A method of operating an authentication server capable of authenticating any of multiple different users to multiple different service providers via a network, comprising: storing validation information for the first user; storing authentication policy requirements of a first of the multiple service providers, in association with an identifier of the first provider; transmitting a first random number to the first provider via the network; receiving, from the first provider via the network, first other information; receiving, from a requesting user via the network, the first random number and a request of that user to be authenticated; transmitting, after receipt of the first random number and authentication request, the stored first provider identifier, the received first other information, and the stored first provider authentication policy requirements, to the requesting user via the network; receiving, in response to the transmitted first provider authentication policy requirements, a user identifier and validation information, from the requesting user via the network; matching the received requesting user identifier to the stored first user identifier; determining that the validation information received from the requesting user corresponds to the stored first provider authentication policy requirements; comparing the validation information received from the requesting user with the stored first user validation information to authenticate that the requesting user is the first user; receiving, from the requesting user via the network, a message, including the first random number and the first other information, signed with a credential; and transmitting, to the first provider via the network, notice of authentication of the first user and the received signed message. storing validation information for the first user; storing authentication policy requirements of a first of the multiple service providers, in association with an identifier of the first provider; transmitting a first random number to the first provider via the network; transmitting a first random number to the first provider via the network; receiving, from the first provider via the network, first other information; receiving, from a requesting user via the network, the first random number and a request of that user to be authenticated; transmitting, after receipt of the first random number and authentication request, the stored first provider identifier, the received first other information, and the stored first provider authentication policy requirements, to the requesting user via the network; receiving, in response to the transmitted first provider authentication policy requirements, a user identifier and validation information, from the requesting user via the network; receiving, from a requesting user via the network, the first random number and a request of that user to be authenticated; transmitting, after receipt of the first random number and authentication request, the stored first provider identifier, the received first other information, and the stored first provider authentication policy requirements, to the requesting user via the network; receiving, in response to the transmitted first provider authentication policy requirements, a user identifier and validation information, from the requesting user via the network; matching the received requesting user identifier to the stored first user identifier; determining that the validation information received from the requesting user corresponds to the stored first provider authentication policy requirements; comparing the validation information received from the requesting user with the stored first user validation information to authenticate that the requesting user is the first user; receiving, from the requesting user via the network, a message, including the first random number and the first other information, signed with a credential; and transmitting, to the first provider via the network, notice of authentication of the first user and the received signed message. receiving, from the requesting user via the network, a message, including the first random number and the first other information, signed with a credential; and transmitting, to the first provider via the network, notice of authentication of the first user and the received signed message.