Authentication framework for resource access across organizations

A computer system, comprising:

• one or more processors;
• and
• memory storing instructions which, when executed by the one or more processors, cause the one or more processors to perform steps comprising:
• receiving, from a target tenant computing system, a client application administrator input;
• generating a first client application entry in a target tenant scope of an OAuth provider, based on the client application administrator input, the first client application entry in the target tenant scope including a first client application identifier identifying a client application and a first resource identifier that defines a set of resources, served by a source tenant service corresponding to a source tenant computing system, to be accessed by the client application and a first permissions definition that defines a set of permissions to perform operations on the set of resources;
• receiving a secret corresponding to the client application and a target service authorization authorizing a target service corresponding to the target tenant computing system to access the secret;
• storing the secret and the target service authorization in the OAuth provider;
• receiving, from the source tenant computing system, acceptance of a request for consent, the request for consent identifying the client application, the set of permissions and the set of resources;
• based on the acceptance of the request for consent, generating a second client application entry in a source tenant scope of the OAuth provider, the second client application entry in the source tenant scope including a second client application identifier identifying the client application and a second resource identifier that defines the set of resources, served by the source tenant service, to be accessed by the client application and a second permissions definition that defines the set of permissions;
• receiving, at an authorization server coupled to the source tenant computing system, from the target service, a request for a token authorizing access to the resources, the request for the token including the secret;
• receiving target service credentials identifying the target service;
• authorizing the target service to receive the token based on the target service credentials and the secret;
• and
• sending the token to the target service.

A computing system that provides a multi-tenant authorization platform for providing a target tenant computing system with access to resources of a source tenant computing system, comprising:

• one or more processors configured to implement an OAuth provider having a target tenant scope that receives, from a target tenant computing system, a client application administrator input and generates a first client application entry in the target tenant scope of the OAuth provider, based on the client application administrator input, the client application entry including a first client application identifier identifying a client application and a first resource identifier that defines a set of resources, served by a source tenant service, to be accessed by the client application and a first permissions definition that defines a set of permissions to perform operations on the set of resources;
• memory comprising a secret store that stores a secret corresponding to the client application and a target service authorization authorizing a target service to access the secret;
• the OAuth provider having a source tenant scope and being further configured to:
• receive, from a source tenant computing system, acceptance of a request for consent, the request for consent identifying the client application, the set of permissions and the set of resources;
• and
• based on the acceptance of the request for consent, generate a second client application entry in the source tenant scope of the OAuth provider, the second client application entry in the source tenant scope including a second client application identifier identifying the client application and a second resource identifier that defines the set of resources, served by the source tenant service, to be accessed by the client application, and a second permissions definition that defines the set of permissions;
• and
• an authorization server coupled to the source tenant computing system, and configured to:
• receive, from the target service, a request for a token authorizing access to the resources, the request for the token including the secret;
• authorize the target service to receive the token based on the request for the token including the secret and based on the set of permissions;
• and
• send the token to the target service.