Abstract: Providing access to a resource via authorization data that conditionally defines the access by an expression that identifies the resource by name and by at least one property of the resource. An authorization service issues the authorization data (e.g., as a token) and evaluating authorization data received from a client. The authorization service evaluates the expression in the authorization data to identify the resource and determine the rights associated with the user for the resource. The authorization service implements role-based access control to control access to resources in a distributed, multi-site network.

Abstract: A system and method for delegating at least one administrative duty associated with namespace management from an authentication system to at least one administration system. An application programming interface provides communication between the authentication system and the administration system. The authentication system receives a request from the administration system, verifies the authority of the request, and performs the action(s) specified in the request to manage a namespace.

Abstract: Methods and systems for resolving naming contests when a user seeks to register an account associated with a login identifier that is already in use by another user. An authentication server notifies the user of a contested registration when the requested login identifier, such as an e-mail address, matches one of the identifiers stored in an authentication database. The server then solicits confirmation from the user that the login identifier belongs to the requesting user rather than the earlier user. By forcing the earlier user to select a different login identifier, the server renders the existing user account inactive but retains a unique account identifier and associated account information for the inactive user account.