Delegated access control of an enterprise network

An identity management system, comprising:

• memory;
• one or more network interfaces;
• and
• at least one processor configured to:
• store in the memory data representing a trust chain formed between a local domain and a remote domain, wherein the local domain has an associated secure enterprise computing network, and wherein the trust chain identifies one or more outside entities associated with the remote domain that are authorized to access the secure enterprise computing network;
• grant a delegation authority to a parent entity among the one or more outside entities associated with the remote domain, wherein the delegation authority enables the parent entity to add outside entities to the trust chain as child entities;
• store in the memory data indicating that the parent entity has been granted the delegation authority to add child entities so that the child entities associated with the remote domain can access the secure enterprise computing network of the local domain;
• receive a request for access to the secure enterprise computing network by one of the child entities associated with the remote domain;
• validate the one of the child entities connected to the local domain on the trust chain by verifying the one of the child entities remains associated with the remote domain;
• and
• control access by the one of the child entities to the secure enterprise computing network based on the trust chain.

A non-transitory computer readable storage media encoded with instructions that, when executed by a processor of a network device, cause the processor to:

• store, in an identity management system, data representing a trust chain formed between a local domain and a remote domain, wherein the local domain has an associated secure enterprise computing network, and wherein the trust chain identifies one or more outside entities associated with the remote domain that are authorized to access the secure enterprise computing network;
• grant a delegation authority to a parent entity among the one or more outside entities associated with the remote domain, wherein the delegation authority enables the parent entity to add outside entities to the trust chain as child entities;
• store, in the identity management system, data indicating that the parent entity has been granted the delegation authority to add child entities so that the child entities associated with the remote domain can access the secure enterprise computing network of the local domain;
• receive, at the identity management system, a request for access to the secure enterprise computing network by one of the child entities associated with the remote domain;
• validate the one of the child entities connected to the local domain on the trust chain by verifying the one of the child entities remains associated with the remote domain;
• and
• control access by the one of the child entities to the secure enterprise computing network based on the trust chain.