An apparatus for authorizing users of network portals (106,108,110,112) to access a secure resource hosted by a secure server, comprising: an authorization table to store a plurality of user identifiers, each representing a user of an owning portal, and to store for each of the user identifiers an access privilege to the secure resource; wherein the authorization table stores a proxy user identifier representing a guest portal and a guest access privilege to the secure resource for all of the users of the guest portal; a policy manager comprising: means for receiving requests for access to the secure resource; wherein if a request for access to the secure resource is received from the owning portal, the request comprising a user identifier representing a user of the owning portal, the policy manager is configured to grant to the user of the owning portal access to the secure resource according to the access privilege stored in the authorization table for the user identifier; and wherein if a request for access to the secure resource is received from the guest portal, the request comprising a user identifier representing a user of the guest portal and a portal identifier representing the guest portal, the policy manager is configured to grant to the user of the guest portal access to the secure resource according to the guest access privilege stored in the authorization table for the proxy user identifier. an authorization table to store a plurality of user identifiers, each representing a user of an owning portal, and to store for each of the user identifiers an access privilege to the secure resource; wherein the authorization table stores a proxy user identifier representing a guest portal and a guest access privilege to the secure resource for all of the users of the guest portal; a policy manager comprising: means for receiving requests for access to the secure resource; wherein if a request for access to the secure resource is received from the owning portal, the request comprising a user identifier representing a user of the owning portal, the policy manager is configured to grant to the user of the owning portal access to the secure resource according to the access privilege stored in the authorization table for the user identifier; and wherein if a request for access to the secure resource is received from the guest portal, the request comprising a user identifier representing a user of the guest portal and a portal identifier representing the guest portal, the policy manager is configured to grant to the user of the guest portal access to the secure resource according to the guest access privilege stored in the authorization table for the proxy user identifier. means for receiving requests for access to the secure resource; wherein if a request for access to the secure resource is received from the owning portal, the request comprising a user identifier representing a user of the owning portal, the policy manager is configured to grant to the user of the owning portal access to the secure resource according to the access privilege stored in the authorization table for the user identifier; and wherein if a request for access to the secure resource is received from the guest portal, the request comprising a user identifier representing a user of the guest portal and a portal identifier representing the guest portal, the policy manager is configured to grant to the user of the guest portal access to the secure resource according to the guest access privilege stored in the authorization table for the proxy user identifier.