Secure resource authorization for external identities using remote principal objects

A method for authorizing access by a remote principal of a second domain to a secure data resource of a first domain of a domain host, the method comprising:

• verifying, by a processing system that includes a processor, that the remote principal is identified as being associated with a group of the second domain represented in a remote principal object stored in a directory of the first domain at the domain host and inaccessible from the second domain, the group having at least one entitlement to the secure data resource as enumerated in a set of permissions and at least one associated access policy defined by the second domain;
• generating, by the processing system, an access token for the remote principal that includes the at least one entitlement;
• and
• providing, by the processing system, the access token to the remote principal to enable access to the secure data resource by the remote principal.

At least one computer-readable storage medium that stores program instructions that, when executed by one or more processing devices, performs a method for authorizing access by a remote principal of a second domain to a secure data resource of a first domain of a domain host, the method comprising:

• verifying that the remote principal is identified as being associated with a group of the second domain represented in a remote principal object stored in a directory of the first domain at the domain host and inaccessible from the second domain, the group having at least one entitlement to the secure data resource as enumerated in a set of permissions and at least one associated access policy defined by the second domain;
• generating an access token for the remote principal that includes the at least one entitlement;
• and
• providing the access token to the remote principal to enable access to the secure data resource by the remote principal.