Identity management and single sign-on in a heterogeneous composite service scenario

A first server device, comprising:

• a memory to store identity information for a plurality of users, policy information for the server device, and particular context information of a plurality of user devices, and
• a processor to execute instructions in the memory to:
• receive, from a second server device that hosts a third party application, a request to receive login credentials of a user of a user device, where the login credentials enable the third party application to access at least two service provider applications on behalf of the user, the request including a token containing identity information for the user and context information that includes capabilities of the user device,
• perform an identity verification operation to determine whether particular identity information, for the user, is stored in the memory, the particular identity information including the login credentials,
• perform an authorization operation to determine whether the context information, matches the particular context information stored in the memory or whether the policy information permits the disclosure of the particular identity information, and
• send the particular identity information to the second server device to be used by the third party application to access the two or more service provider applications, on behalf of the user, when the identity of the user is verified as a result of the identity verification operation and when the disclosure of the particular identity information is permitted as a result of the authorization operation.

A system comprising:

• a storage device to store:
• identity information of a user of a user device, the identity information including a plurality of identity entries of the user, and
• context information that identifies a location of the user device or capabilities of the user device at a prior point in time;
• and a first server device to:
• receive, from a second server device that hosts a third party application, a first request to verify an identity of the user with which the third party application is associated,
• the first request including one or more identity entries,
• determine whether the one or more identity entries match at least one identity entry of the plurality of identity entries,
• retrieve, from the storage device, the plurality of identity entries when the one or more identity entries match the at least one identity entry,
• the plurality of identity entries including login credentials for at least one service provider application from which services are to be obtained by the third party application,
• retrieve, from the storage device, the context information when the one or more identity entries match the at least one identity entry,
• compare particular context information, associated with the user device at a present point in time, with the retrieved context information to determine whether the particular context information matches the retrieved context information, and
• send, to the second server device, the login credentials for the at least one service provider application when the particular context information matches the retrieved context information.