Authentication system for networked computer applications

A method of authenticating a user by an authentication server in a networked computer system, the method comprising:

• presenting user credentials by a user to a gatekeeper server;
• providing presented user credentials by the gatekeeper server to an authentication server;
• authenticating the user by the authentication server;
• creating an authentication token by the authentication server upon authentication of the user to uniquely identify the user, the authentication token being independent of the user credentials presented by the user and verifiable without a need for the user to re-present the user credentials;
• encrypting the authentication token by the authentication server using a key not shared with the gatekeeper server;
• transmitting the authentication token by the authentication server to an application server, wherein transmitting the authentication token to the application server comprises transmitting the authentication token by the authentication server to the gatekeeper server and then transmitting the authentication token by the gatekeeper server to the application server;
• creating an outer token by the gatekeeper server;
• wrapping the outer token around the authentication token to form a combined token;
• encrypting the combined token by the gatekeeper server using a key not shared with the authentication server;
• and
• sending the encrypted combined token to the authenticated user;
• wherein the authenticated user is allowed to present the combined token to the gatekeeper server without having to be re-authenticated.