Universal group support for authentication systems

A method for operating a central authentication device for authentication of users operating a respective computing devices requesting access to a service provider, the method comprising:

• storing at least one universal group that includes a plurality of principals from different types of identity providers, with the users operating the respective computing devices included as principals in the universal group and having the same access rights;
• receiving access tokens generated by the different types of identity providers associated with the respective computing devices, with the identity providers being separate from the respective computing devices;
• generating a respective universal token that is to be shared by the principals within the at least one universal group, with each respective universal token including group membership information for the at least one universal group;
• exchanging the access tokens with the respective universal tokens;
• providing a respective authentication code to the respective computing devices after the exchange, with the respective computing devices then providing the respective authentication codes to the service provider, and
• providing the respective universal tokens to the service provider upon receipt of the respective authentication codes from the service provider, with the group membership information on the universal token to allow the service provider to determine if the users of the respective computing devices have permission to access desired services.

A non-transitory computer readable medium for a central authentication device for authentication of a user operating a computing device requesting access to a service provider, with the non-transitory computer readable medium having a plurality of computer executable instructions for causing the central authentication device to perform steps comprising:

• storing at least one universal group that includes a plurality of principals from different types of identity providers, with the user of the computing device included as one of the principals;
• receiving an access token generated by an identity provider associated with the computing device, with the identity providers being separate from the respective computing devices;
• generating a universal token that includes group membership information for the at least one universal group;
• exchanging the access token with the universal token;
• providing a respective authentication code to the respective computing devices after the exchange, with the respective computing devices then providing the respective authentication codes to the service provider, and
• providing the universal token to the service provider upon receipt of the authentication code from the service provider, with the group membership information on the universal token to allow the service provider to determine if the user of the computing device has permission to access desired services.