Affiliations within single sign-on systems

An apparatus for establishing an affiliation within a single sign-on system, comprising:

• a plurality of principals that can acquire a federated identity and be authenticated and vouched for by an identity provider;
• an identity provider for authenticating and vouching for principals;
• a plurality of service providers that act as a single entity with regard to authentication, federation and authorization to establish a single sign-on system within which such affiliation cooperates;
• and
• at least one service associated with each service provider which comprises a grouping of common functionality comprising at least one method that callers can use to manipulate information managed by said service with regard to a particular principal.

A method for establishing an affiliation within a single sign-on system, comprising the steps of:

• defining a group of service providers that act as a single entity on a network for purposes of any of authentication, federation, and authorization;
• providing a plurality of principals that can acquire a federated identity and be authenticated and vouched for by an identity provider;
• and
• providing an identity provider for authenticating and vouching for principals.