Hosted application access management

A system comprising:

• one or more processing devices;
• and
• a memory to store computer-executable instructions that, if executed, cause the one or more processing devices to:
• generate a first object associated with a request for access to an application executable by a web service, the request corresponding to a membership-based authentication protocol, wherein the request comprises user identity information and membership information comprising a list of one or more groups associated with the user identity information;
• extract the user identity information and the membership information from the first object;
• generate a second object comprising the user identity information and the membership information in a second protocol enabling access to the web service executing the application;
• translate the second object to the first object;
• and
• determine, by the application executed by the web service, a validity of the request using the membership-based authentication protocol applied to the first object.

A non-transitory computer-readable storage device storing computer-executable instructions that, if executed by one or more processing devices, cause the one or more processing devices to:

• receive, by a first web service, a request for access to an application executable by a second web service, the request comprising user identity information and membership information corresponding to a membership-based authentication protocol;
• generate, by the first web service, a header comprising an encapsulated version of the user identity information and the membership information;
• extract, by an interface of the second web service, the user identity information and the membership information from the header;
• generate, by the interface, a security token comprising a user name and a comma-separated list comprising the membership information;
• translate, by the second web service, the user name and the comma-separated list to an object corresponding to the user identity information and the membership information of the request;
• and
• determine, by the application executing on the second web service, a validity of the request using the membership-based authentication protocol applied to the object.