Patent ID: 8006289

Claim:
A computer-implemented method for managing authentication credentials for a user within a data processing system, the method comprising: receiving at a session management server from a client a request to access a protected resource on behalf of a user, wherein the session management server performs session management with respect to the user for a domain that includes the protected resource, and wherein access to the protected resource requires authentication credentials that have been generated for a first type of authentication context; in response to determining by the session management server that authentication credentials for the user indicate that the authentication credentials have been generated for a second type of authentication context, sending a first message from the session management server to an authentication proxy server, wherein the first message contains the authentication credentials for the user and an indicator for the first type of authentication context; and receiving a second message at the session management server from the authentication proxy server, wherein the second message contains updated authentication credentials for the user, and wherein the updated authentication credentials indicate that the updated authentication credentials have been generated for the first type of authentication context.