Intent-based identity access management systems and methods
An identity and access management system including: a processor; and memory including instructions that, when executed by the processor, cause the processor to: receive an API token request for an authorization token to authorize an application function associated with a target API of an application; determine identity information from the API token request; retrieve attributes associated with the identity information; identify the target API and an API function profile associated with the target API for the application function; filter the attributes associated with the identity information based on the API function profile; generate the authorization token according to the filtered attributes; and transmit the authorization token in response to the API token request.
1. An identity and access management system comprising:
at least one processor; and
memory comprising instructions that, when executed by the at least one processor, cause the processor to:
receive an application programming interface (API) token request for an authorization token to authorize an application function associated with a target API of an application;
determine identity information from the API token request;
retrieve attributes associated with the identity information;
identify the target API and an API function profile associated with the target API for the application function;
filter the attributes associated with the identity information based on the API function profile;
generate the authorization token according to the filtered attributes;
transmit the authorization token in response to the API token request;
identify one or more API authorization policies based on the API function profile, wherein the API authorization policies enable only the application function associated with the target API from among a plurality of application functions associated with the application of the target API;
execute the one or more API authorization policies based on the filtered attributes to generate the authorization token;
receive API requirements registered in an API marketplace for the target API, the API requirements including at least the application function associated with the target API and application requirements for the authorization token to enable the application function by the target API;
generate the API authorization policies based on the application function and the application requirements;
generate the API function profile for the target API based on the API authorization polices; and
associate the API function profile with the target API.
2. The system of claim 1 , wherein the attributes are retrieved from a master data management store configured to store various attributes of various applications and users.
3. The system of claim 1 , wherein the API function profile includes a plurality of attribute types to be included in the authorization token generated for the target API.
4. The system of claim 1 , wherein the authorization token enables only the application function associated with the target API from among a plurality of application functions associated with the application of the target API.
5. A method, comprising:
receiving an application programming interface (API) token request for an authorization token to authorize an application function associated with a target API of an application;
determining identity information from the API token request;
retrieving attributes associated with the identity information;
identifying the target API and an API function profile associated with the target API for the application function;
filtering the attributes associated with the identity information based on the API function profile;
generating the authorization token according to the filtered attributes;
transmitting the authorization token in response to the API token request;
identifying one or more API authorization policies based on the API function profile, wherein the API authorization policies enable only the application function associated with the target API from among a plurality of application functions associated with the application of the target API;
executing the one or more API authorization policies based on the filtered attributes to generate the authorization token;
receiving API requirements registered in an API marketplace for the target API, the API requirements including at least the application function associated with the target API and application requirements for the authorization token to enable the application function by the target API;
generating the API authorization policies based on the application function and the application requirements;
generating the API function profile for the target API based on the API authorization polices; and
associating the API function profile with the target API.
6. The method of claim 5 , wherein the attributes are retrieved from a master data management store configured to store various attributes of various applications and users.
7. The method of claim 5 , wherein the API function profile includes a plurality of attribute types to be included in the authorization token generated for the target API.
8. The method of claim 5 , wherein the authorization token enables only the application function associated with the target API from among a plurality of application functions associated with the application of the target API.
9. An identity and access management system comprising:
at least one processor; and
memory comprising instructions that, when executed by the at least one processor, cause the processor to:
receive an application programming interface (API) token request for an authorization token to authorize an application function associated with a target API of an application;
receive API requirements registered in an API marketplace for the target API, the API requirements including at least the application function associated with the target API and application requirements for the authorization token to enable the application function by the target API;
determine identity information from the API token request;
retrieve attributes associated with the identity information;
identify the target API and an API function profile associated with the target API for the application function;
filter the attributes associated with the identity information based on the API function profile;
generate the authorization token according to the filtered attributes; and
transmit the authorization token in response to the API token request.
10. The system of claim 9 , wherein the attributes are retrieved from a master data management store configured to store various attributes of various applications and users.
11. The system of claim 9 , wherein the instructions further cause the at least one processor to:
identify one or more API authorization policies based on the API function profile; and
execute the one or more API authorization policies based on the filtered attributes to generate the authorization token.
12. The system of claim 11 , wherein the API authorization policies enable only the application function associated with the target API from among a plurality of application functions associated with the application of the target API.
13. The system of claim 12 , wherein the instructions further cause the at least one processor to:
generate the API authorization policies based on the application function and the application requirements;
generate the API function profile for the target API based on the API authorization polices; and
associate the API function profile with the target API.
14. The system of claim 13 , wherein the API function profile includes a plurality of attribute types to be included in the authorization token generated for the target API.