Distributed network identity

A method for providing user authentication to a service provider, the method comprising:

• receiving, at an identity provider, an identifier that indicates the service provider, wherein the identifier includes an assertion of an identity of a user;
• requesting an identity credential from the user;
• authenticating the identity credential to produce an authenticated credential;
• and
• passing the authenticated credential to the service provider.

A method for linking user accounts, the method comprising:

• authenticating a user with an identity provider;
• receiving, at a service provider, a first handle corresponding to the user;
• updating a user directory entry associated with the user to include the first handle;
• generating a second handle for the user;
• and
• passing the second handle to the identity provider, wherein the first handle and the second handle are combinable to identify an account of the user.

A method for linking user accounts, the method comprising:

• generating, at an identity provider, a first handle for a user;
• sending the first handle to a service provider;
• receiving a second handle for the user from the service provider;
• and
• updating a user directory entry associated with the user to include the second handle, wherein the first handle and the second handle are combinable to identify an account of the user.

A method for delegating a service, the method comprising:

• authenticating a user with an identity provider;
• requesting, by a first service provider a ticket from the identity provider for the delegated service, wherein the delegated service is performed by a second service provider;
• receiving the ticket at the first service provider, the ticket for authorizing the second service provider to perform the delegated service on behalf of the user;
• and
• presenting the ticket at the second service provider to use the delegated service.