Patent ID: 7552468

Claim:
A method for authenticating a principal implemented in a computer-readable medium and to process on a device for performing the method, comprising: receiving an access request from a first principal for access to a second principal, wherein the first principal makes the access request via a client device over a network, and wherein the first principal is a user and the second principal is an application that processes on another device of the network; evaluating a contract to acquire a credential for the first principal; and transmitting the credential to the first principal for use in interacting with the second principal over the network, wherein the credential includes authentication information, aggregated attributes and aggregated policies for use by the first principal in interacting with the second principal, and wherein the contract identifies identifier information for the first principal and an authentication technique for the first principal to authenticate to the second principal, and wherein the contract includes directives that permit attribute information and policies of the first principal to be assembled from a variety of data stores, and wherein the contract is a specification that indicates how, via the authentication technique, the first principal is to be authenticated to the second principal for a given situation and the contract provides a mechanism, via the directives, for assembling the attribute information and the policies needed for interactions between the first principal and second principal in the given situation, and the contact includes a global policy statement that restricts how the contract is used by the first principal when accessing other principals from predefined locations.