Patent ID: 9686261
Date: 2017-06-20
CPC Classifications: G06F,H04L,H05K

Claim:
1. A computer-implemented method, comprising: receiving, by a computer of a service provider, a request to define a delegation profile from an administrator of a customer account with the service provider; generating the delegation profile, the delegation profile having an identifier, a validation policy specifying a security principal authorized to assume the delegation profile, and an authorization policy specifying one or more actions the security principal is allowed to perform; receiving a first request from the security principal to assume the delegation profile; after authorizing the first request by verifying that the security principal is authorized to assume the delegation profile according to the validation policy, sending one or more delegation credentials usable to authorize the one or more actions to the security principal; and authorizing a second request to perform at least one of the one or more actions using the one or more delegation credentials, the second request including the one or more delegation credentials.