Patent ID: 7657639

Claim:
A method for operating a federated computational environment, wherein a first user account for a user is managed at a first identity provider, wherein a second user account for the user is managed at a second identity provider, wherein a third user account for the user is managed at a service provider, wherein the first identity provider, the second identity provider, and the service provider operate within the federated computational environment, the computer-implemented method comprising: receiving at the service provider a request to access by the user a protected resource that is managed by the service provider; performing, after receiving the request to access the protected resource, a federated single-sign-on operation for the user between the service provider and the first identity provider; modifying, prior to sending a response to the request to access the protected resource, information in the third user account to indicate that the service provider relies upon the second identity provider to authenticate the user on behalf of the service provider rather than the first identity provider; and sending a response for the request to access the protected resource.