Patent ID: 8418234

Claim:
A method of authentication of a principal in a federation, the method implemented by an identity provider, the identity provider comprising a module of automated computing machinery that includes a computer processor and a computer memory operatively coupled to the computer processor, the method comprising: receiving, at the identity provider, an authentication request specifying a service provider's authentication policy, the authentication request having been generated at the service provider in response to receipt at the service provider of a request of the principal for access to a resource of the service provider and a determination by the service provider that an authentication credential of the request does not satisfy the service provider's authentication policy; authenticating the principal by the identity provider according to the service provider's authentication policy; recording in session data of the identity provider an authentication credential satisfying the service provider's authentication policy; and sending an authentication response from the identity provider to the service provider, the authentication response including the authentication credential satisfying the service provider's authentication policy, the authentication credential adapted to be recordable in session data of the service provider.