Authentication broker service

A computer system for authenticating an identity of a user seeking access to a relying computing entity, wherein the identity of the user is issued by an authentication service, the computing system comprising:

• an authentication broker service having a first trust relationship with the relying computing entity and a second trust relationship with an appropriate authentication service identified by the authentication broker service from among a plurality of authentication services, wherein the identifying of the appropriate authentication service is based at least in part on determining that the second trust relationship exists, the authentication broker service receiving an authentication request from the relying computing entity to authenticate the identity of the user, wherein the authentication request does not include an identification of an authentication service, and receiving an authentication response from the appropriate authentication service, the authentication broker service further sending an authentication response to the relying computing entity representing a trusted authentication of the identity of the user to the relying computing entity based on the first trust relationship and the second trust relationship.

A method of establishing a brokerable trust relationship between an authentication broker service and each of a plurality of computing entities, the method comprising:

• establishing one or more brokered authentication rules governing brokered authentication through the authentication broker service;
• obtaining an agreement from each computing entity to comply with the one or more brokered authentication rules;
• and configuring the authentication broker service to authenticate identities of one or more users for each computing entity in accordance with the one or more brokered authentication rules, wherein the one or more users have identities issued by one or more appropriate authentication services identified by the authentication broker service from a plurality of authentication services, the one or more appropriate authentication services having trust relationships with the authentication broker service, wherein identifying of the appropriate authentication service is based at least in part on determining that the trust relationship exists.

A computer-readable medium encoding computer executable instructions encoding a method for establishing a brokerable trust relationship between an authentication broker service and each of a plurality of computing entities, the computer process comprising:

• establishing one or more brokered authentication rules governing brokered authentication through the authentication broker service;
• obtaining an agreement from each computing entity to comply with the one or more brokered authentication rules;
• and configuring the authentication broker service to authenticate identities of one or more users for each computing entity in accordance with the one or more brokered authentication rules, wherein the one or more users have identities issued by one or more appropriate authentication services identified by the authentication broker service from a plurality of authentication services, the one or more appropriate authentication services having trust relationships with the authentication broker service, wherein identifying of the appropriate authentication service is based at least in part on determining that the trust relationship exists.