Cross application authorization for enterprise systems

An apparatus for cross‑application authorization, comprising:

• one or more memories storing processor‑executable code;
• and
• one or more processors coupled with the one or more memories and individually or collectively operable to execute the code to cause the apparatus to:
• receive, at an identity provider and from a first user associated with the identity provider, an application programming interface (API) access policy that supports cross-application authorization between a first application and a second application associated with the identity provider;
• receive, at the identity provider from the first application and on behalf of a second user different from the first user, a request for a first token associated with the cross-application authorization between the first application and the second application,;
• transmit, to the first application and in response to the request, the first token in accordance with the API access policy for the cross-application authorization;
• and
• exchange, at the identity provider, the first token provided by the first application for the second token in accordance with the API access policy for the cross-application authorization.

A non‑transitory computer‑readable medium storing code for cross‑application authorization, the code comprising instructions executable by one or more processors to:

• receive, at an identity provider and from a first user associated with the identity provider, an application programming interface (API) access policy that supports cross-application authorization between a first application and a second application associated with the identity provider;
• receive, at the identity provider from the first application and on behalf of a second user different from the first user, a request for a first token t associated with the cross-application authorization between the first application and the second application;
• transmit, to the first application and in response to the request, the first token in accordance with the API access policy for the cross-application authorization;
• and
• exchange, at the identity provider, the first token provided by the first application for the second token in accordance with the API access policy for the cross-application authorization.