Patent ID: 9544294
Date: 2017-01-10
CPC Classifications: G06F,H04L,H04W

Claim:
1. A computer-implemented method comprising: storing a first mapping between a first authorization policy and a first identity domain; receiving, at an authorization server computer, a first token request from a first client application that is associated with the first identity domain, the first token request for accessing a service provided by a resource server computer; in response to receiving the first token request, identifying, based on the first mapping, the first authorization policy for facilitating the first client application to access the service provided by the resource server computer; determining, based on the first authorization policy, a first scope of access information for the first client application to access the service provided by the resource server computer, wherein the first scope of access information indicates a first operation permitted by the first client application while accessing the service, and the first scope of access information indicates a second operation not permitted by the first client application while accessing the service provided by the resource server computer, and wherein determining the first scope of access information based on the first authorization policy comprises determining whether the resource server computer provides the first scope of access information; generating a first token that includes the first scope of access information; and sending, from the authorization sever computer to the first client application, the first token.