Coordinating access authorization across multiple systems at different mutual trust levels

A system comprising:

• one or more processors;
• and
• memory storing one or more applications that, when executed on the one or more processors, perform an operation comprising:
• receiving, from a beneficiary application via a network, an initiation message requesting the beneficiary application be authorized to access data hosted at a resource server connected to the network;
• verifying that a valid session for a user exists between the beneficiary application and an agent executing at a user device;
• instructing the agent to obtain an authorization code on behalf of the beneficiary application from an authorization server associated with the resource server;
• receiving the authorization code from the agent;
• obtaining an access token and a refresh token from the authorization server based on the authorization code;
• generating a partner authorization (PA) token associated with the access token and the refresh token;
• and
• transmitting the PA token to the beneficiary application to allow the beneficiary application to retrieve the access token when the user is logged in to the beneficiary application.

A non-transitory computer-readable storage medium containing instructions that, when executed by one or more processors, perform an operation comprising:

• receiving, at a partner authorization (PA) system from an application hosted at a beneficiary server via a network, a first message indicating a user wants to authorize the application to access data hosted at a resource server;
• generating a request token and a state identifier based on the first message;
• sending, to the application in a second message via the network, the request token and the state identifier;
• receiving, at the PA system from an agent executing at a client device via the network, a third message, wherein the third message includes a first copy of the request token and a first copy of the state identifier;
• verifying the first copy of the state identifier received in the third message matches the state identifier sent in the second message;
• verifying the first copy of the request token received in the third message matches the request token sent in the second message to confirm the agent is in communication with the application;
• sending, to the agent via the network in response to the third message, a fourth message, wherein the fourth message includes the state identifier and specifies a uniform resource identifier (URI) of an authorization server associated with the resource server;
• receiving, from the agent at the client device via the network, a fifth message that includes a second copy of the state identifier and an authorization code associated with the resource server;
• and
• verifying the second copy of the state identifier received in the fifth message matches the state identifier sent in the second message.