A method for authentication of a user at a first computer to a first application and second application at a second computer, said method comprising the steps of: said first computer sending a first request to said second computer to access said first application, and in response, said second computer determining that said user has not yet been authenticated to said first application, and in response, said second computer redirecting said first request to a third computer, and in response, said third computer determining that said user has been authenticated to said third computer, and in response, said third computer authenticating said user to said first application and in response, said second computer returning a session key to said third computer for a session between said first application and said user, said session have a scope of said second computer or said first application but not a scope of a domain; and in response to said authentication of said user to said first application and receipt by said third computer of said session key from said second computer for a session between said user and said second computer or said first application, said third computer generating another session key with a scope of the domain and sending the domain-scope session key to said first computer; and said first computer sending a second request to said first application with said domain-scope session key, and in response, said first application recognizing a valid session between said user and said first application based on said domain-scope session key and responding to said first computer in compliance with said other request; and wherein said domain is a group of applications including said first application and second application in said second computer, or a group of computers including said second computer, which have a same domain name URL component; said first computer sending a third request to the second application with said domain-scope session key, and in response, said second application recognizing a valid session between said user and said second application based on said domain-scope session key and responding to said first computer in compliance with said further request. said first computer sending a first request to said second computer to access said first application, and in response, said second computer determining that said user has not yet been authenticated to said first application, and in response, said second computer redirecting said first request to a third computer, and in response, said third computer determining that said user has been authenticated to said third computer, and in response, said third computer authenticating said user to said first application and in response, said second computer returning a session key to said third computer for a session between said first application and said user, said session have a scope of said second computer or said first application but not a scope of a domain; and in response to said authentication of said user to said first application and receipt by said third computer of said session key from said second computer for a session between said user and said second computer or said first application, said third computer generating another session key with a scope of the domain and sending the domain-scope session key to said first computer; and said first computer sending a second request to said first application with said domain-scope session key, and in response, said first application recognizing a valid session between said user and said first application based on said domain-scope session key and responding to said first computer in compliance with said other request; and wherein said domain is a group of applications including said first application and second application in said second computer, or a group of computers including said second computer, which have a same domain name URL component; said first computer sending a third request to the second application with said domain-scope session key, and in response, said second application recognizing a valid session between said user and said second application based on said domain-scope session key and responding to said first computer in compliance with said further request.