Policy Service Authorization and Authentication

摘要

Requests for remote network resources can be denied by a policy service by redirecting a requesting user agent to an authorization portal. The authorization portal can authenticate the user agent and redirect the user agent to the originally requested resource with a token. The policy service can be configured to detect the token, and redirect the requesting user agent to the resource with a cookie. The policy service can be configured to reference such cookies when applying policy. Accordingly, an authenticated user agent can be allowed to access the remote network resource and resources at the same host/domain by virtue of the cookie and without additional authentication.

主权项

1. A method of applying network resource access policy, the method comprising:
receiving from a user agent a request for a remote network resource; obtaining from the request authorization data specific to the remote network resource when the request contains the authorization data; determining a resource access policy for the request, including using the authorization data, if obtained, to determine the resource access policy for the request; applying the resource access policy to allow or deny access by the user agent to the remote network resource; when denying access to the remote network resource, redirecting the user agent to an authorization portal; after authorization by the authorization portal, receiving from the user agent an authorized request for the remote network resource, the authorized request including an authorization token; and in response to receiving the authorized request including the authorization token, storing the authorization data specific to the remote network resource at the user agent and redirecting the user agent to the remote network resource to cause the user agent to make another request for the remote network resource.