A method for controlling access to a protected Web service resource, comprising: (i) receiving a first request from a client to access the protected Web service resource from a communication network; (ii) receiving a first authentication token from the client after the client being authenticated from an authentication service and determining, based on evaluating the first authentication token, that the client has been authenticated according to a first factor; (iii) granting the first request to access the protected Web service resource based on authentication according to the first factor; (iv) receiving a second request from the client to access the protected Web service resource from the communication network; (v) denying the second request to access the protected Web service resource based on the authentication according to the first factor being insufficient to grant the second request and sending a message to the client directing the client to the authentication service to be authenticated according to a second factor; (vi) receiving a second authentication token from the client after the client being authenticated by the authentication service according to the second factor and determining, based on evaluating the second authentication token, that the client has been authenticated according to a second factor, and (vii) granting the second request to access the protected Web service resource based on authentication according to the second factor, wherein the client is communicatively connected with the Web service, and the authentication service through the network, wherein the first and second authentication tokens include a claim from the authentication service relating to a factor that was used to authenticate the client and wherein the authentication token is encrypted using public key cryptography, wherein the first factor is selected from the group comprising: a password, an answer to a security question, a biometric identifier, an object, and client specific information, wherein the second factor is different from the first factor, and wherein determining, based on an authentication token, that the client has been authenticated comprises: decrypting the authentication token with a public key of the authentication service; and determining that a claim made by the authentication service in the authentication token satisfies a condition for access, comprising evaluating the authentication token to verify the number and type of authentication processes completed by the client at the authentication service. (i) receiving a first request from a client to access the protected Web service resource from a communication network; (ii) receiving a first authentication token from the client after the client being authenticated from an authentication service and determining, based on evaluating the first authentication token, that the client has been authenticated according to a first factor; (iii) granting the first request to access the protected Web service resource based on authentication according to the first factor; (iv) receiving a second request from the client to access the protected Web service resource from the communication network; (v) denying the second request to access the protected Web service resource based on the authentication according to the first factor being insufficient to grant the second request and sending a message to the client directing the client to the authentication service to be authenticated according to a second factor; (vi) receiving a second authentication token from the client after the client being authenticated by the authentication service according to the second factor and determining, based on evaluating the second authentication token, that the client has been authenticated according to a second factor, and (vii) granting the second request to access the protected Web service resource based on authentication according to the second factor, wherein the client is communicatively connected with the Web service, and the authentication service through the network, wherein the first and second authentication tokens include a claim from the authentication service relating to a factor that was used to authenticate the client and wherein the authentication token is encrypted using public key cryptography, wherein the first factor is selected from the group comprising: a password, an answer to a security question, a biometric identifier, an object, and client specific information, wherein the second factor is different from the first factor, and wherein determining, based on an authentication token, that the client has been authenticated comprises: decrypting the authentication token with a public key of the authentication service; and determining that a claim made by the authentication service in the authentication token satisfies a condition for access, comprising evaluating the authentication token to verify the number and type of authentication processes completed by the client at the authentication service. decrypting the authentication token with a public key of the authentication service; and determining that a claim made by the authentication service in the authentication token satisfies a condition for access, comprising evaluating the authentication token to verify the number and type of authentication processes completed by the client at the authentication service.