Abstract: A system and method for granting a user access to one or more resources managed by one or more resource servers may include authenticating a user of an application. An application scope associated with the application may represent resource server(s) and respective resources that the application is configured to access or otherwise consume. A management role associated with the user may represent resource server(s) and respective resources that the user is authorized to access or otherwise consume. An access token may be determined using the application scope and the management role. The access token may represent resource server(s) and respective resources that the user is authorized to access or otherwise consume via the application.

Abstract: A system and method for granting a user access to one or more resources managed by one or more resource servers may include authenticating a user of an application. An application scope associated with the application may represent resource server(s) and respective resources that the application is configured to access or otherwise consume. A management role associated with the user may represent resource server(s) and respective resources that the user is authorized to access or otherwise consume. An access token may be determined using the application scope and the management role. The access token may represent resource server(s) and respective resources that the user is authorized to access or otherwise consume via the application.

Abstract: Systems and methods for automatic, non-interactive generation of information card tokens are provided. An apparatus can include a receiver, a transmitter, and an information card token generator, wherein the information card token generator is operable to generate an information card token in response to an information card token request received from a relying party site, the information card security token being based at least in part on a user-defined policy.

Abstract: Crafted identities are provided. A statement is provided to the principal for using a crafted identity. The statement includes an identifier that provides access to a resource when presented by the principal to the resource. The statement also includes one or more roles and permissions for the crafted identity when accessing the resource.

Abstract: Methods and systems are provided for enforcing security on attributes of objects. A requestor attempts to assign a value to a target attribute of a target object. The value is a reference to a third object. The target attribute includes security for assigning values and is also linked to a related third attribute associated with the third object. The security associated with the target attribute and security associated with the third attribute are both independently enforced before the assignment of the value to the target attribute is permitted to proceed.