Proxy-based techniques for authorizing cross-realm requests

A computing device, comprising:

• one or more processors;
• and
• one or more memories storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to:
• receive, by a proxy service of a first identity realm that executes at the computing device, a request to perform an operation in a second identity realm, the request comprising identity data associated with a requestor of the request, the identity data indicating a respective identity of the requestor in one or more identity realms;
• establish, by the proxy service of the first identity realm with a proxy service of the second identity realm, a trusted connection;
• identify, from the identity data, an identity of the requestor in the second identity realm;
• and
• transmit, to the proxy service of the second identity realm, request data indicating the identity of the requestor in the second identity realm and the operation being requested, wherein transmitting the request data causes the proxy service of the second identity realm to generate a resource principal object with which execution of the operation is attempted, the resource principal object corresponding to the identity of the requestor in the second identity realm.

A non-transitory computer-readable medium storing computer-executable instructions that, when executed by one or more processors of a computing device, cause the one or more processors to:

• receive, by a proxy service of a first identity realm that executes at the computing device, a request to perform an operation in a second identity realm, the request comprising identity data associated with a requestor of the request, the identity data indicating a respective identity of the requestor in one or more identity realms;
• establish, by the proxy service of the first identity realm with a proxy service of the second identity realm, a trusted connection;
• identify, from the identity data, an identity of the requestor in the second identity realm;
• and
• transmit, to the proxy service of the second identity realm, request data indicating the identity of the requestor in the second identity realm and the operation being requested, wherein transmitting the request data causes the proxy service of the second identity realm to generate a resource principal object with which execution of the operation is attempted, the resource principal object corresponding to the identity of the requestor in the second identity realm.