Patent ID: 7506162

Claim:
A method, comprising: receiving by a second server at a second site a first request from a first server at a first site to access a resource on the second site, wherein a first user has authenticated with the first site; receiving from the first site a first assertion comprising an identifier indicating the first site as a source of the first assertion, an indication that the first user is authorized to access the resource on the second site and a first set of attributes associated with a first account on the first site; determining, based upon the first assertion and a mapping, a subset of the first set of attributes to be used for mapping accounts on the first site to accounts on the second site, wherein the subset of the first set of attributes does not include an account identifier for the first account on the first site; mapping the first account on the first site to a particular account on the second site based upon the subset of the first set of attributes; receiving at the second site a second request from the first site to access the resource on the second site, wherein a second user has authenticated with the first site, the second user differing from the first user; receiving from the first site a second assertion comprising an identifier indicating the first site as a source of the second assertion, an indication that the second user is authorized to access the resource on the second site, and a second set of attributes associated with a second account on the first site; determining, based upon the second assertion and a mapping, a subset of the second set of attributes to be used for mapping accounts on the first site to accounts on the second site, wherein the subset of the second set of attributes does not include an account identifier for the second account on the first site, and wherein the subset of the second set of attributes includes at least one attribute in common with the subset of the first set of attributes; and mapping the second account on the first site to the same particular account on the second site based upon the subset of the second set of attributes, thereby mapping a plurality of accounts on the first site to the same particular account on the second site.