Cross application authorization for enterprise systems

1 . A method for cross-application authorization by an identity provider, comprising:

receiving, at the identity provider and from a first user associated with the identity provider, an indication of an application programming interface (API) access policy that supports cross-application authorization between a first application and a second application associated with the identity provider that is configured to issue tokens on behalf of a second user of the first application and the second application that is different from the first user;

receiving, at the identity provider and from the first application and on the behalf of the second user, a request for a first token that is usable to obtain a second token from the identity provider to enable the cross-application authorization between the first application and the second application;

transmitting, to the first application and in response to the request, the first token in accordance with the API access policy for the cross-application authorization between the second application and the first application from which the request is received; and

exchanging, at the identity provider, the first token provided by the first application for the second token that is usable to access an API of the second application in accordance with the API access policy for the cross-application authorization between the first application and the second application.

2 . The method of claim 1 , wherein receiving the indication of the API access policy comprises:

receiving, from the first user that is an administrative user of the second application, a configuration for the API access policy that enables the identity provider to issue the first token to the first application on behalf of a respective user of the first application.

3 . The method of claim 2 , further comprising:

enabling the first application to request the first token from the identity provider on behalf of the second user in accordance with the API access policy for the cross-application authorization between the first application and the second application.

4 . The method of claim 1 , wherein the second application is configured to trust the identity provider to issue the first token to one or more applications associated with the identity provider without additional input from the first user, the second user, or both.

5 . The method of claim 1 , wherein the identity provider is configured to operate as an API single sign-on (SSO) provider for the first application and the second application.

6 . The method of claim 1 , further comprising:

receiving, at the identity provider, a request to access the first application via a user interface of the identity provider using single sign-on (SSO), the request comprising a set of login credentials associated with the second user of the first application.

7 . The method of claim 1 , further comprising:

issuing, to the first application, the first token and the second token based at least in part on determining that the second user is a member of one or more groups that satisfy a group membership criterion within the API access policy that integrates the first application with the second application.

8 . The method of claim 1 , wherein the API access policy defines a set of user information that the first application is able to access via the API of the second application.

9 . The method of claim 1 , wherein the API access policy is configured by an administrative user of the identity provider and wherein the first user is the administrative user or a different user.

10 . The method of claim 1 , wherein the first token comprises an OAuth authorization grant and the second token comprises one or both of an OAuth access token or an OAuth refresh token that is usable to access the API of the second application.

11 . The method of claim 1 , wherein the API access policy supports three legged OAuth (3LO) between the first application and the second application.

12 . An apparatus for cross-application authorization, comprising:

one or more memories storing processor-executable code; and

one or more processors coupled with the one or more memories and individually or collectively operable to execute the code to cause the apparatus to:

receive, at an identity provider and from a first user associated with the identity provider, an indication of an application programming interface (API) access policy that supports cross-application authorization between a first application and a second application associated with the identity provider that is configured to issue tokens on behalf of a second user of the first application and the second application that is different from the first user;

receive, at the identity provider and from the first application and on the behalf of the second user, a request for a first token that is usable to obtain a second token from the identity provider to enable the cross-application authorization between the first application and the second application;

transmit, to the first application and in response to the request, the first token in accordance with the API access policy for the cross-application authorization between the second application and the first application from which the request is received; and

exchange, at the identity provider, the first token provided by the first application for the second token that is usable to access an API of the second application in accordance with the API access policy for the cross-application authorization between the first application and the second application.

13 . The apparatus of claim 12 , wherein, to receive the indication of the API access policy, the one or more processors are individually or collectively operable to execute the code to cause the apparatus to:

receive, from the first user that is an administrative user of the second application, a configuration for the API access policy that enables the identity provider to issue the first token to the first application on behalf of a respective user of the first application.

14 . The apparatus of claim 13 , wherein the one or more processors are individually or collectively further operable to execute the code to cause the apparatus to:

enable the first application to request the first token from the identity provider on behalf of the second user in accordance with the API access policy for the cross-application authorization between the first application and the second application.

15 . The apparatus of claim 12 , wherein the second application is configured to trust the identity provider to issue the first token to one or more applications associated with the identity provider without additional input from the first user, the second user, or both.

16 . The apparatus of claim 12 , wherein the first token comprises an OAuth authorization grant and the second token comprises one or both of an OAuth access token or an OAuth refresh token that is usable to access the API of the second application.

17 . A non-transitory computer-readable medium storing code for cross-application authorization, the code comprising instructions executable by one or more processors to:

receive, at an identity provider and from a first user associated with the identity provider, an indication of an application programming interface (API) access policy that supports cross-application authorization between a first application and a second application associated with the identity provider that is configured to issue tokens on behalf of a second user of the first application and the second application that is different from the first user;

receive, at the identity provider and from the first application and on the behalf of the second user, a request for a first token that is usable to obtain a second token from the identity provider to enable the cross-application authorization between the first application and the second application;

transmit, to the first application and in response to the request, the first token in accordance with the API access policy for the cross-application authorization between the second application and the first application from which the request is received; and

exchange, at the identity provider, the first token provided by the first application for the second token that is usable to access an API of the second application in accordance with the API access policy for the cross-application authorization between the first application and the second application.

18 . The non-transitory computer-readable medium of claim 17 , wherein to receive the indication of the API access policy, the instructions are executable by the one or more processors to:

receive, from the first user that is an administrative user of the second application, a configuration for the API access policy that enables the identity provider to issue the first token to the first application on behalf of a respective user of the first application.

19 . The non-transitory computer-readable medium of claim 18 , wherein the instructions are further executable by the one or more processors to:

enable the first application to request the first token from the identity provider on behalf of the second user in accordance with the API access policy for the cross-application authorization between the first application and the second application.

20 . The non-transitory computer-readable medium of claim 17 , wherein the first token comprises an OAuth authorization grant and the second token comprises one or both of an OAuth access token or an OAuth refresh token that is usable to access the API of the second application.