A system, for an Identity Provider, IDP, the system comprising: a communication interface; and a processor coupled to the communication interface and configured to: receive via the communication interface a request from a user device to authenticate a user to a service; determine a user identity associated with one or both of the user and the request, based on the request and an authenticated user certificate; generate an identity assertion by transforming the user identity according to rules associated with the service to conform to a federated identity message expected by the service, wherein at least one of the rules is based on a user information profile and is applied to map an entry in a field of the authenticated user certificate to an attribute in an attribute statement within the identity assertion; the attribute uniquely identifies the user to the service; the rules include a set of cascading rules such that if a first rule fails then a second rule is applied in which a component of a field of the authenticated user certificate is mapped to the attribute in the attribute statement within the identity assertion; and provide the identity assertion via the communication interface to the user device from the request to authenticate was received. a communication interface; and a processor coupled to the communication interface and configured to: receive via the communication interface a request from a user device to authenticate a user to a service; determine a user identity associated with one or both of the user and the request, based on the request and an authenticated user certificate; generate an identity assertion by transforming the user identity according to rules associated with the service to conform to a federated identity message expected by the service, wherein at least one of the rules is based on a user information profile and is applied to map an entry in a field of the authenticated user certificate to an attribute in an attribute statement within the identity assertion; the attribute uniquely identifies the user to the service; the rules include a set of cascading rules such that if a first rule fails then a second rule is applied in which a component of a field of the authenticated user certificate is mapped to the attribute in the attribute statement within the identity assertion; and provide the identity assertion via the communication interface to the user device from the request to authenticate was received. receive via the communication interface a request from a user device to authenticate a user to a service; determine a user identity associated with one or both of the user and the request, based on the request and an authenticated user certificate; generate an identity assertion by transforming the user identity according to rules associated with the service to conform to a federated identity message expected by the service, wherein at least one of the rules is based on a user information profile and is applied to map an entry in a field of the authenticated user certificate to an attribute in an attribute statement within the identity assertion; the attribute uniquely identifies the user to the service; the rules include a set of cascading rules such that if a first rule fails then a second rule is applied in which a component of a field of the authenticated user certificate is mapped to the attribute in the attribute statement within the identity assertion; and provide the identity assertion via the communication interface to the user device from the request to authenticate was received.