Abstract: A system, method, and computer program for authorizing GraphQL access by calling an authorization engine to obtain an authorization decision and conforming to its obligation objects. A requester sends a message to a GraphQL function containing a query or mutation operation. The request is validated and authenticated. The authorization engine is called; it renders an access control decision and may obligate the GraphQL function to adhere to certain requirements when carrying out that decision. A GraphQL engine executes the operation when the authorization engine has not denied access and the obligation objects can be conformed to. The GraphQL engine fetches data from data sources. The GraphQL engine returns operation results which are further adhered to according to the obligation objects of the authorization engine or returns an error. The operation results are updated if so required by the obligation objects of the authorization engine. The possibly updated operation results are returned to the requester.

Abstract: Authentication of a user of an OAuth client by an OAuth authorization server, comprising exposing an authentication state machine, where the states of the state machine are hypermedia-based representations of login resources, and transitions between states are represented by hypermedia links, wherein the authentication state machine is exposed to the client by an API adhering to the principles of REpresentational State Transfer (REST). When the final state of the state machine has been reached, a secondary access token is issued to the client, thereby authenticating the user, wherein hypermedia representations which are sent to the client are encoded so as to be readily parsable by the client.