Patent ID: 7370195
Filing Date: 2008-05-06
Classification: G06Q,H04L

Abstract:
1. At a super authority connected to a network environment, an assigned authenticating authority and one or more other authenticating authorities also being connected to the network environment, each authenticating authority configured to authenticate of subset of principals that access the network environment through different domains, a method of controlling authentication of a principal for access to network resources in the network environment, wherein the principal's account identifier is configured for authentication at an authenticating authority from among the assigned authenticating authority and the one or more other authenticating authorities, the method comprising: receiving at the super authority a request for an authenticating authority resolution from an authenticating authority that is not authorized to authenticate the principal, wherein the request comprises an account ID of the principal to be authenticated, the account ID including an individual identifier and a domain identifier; accessing an assignment mapping that maps each account ID in a plurality of account IDs to a corresponding plurality of authenticating authorities that are authorized to authenticate the account ID, the account ID including an individual identifier and a domain identifier, the account ID being used to identify comprising the identity of the principal; locating within the mapping an identity of an assigned authenticating authority from among the one or more authenticating authorities that corresponds to the individual identifier and domain identifier in the account ID of the principal to be authenticated; causing an authentication request to be transmitted to the assigned authenticating authority located from among the one or more other authenticating authorities, the assigned authenticating authority having been located using the principal's individual identifier and domain identifiers in the principal's account ID, wherein the request asks the assigned authenticating authority to authenticate the principal; altering the assignment mapping whereby an account ID previously mapped to a first authenticating authority is remapped to a second authenticating authority.