Hosted authorization response management
A third-party server may maintain a list of named entity devices that belong to one or more roles in an application environment. The server may receive an authorization query from a policy consuming device. The authorization query may include an identity of a particular named entity device which sent a message to the policy consuming device and contextual metadata associated with the message. The server may determine that the particular named entity device belongs to one of the roles and filter the list based on the contextual metadata. The server may generate an interaction control list that includes the filtered list and transmit the interaction control list to the policy consuming device as a response to the authorization query. The interaction control list causes the policy consuming device to react to the message based on the interaction control list.
1. A system, comprising:
a user interface rendered by a software application configured to receive, from a domain owner, one or more policies defining authorization of one or more named entity devices that are associated with a domain owned by the domain owner;
a namespace server comprising memory and one or more processors, the namespace server delegated by the domain owner to respond one or more queries on behalf of the domain owner, and wherein the memory comprises instructions that when executed by the one or more processors cause the one or more processors to:
generate a namespace record based on the one or more policies, the namespace record being a record that provides authorization information to inquirers on how communications related to named entity devices that are associated with the domain should be handled;
publish the namespace record, on behalf of the domain owner, at a namespace location associated with the domain owner;
receive a namespace query from a policy consuming device that receives a message from a named entity device that is associated with the domain, wherein the namespace query is directed to the namespace location; and
return, on behalf of the domain owner, the namespace record to the policy consuming device, wherein the namespace record provides the authorization information related to whether the named entity device authorized to communicate with the policy consuming device.
2. The system of claim 1 , wherein the named entity device has an identity identifier stored on the domain of the domain owner.
3. The system of claim 1 , wherein the authorization information comprises an interaction control list.
4. The system of claim 1 , wherein the namespace server is a domain name system (DNS) server and the namespace record is a DNS record.
5. The system of claim 1 , wherein the namespace record is in a format that is standardized in an application environment associated with the one or more policies.
6. The system of claim 1 , wherein one of the policies includes a contextual constraint related to contextual information of the communication between the policy consuming device and the named entity device.
7. The system of claim 6 , wherein the contextual constraint is associated with a geographical location of the policy consuming device or the named entity device.
8. The system of claim 1 , wherein an identity of the named entity device has been authenticated by the policy consuming device before the authorization query is received.
9. The system of claim 1 , wherein the instruction to return, on behalf of the domain owner, the namespace record to the policy consuming device includes instructions to determine a role of the named entity device specified in the one or more policies.
10. A computer-implemented method, comprising:
receiving, from a domain owner, one or more policies defining authorization of one or more named entity devices that are associated with a domain owned by the domain owner;
generating a namespace record based on the one or more policies, the namespace record being a record that provides authorization information to inquirers on how communications related to named entity devices that are associated with the domain should be handled;
publishing the namespace record, on behalf of the domain owner, at a namespace location associated with the domain owner;
receiving a namespace query from a policy consuming device that receives a message from a named entity device that is associated with the domain, wherein the namespace query is directed to the namespace location; and
returning, by a namespace server delegated by the domain owner to respond one or more queries on behalf of the domain owner, the namespace record to the policy consuming device, wherein the namespace record provides the authorization information related to whether the named entity device authorized to communicate with the policy consuming device.
11. The computer-implemented method of claim 10 , wherein the named entity device has an identity identifier stored on the domain of the domain owner.
12. The computer-implemented method of claim 10 , wherein the authorization information comprises an interaction control list.
13. The computer-implemented method of claim 10 , wherein the namespace server is a domain name system (DNS) server and the namespace record is a DNS record.
14. The computer-implemented method of claim 10 , wherein the namespace record is in a format that is standardized in an application environment associated with the one or more policies.
15. The computer-implemented method of claim 10 , wherein one of the policies includes a contextual constraint related to contextual information of the communication between the policy consuming device and the named entity device.
16. The computer-implemented method of claim 15 , wherein the contextual constraint is associated with a geographical location of the policy consuming device or the named entity device.
17. The computer-implemented method of claim 10 , wherein an identity of the named entity device has been authenticated by the policy consuming device before the authorization query is received.
18. The computer-implemented method of claim 10 , wherein returning, on behalf of the domain owner, the namespace record to the policy consuming device comprises determining a role of the named entity device specified in the one or more policies.
19. A non-transitory computer readable medium for storing computer code comprising instructions, the instructions, when executed by one or more processors, cause the one or more processors to at least:
receive, from a domain owner, one or more policies defining authorization of one or more named entity devices that are associated with a domain owned by the domain owner;
generate a namespace record based on the one or more policies, the namespace record being a record that provides authorization information to inquirers on how communications related to named entity devices that are associated with the domain should be handled;
publish the namespace record, on behalf of the domain owner, at a namespace location associated with the domain owner;
receive a namespace query from a policy consuming device that receives a message from a named entity device that is associated with the domain, wherein the namespace query is directed to the namespace location; and
return, by a namespace server delegated by the domain owner to respond one or more queries on behalf of the domain owner, the namespace record to the policy consuming device, wherein the namespace record provides the authorization information related to whether the named entity device authorized to communicate with the policy consuming device.
20. The non-transitory computer readable medium of claim 19 , wherein the named entity device has an identity identifier stored on the domain of the domain owner.