Method and system for user-determined authentication in a federated environment

A method for authenticating a user within a data processing system, the method comprising:

• receiving at a first server a request from a client for access to a controlled resource;
• in response to a determination that the first server has an identity of a second server that supports an authentication service that was previously associated with the client, sending an authentication request to the second server from the first server;
• in response to a determination that the first server does not have an identity of a second server that supports an authentication service that was previously associated with the client:
• allowing a user to choose an identity for the second server;
• and
• sending an authentication request to the second server from the first server.

An apparatus for authenticating a user within a data processing system, the apparatus comprising:

• means for receiving at a first server a request from a client for access to a controlled resource;
• means for sending an authentication request to the second server from the first server in response to a determination that the first server has an identity of a second server that supports an authentication service that was previously associated with the client;
• means for allowing a user to choose an identity for the second server in response to a determination that the first server does not have an identity of a second server that supports an authentication service that was previously associated with the client;
• and
• means for sending an authentication request to the second server from the first server in response to a determination that the first server does not have an identity of a second server that supports an authentication service that was previously associated with the client.

A computer program product in a computer readable medium for use in authenticating a user within a data processing system, the computer program product comprising:

• means for receiving at a first server a request from a client for access to a controlled resource;
• means for sending an authentication request to the second server from the first server in response to a determination that the first server has an identity of a second server that supports an authentication service that was previously associated with the client;
• means for allowing a user to choose an identity for the second server in response to a determination that the first server does not have an identity of a second server that supports an authentication service that was previously associated with the client;
• and
• means for sending an authentication request to the second server from the first server in response to a determination that the first server does not have an identity of a second server that supports an authentication service that was previously associated with the client.

A network data message comprising:

• a transport protocol header;
• a Uniform Resource Identifier (URI) associated with a controlled resource;
• and
• an authentication service provider token that indicates a domain identity of an authentication service provider, wherein the authentication service provider is one of a plurality of authentication service providers in a federated environment that may be used in responding to a request to access the controlled resource.