Identifying group membership through discharge macaroon access tokens
The disclosed technology teaches delegating authorization to access a resource server contingent upon group membership confirmation by a third-party identity management provider. As part of the technology, a client obtains a Macaroon Access Token with a third-party caveat that requires the client to obtain a one-time Discharge Macaroon Authorization from a third-party authority, and identifies both user group membership that needs to be checked, and a hint how to find the third-party authority. The client provides the Macaroon Access Token to the third-party authority. The client obtains, from the third-party authority, a Discharge Macaroon Access Token that identifies user group membership, and sends the Macaroon Access Token and the Discharge Macaroon Authorization to the resource server as proof of authorization.
1. A method of delegating authorization to access a resource server contingent upon group membership confirmation by a third-party identity management provider, including:
a client obtaining a Macaroon Access Token (MAT) with a third-party caveat that:
requires the client to obtain a one-time discharge Macaroon authorization (DMAT) from a third-party authority; and
identifies
group membership of the client that needs to be checked by the third-party authority, and
a hint how to find the third-party authority;
the client providing the MAT to the third-party authority;
the client obtaining, from the third-party authority, a Discharge Macaroon Access Token (DMAT) that confirms the group membership of the client;
sending the MAT and the DMAT to the resource server as proof of authorization; and
the client obtaining access to the resource server after the resource server receives an introspection response that validates the MAT and DMAT.
2. The method of claim 1 , further including the MAT and DMAT being compatible with OAuth 2.0 or OAuth 2.1 drafts as of November 2020.
3. The method of claim 1 , further including the client obtaining access to a resource, wherein the access is granted through the resource server.
4. The method of claim 3 , wherein the resource is associated with the group.
5. The method of claim 1 , wherein the hint for finding the third-party authority is an internet address.
6. The method of claim 1 , further including the client modifying the MAT to add a first party caveat.
7. The method of claim 6 , wherein the first party caveat is expiry time.
8. The method of claim 6 , wherein the first party caveat limits a scope of the authorization provided by the MAT obtained.
9. A non-transitory computer readable medium including program instructions that, when executed on hardware, implement actions of delegating authorization to access a resource server contingent upon group membership confirmation by a third-party identity management provider the actions including:
a client obtaining a Macaroon Access Token (MAT) with a third-party caveat that:
requires the client to obtain a one-time discharge Macaroon authorization (DMAT) from a third-party authority; and
identifies
group membership of the client that needs to be checked by the third-party authority, and
a hint how to find the third-party authority;
the client providing the MAT to the third-party authority;
the client obtaining, from the third-party authority, a Discharge Macaroon Access Token (DMAT) that confirms the group membership of the client;
sending the MAT and the DMAT to the resource server as proof of authorization; and
the client obtaining access to the resource server after the resource server receives an introspection response that validates the MAT and DMAT.
10. The non-transitory computer readable medium of claim 9 , further including the MAT and DMAT being compatible with OAuth 2.0 or OAuth 2.1 drafts as of November 2020.
11. The non-transitory computer readable medium of claim 9 , further implementing the client obtaining access to a resource, wherein the access is granted through the resource server.
12. The non-transitory computer readable medium of claim 11 , wherein the resource is associated with the group.
13. The non-transitory computer readable medium of claim 9 , wherein the hint for finding the third-party authority is an internet address.
14. A system including hardware coupled to the non-transitory computer readable medium of claim 13 .
15. The non-transitory computer readable medium of claim 9 , further implementing the client modifying the MAT to add a first party caveat.
16. A system including hardware coupled to the non-transitory computer readable medium of claim 15 .
17. The non-transitory computer readable medium of claim 15 , wherein the first party caveat is expiry time.
18. The non-transitory computer readable medium of claim 15 , wherein the first party caveat limits a scope of the authorization provided by the MAT obtained.
19. A system including hardware coupled to the non-transitory computer readable medium of claim 18 .
20. A system including hardware coupled to the non-transitory computer readable medium of claim 9 .