A method comprising: identifying, by an identity service broker implemented by a processor, a first authentication of a user associated with a first identity service; generating, by the identity service broker, a virtual identity of the user comprising a plurality of virtual attribute fields; populating, by the identity service broker, a first virtual attribute field of the plurality of virtual attribute fields based on a first attribute associated with the user and recorded by the first identity service; determining, by the identity service broker after the populating of the first virtual attribute field, that a second virtual attribute field of the plurality of virtual attribute fields is not assigned a value; identifying, by the identity service broker, a second identity service associated with the user when it is determined that the second virtual attribute field is not assigned a value, wherein the second identity service is identified based on a link between an attribute of the second identity service and the first attribute of the first identity service; populating, by the identity service broker, the second virtual attribute field of the plurality of the virtual attribute fields with a value of a second attribute recorded by the second identity service, wherein the second attribute is not the linked attribute of the second identity service and is not recorded by the first identity service; and allowing, by the identity service broker, access for the user to an application based on at least one of the populated first or second virtual attributes of the virtual identity of the user. identifying, by an identity service broker implemented by a processor, a first authentication of a user associated with a first identity service; generating, by the identity service broker, a virtual identity of the user comprising a plurality of virtual attribute fields; populating, by the identity service broker, a first virtual attribute field of the plurality of virtual attribute fields based on a first attribute associated with the user and recorded by the first identity service; determining, by the identity service broker after the populating of the first virtual attribute field, that a second virtual attribute field of the plurality of virtual attribute fields is not assigned a value; identifying, by the identity service broker, a second identity service associated with the user when it is determined that the second virtual attribute field is not assigned a value, wherein the second identity service is identified based on a link between an attribute of the second identity service and the first attribute of the first identity service; populating, by the identity service broker, the second virtual attribute field of the plurality of the virtual attribute fields with a value of a second attribute recorded by the second identity service, wherein the second attribute is not the linked attribute of the second identity service and is not recorded by the first identity service; and allowing, by the identity service broker, access for the user to an application based on at least one of the populated first or second virtual attributes of the virtual identity of the user. <EOS>