A method for authenticating users of a data processing platform comprising: storing a mapping of a first user platform identifier assigned to a first user identity provider identifier associated with a first external identity provider of a first realm to a second user platform identifier assigned to a second user identity provider identifier associated with a second external identity provider of a second realm for a same user, wherein realms are those users in groups that are provided by each different identity provider, and wherein storing the mapping comprises: assigning the first user platform identifier to the first user identity provider identifier associated with the first external identity provider of the first realm and assigning the second user platform identifier to the second user identity provider identifier associated with the second external identity provider; linking the first user platform identifier to the second user platform identifier to link at least one permission provided from the first external identity provider with at least one permission provided from the second external identity provider; receiving a request from a client device to establish an access session to perform one or more actions on data of the data processing platform; receiving, from at least one of the first external identity provider of the first realm or the second external identity provider of the second realm, a user identity provider identifier associated with the request; determining whether the received user identity provider identifier associated with the request matches either the first user identity provider identifier associated with the first user platform identifier or the second user identity provider identifier associated with the second user platform identifier based at least in part on the mapping; and granting permission to perform the one or more actions on the data of the data processing platform based on the at least one permission associated with the first user platform identifier assigned to the first user identity provider identifier and the at least one permission associated with the second user platform identifier assigned to the second user identity provider identifier, wherein either the first or the second user platform identifier matches the received user identity provider identifier associated with the request; wherein the method is carried out by one or more processors. storing a mapping of a first user platform identifier assigned to a first user identity provider identifier associated with a first external identity provider of a first realm to a second user platform identifier assigned to a second user identity provider identifier associated with a second external identity provider of a second realm for a same user, wherein realms are those users in groups that are provided by each different identity provider, and wherein storing the mapping comprises: assigning the first user platform identifier to the first user identity provider identifier associated with the first external identity provider of the first realm and assigning the second user platform identifier to the second user identity provider identifier associated with the second external identity provider; linking the first user platform identifier to the second user platform identifier to link at least one permission provided from the first external identity provider with at least one permission provided from the second external identity provider; assigning the first user platform identifier to the first user identity provider identifier associated with the first external identity provider of the first realm and assigning the second user platform identifier to the second user identity provider identifier associated with the second external identity provider; linking the first user platform identifier to the second user platform identifier to link at least one permission provided from the first external identity provider with at least one permission provided from the second external identity provider; receiving a request from a client device to establish an access session to perform one or more actions on data of the data processing platform; receiving, from at least one of the first external identity provider of the first realm or the second external identity provider of the second realm, a user identity provider identifier associated with the request; determining whether the received user identity provider identifier associated with the request matches either the first user identity provider identifier associated with the first user platform identifier or the second user identity provider identifier associated with the second user platform identifier based at least in part on the mapping; and granting permission to perform the one or more actions on the data of the data processing platform based on the at least one permission associated with the first user platform identifier assigned to the first user identity provider identifier and the at least one permission associated with the second user platform identifier assigned to the second user identity provider identifier, wherein either the first or the second user platform identifier matches the received user identity provider identifier associated with the request; wherein the method is carried out by one or more processors.