# US 10,122,707 B2 · User impersonation/delegation in a token-based authentication system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,122,707 B2 - Document ID: US10122707B2 - Status: Granted - Kind: B2 - Application number: 15/352,282 - Filed: 2016-11-15 - Published: 2017-03-09 - Granted: 2018-11-06 - Earliest claimed: 2011-03-28 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Michael John Fork; Vincent Edmund Price - Web page: https://patentgrep.com/patent/US10122707B2 ## CPC - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - G06F 21/33: using certificates - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - G06F 2221/2115: Third party - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A “trusted service” establishes a trust relationship with an identity provider and interacts with the identity provider over a trusted connection. The trusted service acquires a token from the identity provider for a given user (or set of users) without having to present the user's credentials. The trusted service then uses this token (e.g., directly, by invoking an API, by acquiring another token, or the like) to access and obtain a cloud service on a user's behalf even in the user's absence. This approach enables background services to perform operations within a hosted session (e.g., via OAuth-based APIs) without presenting user credentials or even having the user present. ## Claims ### Claim 1 An identity provider apparatus, comprising: a processor; computer memory holding computer program instructions executed by the processor to perform a set of operations, comprising: establishing a trust relationship with a trusted service over a trusted connection; receiving over the trusted connection from the trusted service a request for a token for one or more authorized users within an authentication domain; responsive to receiving the request over the trusted connection, generating the token without requiring presentation by the trusted service of a user credential; returning the token to the trusted service; responsive to a subsequent receipt from a service provider of the token together with a user identifier associated with a user, the service provider having received the token from the trusted service, validating that the user identifier is within the authentication domain associated with the token; and upon a successful validation, returning a response to the service provider that enables the trusted service to impersonate the user to the service provider. ### Claim 2 (depends on 1) The identity provider apparatus as described in claim 1 wherein the token is a generic token for a set of authorized users and the validating checks to determine that the user credential is associated with the generic token. ### Claim 3 (depends on 1) The identity provider apparatus as described in claim 1 wherein the token is a specific token for an authorized user, and the validating identifies a username associated with the specific token and verifies that the username matches the user credential. ### Claim 4 (depends on 1) The identity provider apparatus as described in claim 1 wherein, for the trusted connection between the trusted service and the identity provider apparatus, the token represents a trusted service-configured subset of a set of target users. ### Claim 5 (depends on 1) The identity provider apparatus as described in claim 1 wherein the generating operation includes scoping the token as a function of one or more of a set of attributes, the attributes being one of: time, location, status and role. ### Claim 6 A method, operable within an identity provider, comprising: establishing a trust relationship with a trusted service over a trusted connection; receiving over the trusted connection from the trusted service a request for a token for one or more authorized users within an authentication domain; responsive to receiving the request over the trusted connection, generating the token without requiring presentation by the trusted service of a user credential; returning the token to the trusted service; responsive to a subsequent receipt from a service provider of the token together with a user identifier associated with a user, the service provider having received the token from the trusted service, validating that the user identifier is within the authentication domain associated with the token; and upon a successful validation, returning a response to the service provider that enables the trusted service to impersonate the user to the service provider. ### Claim 7 (depends on 6) The method as described in claim 6 wherein the token is a generic token for a set of authorized users and the validating checks to determine that the user credential is associated with the generic token. ### Claim 8 (depends on 6) The method as described in claim 6 wherein the token is a specific token for an authorized user, and the validating identifies a username associated with the specific token and verifies that the username matches the user credential. ### Claim 9 (depends on 6) The method as described in claim 6 wherein, for the trusted connection between the trusted service and the identity provider, the token represents a trusted service-configured subset of a set of target users. ### Claim 10 (depends on 6) The method as described in claim 6 wherein the generating operation includes scoping the token as a function of one or more of a set of attributes, the attributes being one of: time, location, status and role. ### Claim 11 A computer program product in a non-transitory computer readable medium for use in a data processing system, the computer program product holding computer program instructions which, when executed by the data processing system serving as an identity provider, perform a set of operations, comprising: establishing a trust relationship with a trusted service over a trusted connection; receiving over the trusted connection from the trusted service a request for a token for one or more authorized users within an authentication domain; responsive to receiving the request over the trusted connection, generating the token without requiring presentation by the trusted service of a user credential; returning the token to the trusted service; responsive to a subsequent receipt from a service provider of the token together with a user identifier associated with a user, the service provider having received the token from the trusted service, validating that the user identifier is within the authentication domain associated with the token; and upon a successful validation, returning a response to the service provider that enables the trusted service to impersonate the user to the service provider. ### Claim 12 (depends on 11) The computer program product as described in claim 11 wherein the token is a generic token for a set of authorized users and the validating checks to determine that the user credential is associated with the generic token. ### Claim 13 (depends on 11) The computer program product as described in claim 11 wherein the token is a specific token for an authorized user, and the validating identifies a username associated with the specific token and verifies that the username matches the user credential. ### Claim 14 (depends on 11) The computer program product as described in claim 11 wherein, for the trusted connection between the trusted service and the identity provider, the token represents a trusted service-configured subset of a set of target users. ### Claim 15 (depends on 11) The computer program product as described in claim 11 wherein the generating operation includes scoping the token as a function of one or more of a set of attributes, the attributes being one of: time, location, status and role.