Patent ID: 11888856
Assignee: MICROSOFT TECHNOLOGY LICENSING, LLC
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC H

Claim 0:
1. A system for authorizing access by a remote principal of a second domain to a secure data resource of a first domain of a domain host, the system comprising:
a processing system that includes one or more processors; and
at least one memory that stores program code to be executed by the processing system to perform a method, the method comprising:
verifying that the remote principal is identified as being associated with a group of the second domain represented in a remote principal object stored in a directory of the first domain at the domain host and inaccessible from the second domain, the group having at least one entitlement to the secure data resource as enumerated in a set of permissions and at least one associated access policy defined by the second domain;
generating an access token for the remote principal that includes the at least one entitlement; and
providing the access token to the remote principal to enable access to the secure data resource by the remote principal.