A method performed by an intermediary server, the intermediary server being deployed on a network path in between a client and a host associated with a relying party, the intermediary server being remote from the client, the method comprising: establishing a secure session on a resource domain with a client (201, 401); within the secure session on the resource domain, receiving a request for a resource hosted under the resource domain (202, 402); proxying the request for the resource from the client to a relying party host acting as origin for the resource domain (202, 402); intercepting (204, 404) a redirect (203, 403) sent from the RP host to redirect the client from the resource domain to an identity services provider (IdP) domain, said interception performed to prevent the redirect from reaching the client; in response to intercepting the redirect, prompting the client for a client credential, said prompting occurring within the secure session on the resource domain (205, 405); independent of the client, performing the following actions: receiving the client credential within the secure session on the resource domain (205, 405), following the redirect to contact an IdP host on the IdP domain, and providing the client credential to the IdP host to obtain an identity assertion from the IdP host (206, 207, 406, 407), and sending the assertion to the relying party to obtain therefrom a resource domain credential for the client (208, 209, 408, 409), the resource domain credential being distinct from the client credential; once the resource domain credential for the client is obtained, associating the resource domain credential with the secure session on the resource domain between the client and the intermediary server, where said associating comprises any of: storing the resource domain credential on the intermediary server on behalf of the client, and storing the resource domain credential on the client under the resource domain; after said association of the resource domain credential with the secure session on the resource domain between the client and the intermediary server: proxying a request from the client to the RP host for the resource and including the resource domain credential with the proxied request (211, 411). establishing a secure session on a resource domain with a client (201, 401); within the secure session on the resource domain, receiving a request for a resource hosted under the resource domain (202, 402); proxying the request for the resource from the client to a relying party host acting as origin for the resource domain (202, 402); intercepting (204, 404) a redirect (203, 403) sent from the RP host to redirect the client from the resource domain to an identity services provider (IdP) domain, said interception performed to prevent the redirect from reaching the client; in response to intercepting the redirect, prompting the client for a client credential, said prompting occurring within the secure session on the resource domain (205, 405); independent of the client, performing the following actions: receiving the client credential within the secure session on the resource domain (205, 405), following the redirect to contact an IdP host on the IdP domain, and providing the client credential to the IdP host to obtain an identity assertion from the IdP host (206, 207, 406, 407), and sending the assertion to the relying party to obtain therefrom a resource domain credential for the client (208, 209, 408, 409), the resource domain credential being distinct from the client credential; receiving the client credential within the secure session on the resource domain (205, 405), following the redirect to contact an IdP host on the IdP domain, and providing the client credential to the IdP host to obtain an identity assertion from the IdP host (206, 207, 406, 407), and sending the assertion to the relying party to obtain therefrom a resource domain credential for the client (208, 209, 408, 409), the resource domain credential being distinct from the client credential; once the resource domain credential for the client is obtained, associating the resource domain credential with the secure session on the resource domain between the client and the intermediary server, where said associating comprises any of: storing the resource domain credential on the intermediary server on behalf of the client, and storing the resource domain credential on the client under the resource domain; storing the resource domain credential on the intermediary server on behalf of the client, and storing the resource domain credential on the client under the resource domain; after said association of the resource domain credential with the secure session on the resource domain between the client and the intermediary server: proxying a request from the client to the RP host for the resource and including the resource domain credential with the proxied request (211, 411). proxying a request from the client to the RP host for the resource and including the resource domain credential with the proxied request (211, 411).