Patent ID: 7496954

Claim:
A system for single sign-on for enterprise applications, comprising: a plurality of enterprise applications; a policy server that receives a user's single sign-on information regarding access to a first enterprise application and promotes communication of authentication and authorization information for the first enterprise application to determine the user's access to the first enterprise application, the policy server, regarding the user accessing a second enterprise application, authenticates the user based on the user's single sign-on information and uses the single sign-on information to obtain authorization information for the second enterprise application to determine the user's access to the second enterprise application; an authentication data store maintaining the authentication information used by the policy server related to user authentication for at least some of the plurality of enterprise applications; a first internal authorization data store maintaining internal authorization information related to internal user; a second external authorization data store maintaining external authorization information related to external user; a consolidated data store maintaining consolidated authorization information including both the internal and external user authorization information used by the policy server related to user authorization for at least some of the plurality of enterprise applications; and a synchronization component that synchronizes the internal and external authorization information from the first internal and second external authorization data stores, respectively, to the consolidated data store.