# US 2026/0100935 A1 · Proxy-based techniques for authorizing cross-realm requests > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2026/0100935 A1 - Document ID: US20260100935A1 - Status: Published application - Kind: A1 - Application number: 19/373,429 - Filed: 2025-10-29 - Published: 2026-04-09 - Earliest claimed: 2024-08-13 - Assignees: Oracle International Corporation - Applicants: Oracle International Corporation - Inventors: Ayush Ruia; Christian Augustine Csar; Girish Nagaraja; Erik Miller; Thomas James Andrews; Shrey Arora; Shoaib Sheriff; Martinus Petrus Lambertus van den Dungen - Web page: https://patentgrep.com/patent/US20260100935A1 ## CPC - H04L 63/0281: {Proxies} - H04L 63/0869: {for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques are disclosed for using a proxy service to generate resource principals corresponding to a cross-realm request. A request to perform an operation in a target realm (TR) may be received by the proxy service of a host realm (HR). The request may comprise identity data that indicates an identifier of the requestor in one or more identity realms (e.g., in at least the TR). The proxy service of the HR may establish a trusted connection with a proxy service of the TR. The proxy service of the HR may transmit request data that indicates the identity of the requestor within the TR, causing the proxy service in the TR to generate a resource principal object corresponding to the identity of the requestor in the TR, whereby the resource principal object is used to execute (or to attempt execution of) the requested operation in the TR. ## Claims ### Claim 1 A computer-implemented method comprising: receiving, by a proxy service of a first identity realm, a request to perform an operation in a second identity realm, the request comprising identity data associated with a requestor of the request, the identity data indicating a respective identity of the requestor in one or more identity realms; establishing, by the proxy service of the first identity realm with a proxy service of the second identity realm, a trusted connection; identifying, by the proxy service of the first identity realm and from the identity data, an identity of the requestor in the second identity realm; and transmitting, by the proxy service of the first identity realm to the proxy service of the second identity realm, request data indicating the identity of the requestor in the second identity realm and the operation being requested, wherein transmitting the request data causes the proxy service of the second identity realm to generate a resource principal object with which execution of the operation is attempted, the resource principal object corresponding to the identity of the requestor in the second identity realm. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the proxy service of the first identity realm and the proxy service of the second identity realm are associated with a centralized cross-realm service. ### Claim 3 (depends on 2) The computer-implemented method of claim 2, wherein the trusted connection is established based at least in part on mutual authentication of the proxy service of the first identity realm and the proxy service of the second identity realm, the mutual authentication being performed based at least in part on a credential that is associated with the centralized cross-realm service. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the trusted connection is established based at least in part on mutual authentication of the proxy service of the first identity realm and the proxy service of the second identity realm, the mutual authentication being performed based at least in part on a credential that is provided by the requestor. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the proxy service of the second identity realm provides the resource principal object to a second service of the second identity realm, and wherein the second service of the second identity realm authorizes the execution of the operation using the resource principal object generated by the proxy service in the second identity realm. ### Claim 6 (depends on 5) The computer-implemented method of claim 5, further comprising: receiving, by the proxy service of the first identity realm, the resource principal object generated by the proxy service of the second identity realm; and providing, by the proxy service of the first identity realm to the requestor, the resource principal object generated by the proxy service of the second identity realm, wherein providing the requestor with the resource principal object configures the requestor to perform subsequent operations with the second service of the second identity realm via an additional trusted connection between the requestor and the second service of the second identity realm. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the identity data is provided in the request as a map or a custom claim. ### Claim 8 A computing device, comprising: one or more processors; and one or more memories storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to: receive, by a proxy service of a first identity realm that executes at the computing device, a request to perform an operation in a second identity realm, the request comprising identity data associated with a requestor of the request, the identity data indicating a respective identity of the requestor in one or more identity realms; establish, by the proxy service of the first identity realm with a proxy service of the second identity realm, a trusted connection; identify, from the identity data, an identity of the requestor in the second identity realm; and transmit, to the proxy service of the second identity realm, request