Business pre-permissioning in delegated third party authorization

Apparatus to manage access to resources hosted in a shared pool of configurable computing resources, comprising:

• a processor;
• computer memory holding computer program instructions that when executed by the processor perform a method comprising:
• registering a third party application that is permitted to access protected resources on behalf of end users via a delegated authorization protocol;
• for at least one end user associated with an organization, setting a permission that determines whether the third party application is permitted to access one or more protected resources associated with the end user, the permission associated with a policy;
• and
• responsive to a request by the third party application to access a protected resource, where the request is received via the delegated authorization protocol, using the permission to determine whether the third party application is permitted to access the protected resource by evaluating validity of one of:
• a credential associated with the request, and a token associated with the request, the credential uniquely identifying the third party application in the shared pool of configurable computing resources, the token uniquely identifying the end user in the shared pool of configurable computing resources;
• and
• applying the policy and returning a response to the request.

A computer program product in a non-transitory computer readable medium for use in a data processing system to manage access to resources hosted in a shared pool of configurable computing resources, the computer program product holding computer program instructions which, when executed by the data processing system, perform a method comprising:

• registering a third party application that is permitted to access protected resources on behalf of end users via a delegated authorization protocol;
• for at least one end user associated with an organization, setting a permission that determines whether the third party application is permitted to access one or more protected resources associated with the end user, the permission associated with a policy;
• and
• responsive to a request by the third party application to access a protected resource, where the request is received via the delegated authorization protocol, using the permission to determine whether the third party application is permitted to access the protected resource by evaluating validity of one of:
• a credential associated with the request, and a token associated with the request, the credential uniquely identifying the third party application in the shared pool of configurable computing resources, the token uniquely identifying the end user in the shared pool of configurable computing resources;
• and
• applying the policy and returning a response to the request.