Patent ID: 8020007

Claim:
A method of providing an identity token, the method comprising: receiving at least one document specifying at least one signing key name describing a source of digital signatures that each of a plurality of services can use to verify a user's identity; receiving a first identity token comprising a first set of content that identifies a user, and a digital signature comprising a first signing key name, the first identity token having a first format, and also receiving a request for one of the plurality of services; identifying, responsive to the request and at least one of the at least one document, at least one second signing key name used by one of the plurality of services corresponding to a service requested in the request; identifying, responsive to the at least one second signing key name, at least one of a plurality of security token services that can convert the first identity token into a second identity token having at least one selected from: a second content, different from the first content, that specifies the user; a second format, different from the first format, that the service requested by the request is able to use; and the second signing key name, different from the first signing key name, that the service requested in the request can use to verify the second identity token; providing to the at least one of the plurality of security token services identified, the first identity token and an indicator corresponding to the request or at least part of the request; receiving from the at least one of the plurality of security token services the second identity token; and providing at least part of the request and the second identity token in the second format to service provider corresponding to the request for use in authenticating the user.