Method and apparatus to authenticate and authorize user access to a system

A system comprising:

• a security configuration module including one or more processors
• to receive, via a secondary site, a request for authentication of a user using the secondary site to access a primary site, the request for authentication of the user including user information corresponding to the user, and
• to verify, the user information and generate at the primary site a token associated with the user;
• and
• a credential authority including one or more processors
• to generate, based on the verifying, a first partial token comprising a first segment or portion of the token associated with the user, the first partial token to be transmitted to and stored at the secondary site,
• wherein the credential authority is further to generate a second partial token comprising a second segment or portion of the token to be stored at the primary site without transmission of the second partial token to the secondary site, the second partial token to be stored at the primary site matching the first partial token to be stored at the secondary site to form the token,
• wherein the first partial token is to be stored at the secondary site without the second partial token, the first partial token to be used to enable the secondary site to perform a task on the primary site on behalf of the user.

A non-transitory machine-readable medium having stored thereon instructions which, when executed by a machine, cause the machine to perform operations comprising:

• receiving, via a secondary site, a request for authentication of a user using the secondary site to access a primary site, the request for authentication of the user including user information corresponding to the user;
• verifying the user information and generating at the primary site a token associated with the user;
• based on the verifying, generating, using a processor, a first partial token comprising a first segment or portion of the token associated with the user, the first partial token to be transmitted to and stored at the secondary site;
• and
• generating a second partial token comprising a second segment or portion of the token to be stored at the primary site without transmission of the second partial token to the secondary site, the second partial token to be stored at the primary site matching the first partial token to be stored at the secondary site to form the token, wherein the first partial token is to be stored at the secondary site without the second partial token, the first partial token to be used to enable the secondary site to perform a task on the primary site on behalf of the user.