Method for managing access to protected resources and delegating authority in a computer network

Abstract

In a method, a consumer (), being a software application or web site accessing a service provider () on behalf of a user, transmits (s) to a service provider (), being a software application or web site providing access to protected resources, a request for authorization to access by the consumer () on behalf of a delegatee () the protected resources of a delegator (). The service provider () transmits (s) to a controller () the request for authorization. A request token is also transmitted, which is a value used by the service provider () to register a requested authorization. The controller () determines (s) whether the requested authorization meets policy settings governing the access to the delegator's protected resources. If so, the service provider () grants the authorization registered by the request token, and a third message including the request token is transmitted (s) to the consumer ().