# US 10,482,286 B2 · Unified system for authentication and authorization > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,482,286 B2 - Document ID: US10482286B2 - Status: Granted - Kind: B2 - Application number: 15/331,591 - Filed: 2016-10-21 - Published: 2017-02-09 - Granted: 2019-11-19 - Earliest claimed: 2009-11-06 - Assignees: Red Hat, Inc. - Applicants: Red Hat, Inc. - Inventors: David Zeuthen - Web page: https://patentgrep.com/patent/US10482286B2 ## CPC - G06F 21/629: {to features or functions of an application} - G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints - G06F 21/6281: {at program execution time, where the protection is within the operating system} - H04L 63/102: {Entity profiles} - G06F 21/30: Authentication, i.e. establishing the identity or authorisation of security principals - G06F 21/44: Program or device authentication - G06F 21/445: {by mutual authentication, e.g. between devices or programs} - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A request is received from a trusted application to authorize a client application that requests a service offered by the trusted application. In view of the request, it is determined whether the client application is authorized to access the trusted application in view of an authorization policy. An authentication of a user of the client application is caused in response to determining the client application is authorized to access the trusted application. An authorization result is returned to the trusted application in view of the determining and the authentication. ## Claims ### Claim 1 A method of performing an authorization for access to a service offered by a trusted application comprising: receiving, by an authorization framework executed by a processing device, a request from the trusted application to authorize a client application that requests the service offered by the trusted application, wherein the request identifies the client application and an action to be carried out by the trusted application; determining, in view of the request, whether the client application is authorized to access the trusted application in view of an authorization policy; causing an authentication of a user of the client application in response to determining the client application is authorized to access the trusted application; and returning, by the authorization framework and to the trusted application, an authorization result in view of the determining and the authentication that indicates to the trusted application whether to offer the client application the service and whether to carry out the action. ### Claim 2 (depends on 1) The method of claim 1, wherein the trusted application is a software application to offer the service to the client application, and wherein the service requested by the client application is other than authorization and authentication. ### Claim 3 (depends on 1) The method of claim 1, wherein the request identifies the user of the client application. ### Claim 4 (depends on 1) The method of claim 1, wherein causing the authentication of the user comprises invoking an authentication agent to collect one or more credentials from the user that are used to access the service. ### Claim 5 (depends on 4) The method of claim 4, wherein the user accesses the client application within a session, and wherein the authentication agent runs in the session. ### Claim 6 (depends on 4) The method of claim 4, wherein the user accesses the client application within a session, and wherein the authentication agent runs outside the session. ### Claim 7 (depends on 4) The method of claim 4, wherein the one or more credentials comprise a fingerprint. ### Claim 8 (depends on 4) The method of claim 4, wherein the authentication agent is to display a graphical user interface to obtain the one or more credentials from the user, and wherein the one or more credentials comprise a credential associated with a super user that is used to access the service. ### Claim 9 (depends on 4) The method of claim 4, wherein the authentication agent is to display a graphical user interface that enables the user to select a predetermined authorized user and a credential associated with the predetermined authorized user that is used to access the service. ### Claim 10 (depends on 1) The method of claim 1, further comprising accessing a different authority to perform at least one of additional authorization of the client application or additional authentication of the user. ### Claim 11 A non-transitory computer-readable medium comprising instructions that, responsive to execution by a processing device, cause the processing device to perform operations comprising: receiving, by an authorization framework executed by the processing device, a request from a trusted application to authorize a client application that requests a service offered by the trusted application, wherein the request identifies the client application and an action to be carried out by the trusted application; determining, in view of the request, whether the client application is authorized to access the trusted application in view of an authorization policy; causing an authentication of a user of the client application in response to determining the client application is authorized to access the trusted application; and returning, by the authorization framework and to the trusted application an authorization result in view of the determining and the authentication that indicates to the trusted application whether to offer the client application the service and whether to carry out the action. ### Claim 12 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein the trusted application is a software application to offer the service to the client application, and wherein the service requested by the client application is other than authorization and authentication. ### Claim 13 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein the request identifies the user of the client application. ### Claim 14 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein causing the authentication of the user comprises invoking an authentication agent to collect one or more credentials from the user that are used to access the service. ### Claim 15 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein the user accesses the client application within a session, and wherein the authentication agent runs outside the session. ### Claim 16 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein the one or more credentials comprise a fingerprint. ### Claim 17 A system to perform an authorization for access to a service offered by a trusted application comprising: a memory; and a processing device, operatively coupled to the memory, to: receive, by an authorization framework executed by the processing device, a request from the trusted application to authorize a client application that requests the service offered by the trusted application, wherein the request identifies the client application and an action to be carried out by the trusted application; determine, in view of the request, whether the client application is authorized to access the trusted application in view of an authorization policy; cause an authentication of a user of the client application in response to determining the client application is authorized to access the trusted application; and return, by the authorization framework and to the trusted application, an authorization result in view of the determining and the authentication that indicates to the trusted application whether to offer the client application the service and whether to carry out the action. ### Claim 18 (depends on 17) The system of claim 17, wherein the request identifies the user of the client application. ### Claim 19 (depends on 17) The system of claim 17, wherein to cause the authentication of the user, the processing device to invoke an authentication agent to collect one or more credentials from the user that are used to access the service, and wherein the authentication agent runs outside a session that the user uses to access the client application. ### Claim 20 (depends on 19) The system of claim 19, wherein the one or more credentials comprise a fingerprint.