Techniques for delegation of access privileges

A computer-implemented method for controlling access to one or more computing resources, comprising:

• under the control of one or more computer systems configured with executable instructions,
• receiving, by a computer system of the one or more computer systems, the computer system comprising one or more computing devices, in connection with a request by a user to access the one or more computing resources, credential information that encodes one or more delegator-specified policies for accessing the one or more computing resources;
• determining, by the computer system, based at least in part on the received credential information, whether the encoded one or more delegator-specified policies allow access to the one or more computing resources;
• determining, by the computer system, based at least in part on one or more policies of one or more policy sets that govern access to the one or more computing resources, whether delegation of access to the one or more computing resources by the delegator is still allowed, the one or more policy sets maintained independently from the received credential information and the one or more policy sets being modifiable to cause a change to an amount of access to the one or more computing resources for which the credential information is usable to access, wherein the change to the amount of access includes revoking the delegator's access to the one or more computing resources or revoking the delegator's ability to delegate access to the one or more computing resources;
• and
• when determined that the encoded one or more delegator-specified policies allow delegation of access to the one or more computing resources by the delegator, providing, by the computer system, access to the one or more computing resources.

A computer-implemented method for generating sessions for accessing one or more computing resources whose access is governed by one or more policy sets, comprising:

• under the control of one or more computer systems configured with executable instructions,
• receiving, by a computer system of the one or more computer systems, the computer system comprising one or more computing devices, a request to initiate a session for accessing the one or more computing resources;
• in response to the request, generating, by the computer system, a session credential that encodes at least one or more permissions applicable for a session and consistent with access of a delegator to the one or more computing resources governed at least in part by a policy set maintained independently from the generated session credential, the policy set being modifiable after generating the session credential to revoke access to the one or more computing resources by the delegator causing the encoded at least one or more permissions to conflict with the policy set or to revoke the ability of the delegator to delegate access to the one or more computing resources to a user;
• and
• providing, by the computer system, the generated session credential to enable the user to use the session credential to access the one or more computing resources according to the encoded one or more permissions in a manner governed at least by the one or more policy sets, wherein enabling the user to access the one or more computing resources is contingent on at least a determination that the policy set still allows the delegator to delegate access to the one or more computing resources to the user.

One or more non-transitory computer-readable storage media having collectively stored thereon instructions executable by one or more processors of a computer system that, when executed by the one or more processors, cause the computer system to at least:

• receive credential information that encodes one or more policies for accessing the one or more computing resources wherein the one or more policies are consistent with a policy set maintained independently from the credential information, the policy being modifiable to revoke access to the one or more computing resources causing a change to an amount of access to the one or more computing resources for which the credential information is useable to access wherein the change to the amount of access includes revoking a delegator's access to the one or more computing resources or revoking the delegator's ability to delegate access to the one or more computing resources;
• receive a request to access the one or more computing resources from a requestor;
• determine, based at least in part on the one or more policies encoded by the credential information and at least in part on the policy set, whether access to the one or more computing resources is still allowed to the requestor, wherein determining whether access to the one or more computing resources is still allowed is contingent on at least a determination that the policy set still allows access to the one or more computing resources to be delegated by the delegator;
• and
• when determined that access to the one or more computing resources is allowed to the requestor and that access to the one or more computing resources is still delegable by the delegator, provide access to the one or more computing resources to the requestor.

A computer system for managing credentials, comprising:

• one or more processors;
• and
• memory, including executable instructions that, when executed by the one or more processors, cause the one or more processors to collectively at least:
• receive a request to initiate a session for accessing the one or more computing resources;
• in response to the request, generate a session credential that encodes at least one or more permissions applicable for a session wherein the at least one or more permissions are consistent with access of a delegator to the one or more computing resources and governed at least in part by a policy set maintained independently from the generated session credential, the policy set being modifiable after generating the session credential to revoke access to the one or more computing resources by the delegator or to revoke the ability of the delegator to delegate access to the one or more computing resources causing the encoded at least one or more permissions to conflict with the policy set;
• and
• provide the generated session credential to enable a user to use the session credential to access the one or more computing resources according to the encoded one or more permissions in a manner governed at least by the one or more policy sets, wherein enabling the user to access the one or more computing resources is contingent on at least a determination that the policy set still allows the delegator to delegate access to the one or more computing resources to the user.

A computer-implemented method of managing access to one or more computing resources, comprising:

• under the control of one or more computing systems configured with executable instructions,
• receiving, by a computer system of the one or more computer systems, the computer system comprising one or more computing devices, a request from a first principal to grant one or more permissions to a second principal, the one or more permissions being consistent with one or more policy sets maintained independently from the request, the one or more policy sets being modifiable after granting the one or more permissions to the second principal to revoke access to the one or more computing resources by the first principal or to revoke the first principal's ability to delegate the one or more permissions causing the granted one or more permissions to conflict with the policy set;
• in response to a request from the second principal to access one or more computing resources, determining at least:
• whether the granted one or more permissions still allow access to the one or more computing resources;
• whether the one or more policy sets still allow the first principal to delegate the one or more permissions;
• and
• whether one or more permissions of an authority different from the first principal still allow access to the one or more computing resources;
• and
• when determined that the granted one or more permissions still allow access to the one or more computing resources, that the one or more policy sets still allow the first principal to delegate the one or more permissions, and that the one or more permissions of the authority still allow access to the one or more computing resources, providing access to the one or more computing resources to the second principal.