Complete forward access sessions

A computer-implemented method, comprising:

• receiving an authentication request to verify authentication information submitted by a client device to a first service in connection with a first request submitted to the first service over a network, wherein the authentication request includes an electronic signature submitted by the client device that is different from the first service;
• generating a response to the authentication request that includes information usable by a second service to make, without communication with an authentication service, based at least in part on the information and one or more cryptographic processes, a determination whether fulfillment of a second request from the first service on behalf of the client device is allowable under authority of the authentication service, the determination based at least in part on policy information included in the information that specifies one or more policies applicable to an identity that is associated with the first request, wherein the second request from the first service indicates access to one or more computing resources managed by the second service on behalf of the client device;
• and
• providing the response to the first service.

A non-transitory computer-readable storage medium having stored thereon instructions which, if executed by one or more processors of a computer system of an authentication service, cause the computer system to:

• receive an authentication request to verify authentication information submitted to a first system by a client device in connection with a first request submitted to the first system over a network;
• generate a response to the authentication request that includes information usable by a second system to make, without communication with the authentication service, based at least in part on the information and one or more cryptographic processes, a determination whether fulfillment of a second request from the first system on behalf of the client device is allowable under authority of the authentication service, the determination based at least in part on policy information included in the information that specifies one or more policies applicable to an identity that is associated with the first request, wherein the first system lacks the information shared between the second system and the computer system;
• and
• provide the response to the first system.