and associated user requesting access to cloud-based resources will then see the authentication endpoint as an internal (inside the enterprise) server and may supply an authentication ticket which includes on-premises log-in or sign-on identity for the user. The remote or cloud-based authentication endpoint may then validate the authentication ticket, and the user may then access devices, applications and services operated in association with the remote or cloud-based authentication endpoint without a second or separate log-in or sign-on and without use of additional authentication equipment at the user's enterprise network.

Single sign-on identity management between local and remote systems

The subject disclosure relates to authorization based on a determination of permissions that can be granted for an action(s) to be performed on a resource. The determination of the permission is based on a set of rules that represent a theory including a notion of trust that has been divided into different sized tables. The tables are utilized to evaluate two or more input claims and to facilitate a determination of whether access to at least one system resource is to be granted. The evaluation can include matching the two or more input claims to rows in the table, wherein access is allowed if a match is found.

Access control management

Growing community of inventors

Issaquah, WA, United States of America

Shiung-Vei Yong