# US 10,454,940 B2 · Identity cloud service authorization model > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,940 B2 - Document ID: US10454940B2 - Status: Granted - Kind: B2 - Application number: 15/474,341 - Filed: 2017-03-30 - Published: 2017-11-16 - Granted: 2019-10-22 - Earliest claimed: 2016-05-11 - Assignees: Oracle International Corporation - Applicants: Oracle International Corporation - Inventors: Vadim Lander; Hari Sastry; Sreedhar Katti; Sirish V. Vepa; Swathi Vinayak Shenoy - Web page: https://patentgrep.com/patent/US10454940B2 ## CPC - H04L 63/102: {Entity profiles} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/0815: {providing single-sign-on or federations} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system for authorizing access to a resource receives a request for an access token that corresponds to the resource, where the request includes user information and application information. The user information includes a role of the user and the application information includes a role of the application. The system evaluates the request by computing scopes for the access token, including determining an intersection between the user information and the application information. The system then provides the access token that includes the computed scopes, the scopes being based at least on the role of the user and the role of the application. ## Claims ### Claim 1 A method of authorizing access to a resource, the resource accessible via a multi-tenant cloud based system and the resource is protected from access based at least on a tenancy of an access requesting user or an access requesting application, the method comprising: receiving an access token request for an access token that corresponds to the resource, wherein the request comprises user information and application information, the user information comprising a role of the user, a corresponding tenant of the user, and an indication of whether the user is an administrator for the application, and the application information comprising a role of the application; evaluating the access token request by computing scopes for the access token, the computing comprising determining an intersection between the user information and the application information; and providing the access token that comprises the computed scopes, the scopes based at least on the role of the user, the role of the application, and a corresponding tenancy of the resource, and comprises actions allowed on the resource; the access token comprising custom token claims indicating whether the user is the administrator for the application. ### Claim 2 (depends on 1) The method of claim 1, further comprising: receiving the access token with an access authorization request; evaluating if access to the resource to perform an operation is permitted based on the computed scopes, the resource, and the operation. ### Claim 3 (depends on 2) The method of claim 2, wherein the evaluating if access to the resource to perform the operation is permitted is further based on a payload of the access authorization request or indirect attributes of the resource. ### Claim 4 (depends on 1) The method of claim 1, wherein the custom token claims further comprise a tenancy in which the application is defined and a multi-value attribute that comprises administration roles granted to the application. ### Claim 5 (depends on 1) The method of claim 1, the evaluating the access token request further comprising computing scopes based only the user information without the application information based on an onBehalfOfUser property. ### Claim 6 (depends on 1) The method of claim 1, wherein the scopes comprise OAuth scopes. ### Claim 7 (depends on 2) The method of claim 2, wherein the evaluating if access to the resource to perform the operation is permitted is based on an eXtensible Access Control Markup Language (XACML) based authorization policy. ### Claim 8 (depends on 2) The method of claim 2, wherein the evaluating if access to the resource to perform the operation is permitted is based on a Representational State Transfer (REST) request. ### Claim 9 A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, authorizes access to a resource, the resource accessible via a multi-tenant cloud based system and the resource is protected from access based at least on a tenancy of an access requesting user or an access requesting application, the authorizing access comprising: receiving an access token request for an access token that corresponds to the resource, wherein the request comprises user information and application information, the user information comprising a role of the user, a corresponding tenant of the user, and an indication of whether the user is an administrator for the application, and the application information comprising a role of the application; evaluating the access token request by computing scopes for the access token, the computing comprising determining an intersection between the user information and the application information; and providing the access token that comprises the computed scopes, the scopes based at least on the role of the user, the role of the application, and a corresponding tenancy of the resource, and comprises actions allowed on the resource; the access token comprising custom token claims indicating whether the user is the administrator for the application. ### Claim 10 (depends on 9) The computer readable medium of claim 9, the authorizing access further comprising: receiving the access token with an access authorization request; evaluating if access to the resource to perform an operation is permitted based on the computed scopes, the resource, and the operation. ### Claim 11 (depends on 10) The computer readable medium of claim 10, wherein the evaluating if access to the resource to perform the operation is permitted is further based on a payload of the access authorization request or indirect attributes of the resource. ### Claim 12 (depends on 9) The computer readable medium of claim 9, wherein the custom token claims further comprise a tenancy in which the application is defined and a multi-value attribute that comprises administration roles granted to the application. ### Claim 13 (depends on 10) The computer readable medium of claim 10, further generating an evaluation decision comprising one or more obligations. ### Claim 14 (depends on 9) The computer readable medium of claim 9, wherein the scopes comprise OAuth scopes. ### Claim 15 (depends on 10) The computer readable medium of claim 10, wherein the evaluating if access to the resource to perform the operation is permitted is based on an eXtensible Access Control Markup Language (XACML) based authorization policy. ### Claim 16 (depends on 10) The computer readable medium of claim 10, wherein the evaluating if access to the resource to perform the operation is permitted is based on a Representational State Transfer (REST) request. ### Claim 17 A multi-tenant cloud based system for authorizing access to a resource, the resource protected from access based at least on a tenancy of an access requesting user or an access requesting application, the system comprising: a processor that implements a microservice, the microservice functionality comprising: receiving an access token request for an access token that corresponds to the resource, wherein the request comprises user information and application information, the user information comprising a role of the user, a corresponding tenant of the user, and an indication of whether the user is an administrator for the application, and the application information comprising a role of the application; evaluating the access token request by computing scopes for the access token, the computing comprising determining an intersection between the user information and the application information; and providing the access token that comprises the computed scopes, the scopes based at least on the role of the user, the role of the application, and a corresponding tenancy of the resource, and comprises actions allowed on the resource; the access token comprising custom token claims indicating whether the user is the administrator for the application. ### Claim 18 (depends on 17) A cloud based system of claim 17, the microservice functionality further comprising: receiving the access token with an access authorization request; evaluating if access to the resource to perform an operation is permitted based on the computed scopes, the resource, and the operation. ### Claim 19 (depends on 18) The cloud based system of claim 18, wherein the evaluating if access to the resource to perform the operation is permitted is further based on a payload of the access authorization request or indirect attributes of the resource. ### Claim 20 (depends on 17) The cloud based system of claim 17, wherein the computed scopes comprise a collection of actions permitted on the resource.