Patent ID: 8819794

Claim:
A method, comprising: sending, from a processing device, a request from a first application to a second application; receiving, at the processing device, a response to the request, the response comprising a list of authentication issuers trusted by the second application; comparing, with the processing device, the list of authentication issuers trusted by the second application to a list of authentication issuers approved for the first application; and identifying an authentication issuer match between the lists; constructing a token, with the processing device, for an authentication issuer using a tenant identifier from an approved authentication issuer configuration; obtaining authentication credentials from the authentication issuer using the token; and generating, with the processing device, a revised request to the second application using the authentication credentials; in response to determining that there is no match, determining whether a realm value in the response matches a configured authentication issuer; and using the tenant identifier to generate a self-issued token for the authentication issuer, wherein an approved authentication issuer configuration identifies a Globally Unique Identifier (GUID) for an approved authentication issuer and identifies the tenant identifier when an application is configured for an on-premise installation.