Abstract: Examples relate to providing selective access to resources. In one example, a computing device may: receive, from a client application, a request to access a first resource server, the request including a client access token; identify a first set of permissions specified by a client topology, the client topology specifying: the first resource server; the first set of permissions for accessing, by the client application, the first resource server; a second resource server; and a second set of permissions for accessing, by the first resource server, the second resource server; provide the client application with a first access token specifying the first set of permissions and the first resource server; receive, from the first resource server, a request to access the second resource server, the request including the first access token; and provide the first resource server with a second access token specifying the second set of permissions.

Abstract: In response to a request of a first user, identity information for users is searched to retrieve a portion of the identity information corresponding to the first user. The identity information including fields, where a first subset of the fields is schemaless, and a second subset of the fields is interpreted according to a specified schema. Searching the identity information includes searching the first subset and the second subset of fields. An action for the request is authorized by using information included in at least one field of the first subset included in the retrieved portion of the identity information.

Abstract: According to an example, to authenticate a user of a computing device, a user login request with at least one primary credential is received from a computing device. At least one primary credential is validated to authenticate the user, and a first device token is created and transmitted to the computing device. A secondary credential is received from the computing device, and a server token and a reference to the server token is created. The server token is encrypted and stored and the server token reference is sent to computing device for use in a subsequent authentication with the secondary credential.

Abstract: Groups of a plurality of tenants are mapped to identity management classes corresponding to respective roles that grant respective permissions. The identity management classes are associated with hierarchical delegation information that specify delegation rights among the identity management classes, the delegation rights specifying rights of members of the respective identity management classes to perform delegation with respect to further members of the identity management classes. In response to a request by a first member of a first of the identity management classes to perform delegation with respect to a second member of one of the identity management classes, it is determined, based on the hierarchical delegation information, whether the first member is allowed to perform the delegation with respect to the second member.

Abstract: A first representation is provided of privileges among a plurality of tenants of a system. The tenants have relationships according to a hierarchy that includes multiple hierarchical levels of the tenants, where at least one of the privileges specifies a permission of a first tenant to perform a task with respect to a second tenant. The first representation is independent of a representation of the relationships among the plurality of tenants. In response to a request from the first tenant to perform a task with respect to the second tenant, a system determines, based on the first representation, whether the first tenant is permitted to perform the task with respect to the second tenant.

Abstract: Examples relate to providing selective access to resources. In one example, a computing device may: receive, from a client application, a request to access a first resource server, the request including a client access token; identify a first set of permissions specified by a client topology, the client topology specifying: the first resource server; the first set of permissions for accessing, by the client application, the first resource server; a second resource server; and a second set of permissions for accessing, by the first resource server, the second resource server; provide the client application with a first access token specifying the first set of permissions and the first resource server; receive, from the first resource server, a request to access the second resource server, the request including the first access token; and provide the first resource server with a second access token specifying the second set of permissions.

Abstract: According to an example, to authenticate a user of a computing device, a user login request with at least one primary credential is received from a computing device. At least one primary credential is validated to authenticate the user, and a first device token is created and transmitted to the computing device. A secondary credential is received from the computing device, and a server token and a reference to the server token is created. The server token is encrypted and stored and the server token reference is sent to computing device for use in a subsequent authentication with the secondary credential.

Abstract: Groups of a plurality of tenants are mapped to identity management classes corresponding to respective roles that grant respective permissions. The identity management classes are associated with hierarchical delegation information that specify delegation rights among the identity management classes, the delegation rights specifying rights of members of the respective identity management classes to perform delegation with respect to further members of the identity management classes. In response to a request by a first member of a first of the identity management classes to perform delegation with respect to a second member of one of the identity management classes, it is determined, based on the hierarchical delegation information, whether the first member is allowed to perform the delegation with respect to the second member.

Abstract: Access of a resource or service requested by a user is authorized by using identity information of at least one of plural records containing identity information for respective users. Replication of portions of the records containing identity information for the respective users among different zones is controlled, where the controlling of the replication is based on metadata individually associated with respective portions of the records. Each of the metadata identifies at least one zone to which a respective portion of a respective one of the records is allowed to be replicated.

Abstract: A first representation is provided of privileges among a plurality of tenants of a system. The tenants have relationships according to a hierarchy that includes multiple hierarchical levels of the tenants, where at least one of the privileges specifies a permission of a first tenant to perform a task with respect to a second tenant. The first representation is independent of a representation of the relationships among the plurality of tenants. In response to a request from the first tenant to perform a task with respect to the second tenant, a system determines, based on the first representation, whether the first tenant is permitted to perform the task with respect to the second tenant.

Abstract: In response to a request of a first user, identity information for users is searched to retrieve a portion of the identity information corresponding to the first user. The identity information including fields, where a first subset of the fields is schemaless, and a second subset of the fields is interpreted according to a specified schema. Searching the identity information includes searching the first subset and the second subset of fields. An action for the request is authorized by using information included in at least one field of the first subset included in the retrieved portion of the identity information.