# US 8,544,068 B2 · Business pre-permissioning in delegated third party authorization > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,544,068 B2 - Document ID: US8544068B2 - Status: Granted - Kind: B2 - Application number: 12/943,218 - Filed: 2010-11-10 - Published: 2012-05-10 - Granted: 2013-09-24 - Earliest claimed: 2010-11-10 - Assignees: International Business Machines Corporation - Applicants: Robert Leslie Yates; Prashant S. Kulkarni; Mary Ellen Zurko - Inventors: Robert Leslie Yates; Prashant S. Kulkarni; Mary Ellen Zurko - Web page: https://patentgrep.com/patent/US8544068B2 ## CPC - H04L 63/101: {Access control lists [ACL]} - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 51/42: Mailbox-related aspects, e.g. synchronisation of mailboxes - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method to manage access to end user-protected resources hosted in a shared pool of configurable computing resources, such as a cloud computing environment, begins by registering a particular application or service into the environment. The application or service is one that is being permitted to access resources on behalf of end users via a delegated authorization protocol, such as OAuth. For at least one end user associated with the organization, a permission is set, preferably by an organization entity, such as an organization administrator. The permission determines whether the application or service is permitted to access one or more resources associated with the end user. Then, in response to a request by the third party application to access a resource, where the request is received via the delegated authorization protocol, the permission is then used to determine whether the third party application is permitted to access the resource. ## Claims ### Claim 1 A method to manage access to protected resources hosted in a shared pool of configurable computing resources, comprising: registering a third party application that is permitted to access protected resources on behalf of end users via a delegated authorization protocol; for at least one end user associated with an organization, setting a permission that determines whether the third party application is permitted to access one or more protected resources associated with the end user, the permission associated with a policy; and responsive to a request by the third party application to access a protected resource, where the request is received via the delegated authorization protocol, using the permission to determine whether the third party application is permitted to access the protected resource by having a computing entity including a hardware element evaluate validity of one of: a credential associated with the request, and a token associated with the request, the credential uniquely identifying the third party application in the shared pool of configurable computing resources, the token uniquely identifying the end user in the shared pool of configurable computing resources; and applying the policy and returning a response to the request. ### Claim 2 (depends on 1) The method as described in claim 1 wherein the delegated authorization protocol is OAuth. ### Claim 3 (depends on 1) The method as described in claim 1 wherein the permission is set by an organization entity. ### Claim 4 (depends on 3) The method as described in claim 3 wherein the organization entity is an organization administrator. ### Claim 5 (depends on 1) The method as described in claim 1 further including evaluating a timestamp associated with the token. ### Claim 6 (depends on 1) The method as described in claim 1 wherein the permission is set for one of: the end user, and a set of end users that include the end user. ### Claim 7 Apparatus to manage access to resources hosted in a shared pool of configurable computing resources, comprising: a processor; computer memory holding computer program instructions that when executed by the processor perform a method comprising: registering a third party application that is permitted to access protected resources on behalf of end users via a delegated authorization protocol; for at least one end user associated with an organization, setting a permission that determines whether the third party application is permitted to access one or more protected resources associated with the end user, the permission associated with a policy; and responsive to a request by the third party application to access a protected resource, where the request is received via the delegated authorization protocol, using the permission to determine whether the third party application is permitted to access the protected resource by evaluating validity of one of: a credential associated with the request, and a token associated with the request, the credential uniquely identifying the third party application in the shared pool of configurable computing resources, the token uniquely identifying the end user in the shared pool of configurable computing resources; and applying the policy and returning a response to the request. ### Claim 8 (depends on 7) The apparatus as described in claim 7 wherein the delegated authorization protocol is OAuth. ### Claim 9 (depends on 7) The apparatus as described in claim 7 wherein the permission is set by an organization entity. ### Claim 10 (depends on 9) The apparatus as described in claim 9 wherein the organization entity is an organization administrator. ### Claim 11 (depends on 7) The apparatus as described in claim 7 wherein the permission is set for one of: the end user, and a set of end users that include the end user. ### Claim 12 A computer program product in a non-transitory computer readable medium for use in a data processing system to manage access to resources hosted in a shared pool of configurable computing resources, the computer program product holding computer program instructions which, when executed by the data processing system, perform a method comprising: registering a third party application that is permitted to access protected resources on behalf of end users via a delegated authorization protocol; for at least one end user associated with an organization, setting a permission that determines whether the third party application is permitted to access one or more protected resources associated with the end user, the permission associated with a policy; and responsive to a request by the third party application to access a protected resource, where the request is received via the delegated authorization protocol, using the permission to determine whether the third party application is permitted to access the protected resource by evaluating validity of one of: a credential associated with the request, and a token associated with the request, the credential uniquely identifying the third party application in the shared pool of configurable computing resources, the token uniquely identifying the end user in the shared pool of configurable computing resources; and applying the policy and returning a response to the request. ### Claim 13 (depends on 12) The computer program product as described in claim 12 wherein the delegated authorization protocol is OAuth. ### Claim 14 (depends on 12) The computer program product as described in claim 12 wherein the permission is set by an organization entity. ### Claim 15 (depends on 14) The computer program product as described in claim 14 wherein the organization entity is an organization administrator. ### Claim 16 (depends on 12) The computer program product as described in claim 12 wherein the permission is set for one of: the end user, and a set of end users that include the end user.