Method for managing access to protected resources and delegating authority in a computer network

A method carried out at least by a consumer, a service provider, and a controller, wherein

• a service provider is at least one of a software application and a web site that is configured to provide access to protected resources;
• and
• a consumer is at least one of a software application and a web site that is configured to access a service provider on behalf of a user without knowing the user credentials for the service provider;
• the method comprising:
• transmitting, by the consumer to the service provider, a first message representing a request for authorization to access by the consumer on behalf of a first user, here referred to as delegatee, the protected resources of a second user, here referred to as delegator, from the service provider;
• transmitting, by the service provider to the controller, a second message representing the request for authorization to access by the consumer on behalf of the delegatee the protected resources of the delegator from the service provider, the second message including a request token, wherein a request token is a value used by a service provider to register a requested authorization to access protected resources;
• determining, by the controller, whether the requested authorization represented by the second message meets policy settings governing the access to protected resources of the delegator;
• and,
• if it is determined that the requested authorization meets the policy settings,
• granting, by the service provider, the authorization registered by the request token;
• transmitting, by at least one of the controller and the service provider, to the consumer, a third message including the request token;
• and
• accessing, by the consumer, on behalf of the delegatee, the protected resources of the delegator from the service provider, the consumer using the request token to do so without knowing the user credentials for the service provider.