Patent ID: 8510818

Claim:
A method comprising: receiving at a resource within a first realm, a request from an entity authenticated by a domain controller in a second realm, the request requesting access to the resource within the first realm, wherein the request includes a service ticket and a privilege access certificate (“PAC”); based upon the service ticket and the PAC, generating by the resource within the first realm a user token, wherein the user token includes an Other Org security identifier associated with the entity, wherein the Other Org security identifier indicates that the entity was authenticated by the domain controller in the second realm; based upon whether the user token includes the Other Org security identifier, determining whether entities authenticated by other than the first realm are allowed access to the resource according to a selective trust relationship between the first realm and other realms that include the second realm; in an event that entities authenticated by other than the first realm are allowed access to the resource: determining, by a processor, other realm access permissions to be assigned to entities authenticated by other than the first realm, based on the selective trust relationship, wherein the other realm access permissions are different from first realm access permissions that are to be assigned to entities authenticated by the first realm; and granting the entity access to the resource according to the other realm access permissions; and in an event that entities authenticated by other than the first realm are not allowed to access the resource, refusing to grant the entity access to the resource.