Patent ID: 8005965

Claim:
A method for controlling access to protected resources within a distributed data processing system, the method comprising: receiving at a first server from a client a request to access a protected resource and a single-use token associated with the client or a user of the client; validating the single-use token, wherein the single-use token comprises session information for performing session management with respect to the client; determining that the single-use token is a domain token; generating a client authorization credential request; sending to a second server the client authorization credential request, the single-use domain token associated with the client or the use of the client, and a single-use domain token associated with the first server, wherein the first server and the second server are operated within a common domain; generating a response to the request; refreshing the single-use token; validating at the second server the single-use domain token associated with the client or the user of the client and the single-use domain token associated with the first server; generating the client authorization credential; refreshing at the second server the single-use domain token associated with the client or the user of the client and the single-use domain token associated with the first server; and sending to the first server the client authorization credential, the refreshed single-use domain token associated with the client or the user of the client, and the refreshed single-use domain token associated with the first server; and sending the response and the refreshed single-use token to the client.