Single sign-on for interconnected computer systems

A method comprising:

• authenticating, by a primary computing device, a client computer based on a primary user identification and a primary password;
• receiving, by the primary computing device, a provisioning request for a first application to be provisioned for the client computer;
• when the provisioning request is approved, creating, by the primary computing device, an application group for the first application with the client computer having the primary user identification;
• instructing, by the primary computing device a first associated computer device to create authentication information for the client device, wherein the authentication information comprises the primary user identification;
• in response to the instructing, generating, by the first associated computing device, a secondary password for the client device with the primary user identification, the secondary password being different from the primary password;
• creating, by the first associated computing device, a user profile for the client device with the primary user identification and the secondary password;
• when the client device accesses the first associated computing device for the first application, receiving the primary user identification and the primary password through the primary computing device;
• triggering a service initiation at the first associated computing device for the first application;
• authenticating, by the first associated computing device, the primary user identification with the primary computing device for the first application;
• when the primary user identification is authenticated, extracting, by the first associated computing device, the secondary password and primary user identification from the user profile;
• authenticating, by the first associated computing device, the extracted secondary password with a secondary identity manager;
• and
• when the extracted secondary password is authenticated, issuing, by the first associated computing device, a security token to the client computer for the first application.

One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, memory, and a communication interface, cause the computing platform to:

• authenticate a client computer based on a primary user identification and a primary password;
• receive a provisioning request for an application to be provisioned for the client computer;
• when the provisioning request is approved, create an application group for the application with the client computer having the primary user identification;
• instruct an associated computing device to create authentication information for the client computer, wherein the authentication information comprises the primary user identification;
• in response to the instructing, generate a secondary password for the client computer with the primary user identification, the secondary password being different from the primary password;
• create a user profile for the client computer with the primary user identification and the secondary password;
• when the client computer accesses the associated computing device for the application, receive the primary user identification and the primary password through a primary computing device;
• trigger a service initiation at the associated computing device for the application;
• authenticate, by the associated computing device, the primary user identification with the primary computing device for the application;
• when the primary user identification is authenticated, extract, by the associated computing device, the secondary password and primary user identification from the user profile;
• authenticate, by the associated computing device, the extracted secondary password with the secondary identity manager;
• and
• when the extracted secondary password is authenticated, issue, by the associated computing device, a security token to the client computer for the application.

An apparatus, comprising:

• at least one processor, the at least one processor comprising a secondary identity manager and a computing node;
• a communication interface communicatively coupled to the at least one processor;
• and
• memory storing computer-readable instructions that, when executed by the at least one processor, cause the apparatus to:
• when the apparatus receives an initiation from a primary computing device to provision a group for an application supported by the apparatus, generate, by the secondary identity manager, a secondary password for a client computer with the primary user identification, the secondary password being different from a primary password;
• create, by the computing node, a user profile for the client computer in the group with the primary user identification and the secondary password;
• trigger a service initiation for the group to provide service for the application;
• authenticate the primary user identification with the primary computing device for the application;
• when the primary user identification is authenticated, extract the secondary password and primary user identification from the user profile;
• authenticate the extracted secondary password with the secondary identity manager;
• and
• when the extracted secondary password is authenticated, issue, by the secondary identity manager, a security token to the client computer for the application through the communication interface.