Patent ID: 7568218

Claim:
A computer-implemented method comprising: receiving, from a user authenticated in a first realm, a request to access a resource associated with a second realm; and associating the user with a security identifier included in a token, the security identifier indicates that the user was authenticated in a realm other than the second realm, such that resources within the second realm can make authentication and access control decisions based on the security identifier; wherein: resources within the first realm have a mutual trust relationship with other resources within the first realm, such that if a first realm user has permission to access a particular resource within the first realm, the first realm user is granted access to the resource within the first realm when the first realm user is authenticated by any entity within the first realm; resources within the second realm have a mutual trust relationship with other resources within the second realm, such that if a second realm user has permission to access a particular resource within the second realm, the second realm user is granted access to the resource within the second realm when the second realm user is authenticated by any entity within the second realm; and the first and second realms have a selective trust relationship such that: the second realm user authenticated within the second realm is granted access to a resource in the second realm with a set of permissions for users authenticated within the second realm; and a first realm user authenticated within the first realm is granted access to the resource in the second realm with a set of permissions for users authenticated outside of the second realm, wherein the set of permissions for users authenticated outside of the second realm is more restrictive than the set of permissions for users authenticated within the second realm.