US Patent 11997207 Identifying group membership through discharge macaroon access tokens

The disclosed technology teaches delegating authorization to access a resource server contingent upon group membership confirmation by a third-party identity management provider. As part of the technology, a client obtains a Macaroon Access Token with a third-party caveat that requires the client to obtain a one-time Discharge Macaroon Authorization from a third-party authority, and identifies both user group membership that needs to be checked, and a hint how to find the third-party authority. The client provides the Macaroon Access Token to the third-party authority. The client obtains, from the third-party authority, a Discharge Macaroon Access Token that identifies user group membership, and sends the Macaroon Access Token and the Discharge Macaroon Authorization to the resource server as proof of authorization.