US 11,930,016 B2
Authentication framework for resource access across organizations
Anshul Dube, Brooklyn, NY (US); Parul Manek, Redmond, WA (US); Steven Mark Silverberg, Bellevue, WA (US); Shankaranand Arunachalam, Redmond, WA (US); Jason Craig Nelson, Woodinville, WA (US); Andrew Burke Ryan, Seattle, WA (US); Robert A. Lowe, Redmond, WA (US); and Ganesh Pandey, Redmond, WA (US)
Assigned to Microsoft Technology Licensing, LLC., Redmond, WA (US)
Filed by Microsoft Technology Licensing, LLC, Redmond, WA (US)
Filed on May 20, 2022, as Appl. No. 17/749,761.
Application 17/749,761 is a continuation of application No. 16/773,526, filed on Jan. 27, 2020, granted, now 11,381,571.
Prior Publication US 2022/0278991 A1, Sep. 1, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/102 (2013.01) [H04L 63/0884 (2013.01)] 20 Claims
 
1. A computer implemented method comprising:
generating a client application entry in a source tenant scope of an OAuth provider having a secret corresponding to a client application and a target service authorization authorizing a target service to access the secret, the client application entry in the source tenant scope including:
a client application identifier identifying the client application,
a resource identifier that identifies a resource, served by a source tenant service corresponding to a source tenant computing system, to be accessed by the client application, and
a permissions definition that defines a permission to perform an operation on the resource;
receiving, from the target service at an authorization server corresponding to the source tenant computing system, a request for a token authorizing access to the resource, the request for the token including the secret corresponding to the client application;
generating, by the authorization server, an authorization result that authorizes the target service to receive the token authorizing access to the resource based on:
the request including the secret, and
the permission definition in the client application entry; and
sending the token to the target service based on the authorization result.