Providing selective access to resources

A computing device for providing selective access to resources, the computing device comprising:

• a hardware processor;
• and
• a data storage device storing instructions that, when executed by the hardware processor, cause the hardware processor to:
• receive, from a client application, a client request to access a first resource server, the client request including a client access token specifying, as a client audience, the client application;
• in response to receiving the client request, identify a first set of permissions for accessing, by the client application, the first resource server, the first set of permissions being specified by a client topology for the client application, the client topology specifying:
• the first resource server;
• the first set of permissions for accessing, by the client application, the first resource server;
• a second resource server, and
• a second set of permissions for accessing, by the first resource server, the second resource server;
• provide the client application with a first access token, the first access token specifying the first set of permissions and, as a first audience, the first resource server,
• receive, from the first resource server, a first resource request to access the second resource server, the first resource request including the first access token;
• and
• in response to receiving the first resource request, provide the first resource server with a second access token, the second access token specifying the second set of permissions and, as a second audience, the second resource server.

A method for providing selective access to resources, implemented by a hardware processor, the method comprising:

• receiving, from a client device, i) a client request for user data, and ii) a first token specifying a first audience and a first set of permissions;
• providing an authorization server with a token request, the token request including i) the first token, and ii) a request to access a resource server;
• receiving, from the authorization server, a resource server token, the resource server token specifying a second audience and a second set of permissions, the second audience being the resource server;
• providing the resource server with i) a resource request for the user data, and ii) the resource server token;
• receiving, from the resource server, the user data;
• and
• providing the user data to the client device.