Secure resource authorization for external identities using remote principal objects
摘要
說明書
Regarding sign-in/authentication activity, when a user/remote principal signs-in to the data resource owner domain from their own domain, the owner should know that a sign-in occurred and a token was issued to a data resource in their domain. The specific identity of the remote principal that was authentication, as well as their geographic location, are private with respect to the remote principal's domain and are thus not shared with the data resource owner, in embodiments. The service provider should know that one of their users signed-in to the customer tenant. The remote principal's domain however, is provided complete details of the sign-in/authentication for tasks and access to data resources, including who, when, from where, and/or the like.
Regarding activity audits, each activity performed (including reads) through the tokens issued to remote principals are tracked and made available to the data resource owner's domain, in embodiments. The audits of write activities made available to the data resource owner's domain include the RPO identifier and then token identifier instead of the actual user/remote principal identity.
Systems and devices are configured in various ways to perform secure resource authorization for external identities using remote principal objects—in this context,