data indicating the identity of the requestor in the second identity realm and the operation being requested, wherein transmitting the request data causes the proxy service of the second identity realm to generate a resource principal object with which execution of the operation is attempted, the resource principal object corresponding to the identity of the requestor in the second identity realm. ### Claim 9 (depends on 8) The computing device of claim 8, wherein the proxy service of the first identity realm and the proxy service of the second identity realm are associated with a centralized cross-realm service. ### Claim 10 (depends on 9) The computing device of claim 9, wherein the trusted connection is established based at least in part on mutual authentication of the proxy service of the first identity realm and the proxy service of the second identity realm, the mutual authentication being performed based at least in part on a credential that is associated with the centralized cross-realm service. ### Claim 11 (depends on 8) The computing device of claim 8, wherein the trusted connection is established based at least in part on mutual authentication of the proxy service of the first identity realm and the proxy service of the second identity realm, the mutual authentication being performed based at least in part on a credential that is provided by the requestor. ### Claim 12 (depends on 8) The computing device of claim 8, wherein the proxy service of the second identity realm provides the resource principal object to a second service of the second identity realm, and wherein the second service of the second identity realm authorizes the execution of the operation using the resource principal object generated by the proxy service in the second identity realm. ### Claim 13 (depends on 12) The computing device of claim 12, wherein executing the computer-executable instructions further causes the one or more processors to: receive the resource principal object generated by the proxy service of the second identity realm; and provide, to the requestor, the resource principal object generated by the proxy service of the second identity realm, wherein providing the requestor with the resource principal object configures the requestor to perform subsequent operations with the second service of the second identity realm via an additional trusted connection between the requestor and the second service of the second identity realm. ### Claim 14 (depends on 8) The computing device of claim 8, wherein the identity data is provided in the request as a map or a custom claim. ### Claim 15 A non-transitory computer-readable medium storing computer-executable instructions that, when executed by one or more processors of a computing device, cause the one or more processors to: receive, by a proxy service of a first identity realm that executes at the computing device, a request to perform an operation in a second identity realm, the request comprising identity data associated with a requestor of the request, the identity data indicating a respective identity of the requestor in one or more identity realms; establish, by the proxy service of the first identity realm with a proxy service of the second identity realm, a trusted connection; identify, from the identity data, an identity of the requestor in the second identity realm; and transmit, to the proxy service of the second identity realm, request data indicating the identity of the requestor in the second identity realm and the operation being requested, wherein transmitting the request data causes the proxy service of the second identity realm to generate a resource principal object with which execution of the operation is attempted, the resource principal object corresponding to the identity of the requestor in the second identity realm. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the proxy service of the first identity realm and the proxy service of the second identity realm are associated with a centralized cross-realm service. ### Claim 17 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the trusted connection is established based at least in part on mutual authentication of the proxy service of the first identity realm and the proxy service of the second identity realm, the mutual authentication being performed based at least in part on a first credential that is associated with a centralized cross-realm service or on a second credential that is provided by the requestor. ### Claim 18 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the proxy service of the second identity realm provides the resource principal object to a second service of the second identity realm, and wherein the second service of the second identity realm authorizes the execution of the operation using the resource principal object generated by the proxy service in the second identity realm. ### Claim 19 (depends on 18) The non-transitory computer-readable medium of claim 18, wherein executing the computer-executable instructions further causes the one or more processors to: receive the resource principal object generated by the proxy service of the second identity realm; and provide, to the requestor, the resource principal object generated by the proxy service of the second identity realm, wherein providing the requestor with the resource principal object configures the requestor to perform subsequent operations with the second service of the second identity realm via an additional trusted connection between the requestor and the second service of the second identity realm. ### Claim 20 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the identity data is provided in the request as a map or a custom claim.