Abstract: Disclosed are various embodiments for an authentication service. A unique identifier is associated with a device access token for a client to be authenticated. An authentication identifier is sent to an authenticated client. The client to be authenticated communicates the authentication identifier and unique identifier to the authentication service to complete authentication.

Abstract: Disclosed are various embodiments for an authentication service. A unique identifier is associated with a device access token for a client to be authenticated. An authentication identifier is sent to an authenticated client. The client to be authenticated communicates the authentication identifier and unique identifier to the authentication service to complete authentication.

Abstract: Disclosed are various embodiments for an authentication service. A unique identifier is associated with a device access token for a client to be authenticated. An authentication identifier is sent to an authenticated client. The client to be authenticated communicates the authentication identifier and unique identifier to the authentication service to complete authentication.

Abstract: Disclosed are various embodiments for identity data migration from one organization to another. An authentication service operated by a first organization receives user login information from a client device. The authentication service identifies a second organization for which the authentication service authenticates users. The user login information is verified according to an identity data associated with the second organization. An authentication token is returned to the client device and used by the client device to access resources of a network site operated by the second organization.

Abstract: Disclosed are various embodiments for a shopping cart component of an electronic commerce application. The shopping cart may be shared by one or more users of the electronic commerce application. In this respect, the shopping cart represents the aggregate purchase of items on behalf of multiple users of the electronic commerce application. Each user with access to the shopping cart may add to or remove items from the shopping cart or purchase some or all of the items within the shopping cart. Further, each user may share the shopping cart with other users of the electronic commerce application. Discounts or other promotional or marketing credits or benefits may also be added to and shared by all users with access to the shopping cart.

Abstract: Disclosed are various embodiments for providing a native authentication experience with failover. A network service authenticates a first application executed in a computing device in a first instance using one or more authentication factors received via a platform-specific application programming interface that is native to the computing device. After a change to how authentication is performed by the network service, the network service authenticates the first application in a second instance via code-based linking with a second application that is authenticated.

Abstract: Methods and systems are provided to enable gradual expiration of credentials. Instead of depriving a user of all his access rights upon expiration of his credential (e.g., password), the user's access rights may be gradually restricted during a grace period after an expected or initial expiration time and/or before a final expiration time. The access right may be determined based on a duration from a time of the access request to the final expiration time or to the initial expiration time.

Abstract: Methods and systems are provided to enable access control based on credential properties. Besides authenticating a credential, an authentication service can provide additional credential-related information with respect to a credential such as last updated time. An entity receiving such additional credential-related information can implement access control policies based on the credential-related information. For instance, a user's access rights may be gradually restricted after an initial expiration time and towards a final expiration time. In an example, such access control may be implemented by a client application or client website of the authentication service. Alternatively or additionally, such access control may be implemented by an authorization service used by the client application or client website.

Abstract: Disclosed are various embodiments for identity data migration from one organization to another. Identity data corresponding to user accounts of a first organization are copied from a first data store managed by the first organization to a second data store managed by a second organization. A sign-in process of a network site of the first organization is reconfigured to employ an authentication service operated by the second organization. The authentication service is configured to authenticate a user of the network site using the identity data stored in the second data store.

Abstract: Disclosed are various embodiments for an authentication service. A unique identifier is associated with a device access token for a client to be authenticated. An authentication identifier is sent to an authenticated client. The client to be authenticated communicates the authentication identifier and unique identifier to the authentication service to complete authentication.

Abstract: Disclosed are various embodiments for providing a native authentication experience with failover. A network service authenticates a first application executed in a computing device in a first instance using one or more authentication factors received via a platform-specific application programming interface that is native to the computing device. After a change to how authentication is performed by the network service, the network service authenticates the first application in a second instance via code-based linking with a second application that is authenticated.

Abstract: Disclosed are various embodiments for providing a native authentication experience with failover. If a particular authentication approach is supported by a network service, an application authenticates with the network service according to the authentication approach using an authentication factor received via a platform-specific interface. If the particular authentication approach is not supported, code-based linking may be employed to authenticate via another application that is authenticated with the network service.

