Patent ID: 7636941

Claim:
A method for providing a first service and a second service to a user via a client being coupled to a data communication network, said first service being provided by a first network server also being coupled to the data communication network, said second service being provided by a second network server also being coupled to the data communication network, said method comprising: receiving a first request from the first network server to provide the first service to the user wherein the first service requires authentication of the user; authenticating the user for the first service in response to the received first request; allowing the user access to the first service in response to the received first request wherein an authentication ticket and profile information associated with the user is communicated to the first service; storing first data on the client in response to allowing the user access to the first service, said first data identifying a first policy group associated with the first service, said first policy group having a shared set of business rules to restrict authentication of a user across different domains; receiving a second request from the second network server to provide the second service to the user wherein authentication of the user by the second service is optional and wherein the user is not authenticated for the second service; if the second service is associated with the first policy group identified by the stored first data, allowing the user access to the second service in response to the received second request wherein the user is authenticated for the second service in response to the received second request and wherein the authentication ticket and profile information associated with the user is communicated to the second service; if the second service is not associated with the first policy group identified by the stored first data: updating the stored first data to identify the second service, said updating further comprising identifying a second policy group associated with the second service; and allowing the unauthenticated user to access the second service during which the user continues to be unauthenticated for the second service wherein authentication ticket and profile information associated with the user is not communicated to the second service; receiving a third request from a third network server to provide a third service to the user, said third network server also being coupled to the data communication network; authenticating the user for access to the third service in response to the received third request; and allowing the user access to the third service if the user has been authenticated, wherein, in response to allowing the user access to the third service, the user is allowed access to the second service on a subsequent visit to the second network server if the third service is associated with the second policy group identified by the undated first data.