Patent ID: 7603555

Claim:
A system for authenticating computer users comprising: a first login server disposed in an intranet and adapted to: receive and validate a first user's credentials; collect at least a first security identifier (“SID”) associated with the first user; and create a first Security Association Markup Language (“SAML”) token, wherein the first SAML token includes the first SID; a second login server, disposed in a demilitarized zone (“DMZ”) associated with the intranet and adapted to: receive the first SAML token; validate the first SAML token; and transform the first SAML token into a second SAML token, wherein the second SAML token includes the first SID and wherein there exists a trust relationship between the first login server and the second login server; and a web server disposed in the DMZ and adapted to: receive a request from a web client for access to an application hosted by the web server, wherein the application authenticates users by comparing SIDs to an access control list; receive the second SAML token from the second login server; construct a third token at least in part from the first SID; and provide the third token to the application for authentication of the first user.