Patent ID: 8874902

Claim:
A method comprising: receiving, by an access control management system, from a first client device, information associated with an encrypted data object, the information including an identification of a role assigned to a user authorized to access the encrypted data object; receiving, by the access control management system, from a second client device, a request for the information associated with the encrypted data object; verifying, by the access control management system, that a user of the second client device is identified in the received information associated with the encrypted data object; verifying, by the access control management system, that the user of the second client device is assigned the role identified in the received information; selecting, by the access control management system, an identity provider from a plurality of identity providers, based on a user identifier included in the request for the received information associated with the encrypted data object, the user identifier associated with the user of the second client device; requesting, by the access control management system, from the selected identity provider, authentication of the user of the second client device; and sending, by the access control management system, to the second client device, the received information associated with the encrypted data object, responsive to the authentication by the selected identity provider of the user of the second client device.