System and method of locating identity providers in a data network

An identity provider locator server comprising:

• an interface to a data network to communicate with a plurality of identity provider servers and a plurality of service provider servers;
• a processor including logic to respond to a request from one of the plurality of service provider server systems to identify one or more of the plurality of identity provider servers;
• and
• a memory accessible to the processor.

A static data structure stored within a memory of an identity provider location server, the static data structure comprising:

• a list of valid identity provider servers that may be located;
• a list of valid service provider servers;
• and
• a list of valid identity provider to service provider mappings.

A dynamic data structure stored within a memory of an identity provider location server, the dynamic data structure comprising:

• a list of active sessions;
• a list of identity provider servers;
• and
• a list of active session to identity provider mappings.

A method of interacting with an identity provider locator server, the method comprising:

• receiving an end-user connection request at a service provider server;
• sending a redirect message including a uniform resource locator to the end-user, the uniform resource locator identifies a type of request and identifies the service provider server wherein, the redirect message is sent to initiate a request to the identity provider locator server to provide a list of valid identity provider servers for use by the service provider to determine which of many identity provider servers to use to authenticate the end-user;
• receiving a locate response message sent via a second redirect message the locate response message including an encrypted payload containing the list of active identity provider servers;
• and
• authenticating the end-user using a first identity provider server in the list of active identity provider servers.