Abstract: A computer implemented method, apparatus, and computer program product for managing requests. Responsive to receiving a request from a client, a determination is made as to whether a connection within a pool of connections has a set of outstanding requests for the client to handle a previous request from the same client. Responsive to a determination that the connection has any outstanding request, a determination is made as to whether a set of requests queued for the connection is equal to or exceeds a threshold. Responsive to a determination that the set of outstanding requests is equal to or exceeds the threshold, subsequent requests from the client are unprocessed until the set of outstanding requests becomes less than the threshold.

Abstract: Disclosed are various embodiments for obtaining a service request from a client, the service request including plaintext data to be encrypted and associated metadata. Ciphertext data is generated based upon the plaintext data. The ciphertext data is stored in a record in a data store of a cryptographic device. A service response is provided to the client, which includes a record identifier for the record in the data store.

Abstract: In association with a data processing system that includes one or more servers, one or more clients and a partitionable distributed directory contained in a database, a computer implemented method is provided for selectively processing data entries that reside in the directory. The method comprises the steps of generating a request to perform an operation on each data entry in a specified group of intended entries, and specifying a hashing control index that uniquely identifies each entry of the specified group, and excludes all other entries. The requested operation is applied only to data entries in the directory that are identified by the specified hashing control index.

Abstract: A method, system, and computer usable program product for deploying directory instances are provided in the illustrative embodiments. A configuration of an existing directory instance is cloned to the new directory instance. The existing directory instance may execute in a first data processing system and the new directory instance may execute in a second data processing system. A schema of the existing directory instance is cloned to the new directory instance. A determination is made whether the new directory instance is a peer of the existing directory instance. Data from the existing directory instance is cloned to the new directory instance if the new directory instance is a peer of the existing directory instance. The new directory instance is made operational in a directory topology.

Abstract: A filter range based search control to request a range of data from one or more directory servers. A directory server receives a search request from a client application comprising a search filter control defining a set of requested data, a sort control defining a sorting order of the set of requested data, and a range filter control defining a range of entries in the requested data. Data entries matching a search value defined in the search filter control and sorted according to sort attributes defined in the sort control are obtained from a set of directories associated with the directory server to form a sorted list of matching entries. A subset of data entries in the sorted list that match a range value defined in the range filter control are collected, and a response comprising the collected subset of data entries is then sent to the client application.

Abstract: A filter range based search control to request a range of data from one or more directory servers. A directory server receives a search request from a client application comprising a search filter control defining a set of requested data, a sort control defining a sorting order of the set of requested data, and a range filter control defining a range of entries in the requested data. Data entries matching a search value defined in the search filter control and sorted according to sort attributes defined in the sort control are obtained from a set of directories associated with the directory server to form a sorted list of matching entries. A subset of data entries in the sorted list that match a range value defined in the range filter control are collected, and a response comprising the collected subset of data entries is then sent to the client application.

Abstract: A filter range based search control to request a range of data from one or more directory servers. A directory server receives a search request from a client application comprising a search filter control defining a set of requested data, a sort control defining a sorting order of the set of requested data, and a range filter control defining a range of entries in the requested data. Data entries matching a search value defined in the search filter control and sorted according to sort attributes defined in the sort control are obtained from a set of directories associated with the directory server to form a sorted list of matching entries. A subset of data entries in the sorted list that match a range value defined in the range filter control are collected, and a response comprising the collected subset of data entries is then sent to the client application.

Abstract: A method, system, and computer usable program product for transmitting information about dynamic group memberships of an entry stored in a computer memory are provided in the illustrative embodiments. A set of dynamic group filters is received from a server in a distributed data environment. The set of dynamic group filters provides a set of attributes. A determination is made whether the entry includes a subset of the set of attributes. A request for dynamic group memberships of the entry is sent to the server. The request includes the subset of attributes and excludes attributes not used by any of the dynamic group filters. Information about at least one dynamic group of which the entry is a member is received for evaluation. A proxy server may receive the request for dynamic group filters and distribute the request to one or more servers in a distributed data environment.