7. vCloud Security Examples : 7.2 Single Sign-On (SSO) – Consumer : 7.2.2 Use Case : 7.2.2.3. Delegation
   
7.2.2.3. Delegation
Executing tasks on behalf of a user is referred to as delegation. In this example use case, some workflows, which an end user initiates, might require multiple solutions to communicate with each other. This use case shows the SSO support for such work flows. Before the user can initiate the workflow through a given UI, the user must provide credentials. The UI then validates those credentials against the SSO server, which issues a SAML token. Then the user decides to initiate a workflow, which requires Solution-1 to access Solution-2 and Solution-3 on behalf of the end user. As part of this process, the UI requests from the SSO server a so-called “delegated” token for Solution-1 by providing the SAML token of the end user. The delegated token asserts that the user has granted Solution-1 the privileges to execute tasks on the user’s behalf. After the UI has the delegated token it gives it to Solution-1, which then can use it to log in to Solution-2 and Solution-3. The following figure illustrates this use case.
Figure 40. Task Execution on Behalf of a User