{"id":703,"date":"2007-03-04T17:50:33","date_gmt":"2007-03-05T01:50:33","guid":{"rendered":"\/?p=703"},"modified":"2007-03-04T18:05:48","modified_gmt":"2007-03-05T02:05:48","slug":"separating-the-identity-of-users-from-services","status":"publish","type":"post","link":"https:\/\/www.identityblog.com\/?p=703","title":{"rendered":"Separating the identity of users from services"},"content":{"rendered":"

Geoff Arnold added a comment to an earlier piece<\/a> that helps tease out the issues around delegation:<\/p>\n

In otherwords, there is no user-absent scenario. There is a user is present and delegates authority scenario. After all, how can a user delegate authority if she isn\u00e2\u20ac\u2122t present???<\/em><\/p>\n

That's fine as long as one of the rights that can be delegated is ability to delegate further<\/strong>. And I'm guessing that that's what Eve is really talking about. Not delegating 100% of her rights to some agent, but delegating sufficient rights that the agent can act as a more-or-less first class entity, negotiating and delegating on her behalf.<\/p>\n

In fact the only (obvious) right that I should not be able to delegate is the right of revocation….<\/p><\/blockquote>\n

OK.  So delegation is recursive.  If we accept the notion that services operate within their own identity<\/strong> when they do something a user has asked them to – then if they want to delegate further, they need to create a Delegation Token that:<\/p>\n