Introduction Web services are often intended for specific user populations. In an increasingly decentralized environment, the organization providing the service may well be different from the organization managing the user population.
Many providers offer services customized for each individual.
Service providers typically need to verify the user's identity in some way when allowing access to individualized services. Ideally the user's identity should correspond to their identity as managed at their local organization. This document describes a simple method for an organization to establish proof of user identities under its management to any service provider, without revealing user secrets or providing direct access to its authentication or authorization systems. The service provider must have a mechanism to parse incoming url's, such as a CGI script. The requirements lead us naturally to the notion of public key technology.