Patent ID: 7739744

Claim:
A computer-implemented method processed by a reverse proxy, the method comprising: intercepting, by the reverse proxy, an attempt by a first principal to access a second principal; determining, by the reverse proxy, whether authentication credentials are available for authenticating the first principal, where the authentication credentials are defined by a policy and the policy identifies an identity service that is to authenticate the first principal and the policy also identifies the authentication mechanism to be used by that identity service, the authentication credentials are used for multifactor authentication by authenticating the first principal with some of the authentication credentials by using the authentication mechanism and the identity service defined in the policy and by authenticating the first principal to the second principal via a different authentication mechanism expected by the second principal and by using select ones of the authentication credentials, where the second principal is a legacy service that does not support multifactor authentication; passing, by the reverse proxy, the select ones of the authentication credentials to the second principal giving access to the first principal if the authentication credentials are available, and wherein the second principal expects the select ones of the authentication credentials for access by using the different authentication mechanism of the second principal; and redirecting, by the reverse proxy, the first principal to an identity service if the authentication credentials are unavailable for the first principal to authenticate with the identity service using the authentication mechanism defined in the policy and on successful authentication the first principal is supplied the authentication credentials.