Patent attributes
A client computer and/or a user is authenticated via installation of an agent, permitting access to previously inaccessible resources. All users are initially denied access to a resource via a permission list, such as a by being a member of a group that is denied access. The user, once authenticated, is permitted to access the resource, e.g. by being temporarily removed from a cached copy of the group, by being temporarily added to a cached copy of a group allowed to access the resource, or both. Authentication is revoked when the agent is uninstalled. Subsequent accesses to the resource are not permitted, e.g. by undoing the temporary removal or addition. An optional resource firewall proxy server between client computers and a resource filters requests for the resource, and until a user is authenticated via an out-of-band communication from an agent, the user is denied access to the resource.
