Patent ID: 7698381

Claim:
A method for constraining delegation of service requests made by a first server on behalf of a client, the method comprising: receiving, at the first server, an authentication mechanism for the client, wherein the authentication mechanism is generated using a first authentication method; authenticating, by the first server, the client based upon the authentication mechanism, wherein such authentication is performed according to the first authentication method; identifying, by the first server, a target service to which access is sought on behalf of the client, wherein the target service is resident on a target server; sending, by the first server, a request according to a second authentication method to a trusted third-party to issue a first service ticket to the first server for the client, wherein the first service ticket is used with the second authentication method, and wherein the second authentication method is different from the first authentication method; receiving, at the first server, the first service ticket to the first server, wherein the first service ticket to the first server specifies that the first service ticket is delegable through the presence of a forwardable flag in the first service ticket; requesting, by the first server, a target service ticket from the trusted third-party to access the target service on behalf of the client, wherein the first server provides the trusted third-party with the first service ticket when requesting the target service ticket, and wherein the target service ticket is used with the second authentication method; and sending the target service ticket to the target server.