US 10,476,860 B1 · Credential translation

Abstract

An API provides a frontend interface to one or more backend services. Access to an API is controlled by a set of frontend credentials, and access to the one or more backend services is controlled by a set of backend credentials. A credential-translation table maintained within the API links each backend credential to one or more frontend credentials. Links between frontend and backend credentials may be managed by an administrator of the API. The API uses the translation table to translate frontend credentials provided with an API call into backend credentials used to access backend services. The API provides users with the ability to update the backend credentials in the credential-translation table based at least in part on the frontend credentials provided by the user. The API may limit the ability to extract backend credentials to administrative users.

Claims20

Dependent claims

A computer-implemented method, comprising:

obtaining, from a client application, a first request to invoke an interface component hosted by a computer system, the first request identifying a first credential;
authorizing invocation of the interface component based at least in part on the first credential;
identifying, from a credential-translation table, a second credential that is associated with the first credential in accordance with a sharing context of the second credential, the sharing context specifying a request scope that limits access to the second credential to one of a plurality of selectable scopes, the second credential allowing the interface component to access a backend service;
providing the second credential to the interface component;
submitting a second request to the backend service, the second request authorized by the backend service using the second credential;
and
fulfilling the first request based at least in part on results received from the backend service in response to the second request.

4 more elements

A non-transitory computer-readable storage medium including stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:

implement an interface component that exposes a web-service interface to a client application;
authorize access to the interface component using a credential identified by the client application;
identify, from a credential store maintained by the computer system, and based at least in part on the credential, a set of backend credentials that allow access to a backend service, the set of backend credentials identified based on a sharing context of the set backend credentials, the sharing context specifying a request scope from a plurality of scopes that are able to be specified;
provide the set of backend credentials to the interface component;
select a particular backend credential from the set of backend credentials;
and
submit a request from the interface component to the backend service, the request authorized by the particular backend credential.

4 more elements

Dependencies are inferred from the claim text.

Credential translation

Life of this patent

Credential translation

Life of this patent

Abstract

Claims20