A system comprising a first server for hosting a web application or an internet information service wherein the first server includes computer-executable instructions defining an identity federation and security token translation module for managing and facilitating a creation of a custom security principal object for a user requesting access to the web application or the IIS; wherein the identity federation and security token translation module includes: an access thread for directly requesting and obtaining security tokens from at least one security token service based on a request for access from a user of the web application or the IIS; a new user security token request thread for requesting and receiving a security token from the STS; a validation thread for validating the received security token from the STS; a user profile call thread for calling another service and receiving user profile and fine grain access information corresponding to the validated received security token; a builder thread for building a custom security principal object from the received user profile and FGA information; an insertion thread for inserting the custom security principal object in the web application or the IIS as an FGA dataset; a secure sockets layer certificate thread for pulling a SSL certificate from the web application or the and sending the SSL certificate to the STS; a data cache for storing the custom security principal object in a non-transitory computer readable media, wherein the data cache is located on the first server; a user cache search thread for determining if the data cache includes a custom security principal object for the user requesting access to the web application or the IIS, wherein, if it is determined that the data cache includes a custom security principal object for the user requesting access to the web application or the IIS, the module inserts the custom security principal object for the user from the data cache in the web application or the IIS; and wherein the identity federation and security token translation module is configured to be changed without making changes to the web application or the IIS. an access thread for directly requesting and obtaining security tokens from at least one security token service based on a request for access from a user of the web application or the IIS; a new user security token request thread for requesting and receiving a security token from the STS; a validation thread for validating the received security token from the STS; a user profile call thread for calling another service and receiving user profile and fine grain access information corresponding to the validated received security token; a builder thread for building a custom security principal object from the received user profile and FGA information; an insertion thread for inserting the custom security principal object in the web application or the IIS as an FGA dataset; a secure sockets layer certificate thread for pulling a SSL certificate from the web application or the and sending the SSL certificate to the STS; a data cache for storing the custom security principal object in a non-transitory computer readable media, wherein the data cache is located on the first server; a user cache search thread for determining if the data cache includes a custom security principal object for the user requesting access to the web application or the IIS, wherein, if it is determined that the data cache includes a custom security principal object for the user requesting access to the web application or the IIS, the module inserts the custom security principal object for the user from the data cache in the web application or the IIS; and wherein the identity federation and security token translation module is configured to be changed without making changes to the web application or the IIS.