A method implemented by a computing device comprising: authenticating a client to access resources from a service provider; in connection with authentication of the client, determining whether the service provider is configured to support tokens that do not include privilege data; and based on the determination: issuing a combined authentication token to the client that includes privilege data associated with the client when the service provider is not configured to support tokens that do not include privilege data; or issuing a lightweight token to the client and communicating the privilege data associated with the client for storage in a centralized authentication database when the service provider is configured to support tokens that do not include privilege data; wherein the lightweight token is configured to include a reference usable by the service provider to look-up privilege data associated with the client from the centralized authentication database; wherein, upon detecting a lightweight token in a request to access resources, the reference is obtained from the lightweight token, and the privilege data associated with the reference is verified to permit user access to the resources. authenticating a client to access resources from a service provider; in connection with authentication of the client, determining whether the service provider is configured to support tokens that do not include privilege data; and based on the determination: issuing a combined authentication token to the client that includes privilege data associated with the client when the service provider is not configured to support tokens that do not include privilege data; or issuing a lightweight token to the client and communicating the privilege data associated with the client for storage in a centralized authentication database when the service provider is configured to support tokens that do not include privilege data; wherein the lightweight token is configured to include a reference usable by the service provider to look-up privilege data associated with the client from the centralized authentication database; wherein, upon detecting a lightweight token in a request to access resources, the reference is obtained from the lightweight token, and the privilege data associated with the reference is verified to permit user access to the resources. issuing a combined authentication token to the client that includes privilege data associated with the client when the service provider is not configured to support tokens that do not include privilege data; or issuing a lightweight token to the client and communicating the privilege data associated with the client for storage in a centralized authentication database when the service provider is configured to support tokens that do not include privilege data; wherein the lightweight token is configured to include a reference usable by the service provider to look-up privilege data associated with the client from the centralized authentication database; wherein, upon detecting a lightweight token in a request to access resources, the reference is obtained from the lightweight token, and the privilege data associated with the reference is verified to permit user access to the resources.