Techniques for accessing desktop applications using federated identity

1. A system, comprising:

circuitry for receiving a user credential;

circuitry for generating a web-service access token based on the received user credential, the web-service access token including information identifying a user, the web-service access token containing information used to authenticate the user to access one or more web applications or web services;

circuitry for generating a system access token for a remote desktop session from information stored in the web-service access token, the system access token containing information used to authenticate threads of processes to access system resources of a computer system in the remote desktop session;

circuitry for validating an access request by the user to effectuate the remote desktop session comprising threads of processes accessing system resources of the computer system using the system access token; and

circuitry for effectuating the remote desktop session comprising threads of processes accessing system resources of the computer system that is associated with the system access token.

2. The system of claim 1 , further comprising:

circuitry for storing a user identifier in the system access token, the user identifier created by hashing a username obtained from the web-service access token.

3. The system of claim 1 , further comprising

circuitry for generating the web-service access token from a second web-service access token, wherein the second web-service access token was issued by an authentication service for a second security realm that maintains a user account for the user.

4. The computer system of claim 1 , wherein the circuitry for generating the system access token for a remote desktop session further comprises:

circuitry for creating a user identifier from invariant information stored in the web-service access token.

5. The computer system of claim 1 , wherein a user account for the user is not maintained by a computer system in a first security realm that generated the system access token.

6. The computer system of claim 1 , further comprising:

circuitry for storing user privilege information and user group information in the system access token, the user privilege information and user group information generated from claims stored in the web-service access token.

7. The computer system of claim 1 , further comprising:

circuitry for storing user information for the remote desktop session in a user profile associated with a user identifier created from invariant information stored in the web-service access token.

8. A computer readable storage device including executable instructions that, when executed on a computer, cause the computer to perform operations comprising:

receiving a user credential;

generating a web-service access token based on the received user credential, the web-service access token being issued by an authentication service in a first security realm;

creating a user identifier from information in the web-service access token, the user identifier containing information used to authenticate a thread of a process to access a system resource in a remote desktop session of a computer system;

validating an access request by the user to effectuate the remote desktop session comprising threads of processes accessing system resources of the computer system using the user identifier; and

effectuating the remote desktop session comprising threads of processes accessing system resources of the computer system, the remote desktop session including profile settings associated with the created user identifier.

9. The computer readable storage device of claim 8 , further including executable instructions that, when executed on the computer, cause the computer to perform operations comprising:

obtaining a set of one or more claims from the web-service access token.

10. The computer readable storage device of claim 8 , further including executable instructions that, when executed on the computer, cause the computer to perform operations comprising:

storing a set of one or more privileges generated from claims stored in the web-service access token.

11. The computer readable storage device of claim 8 , further including executable instructions that, when executed on the computer, cause the computer to perform operations comprising:

generating the web-service access token in response to receiving the web-service access token issued by an authentication service in a second security realm.

12. The computer readable storage device of claim 8 , wherein receiving the web-service access token further comprises:

receiving the web-service access token conforming to the security assertion markup language standard issued by an authentication service in a first security realm.

13. The computer readable storage device of claim 8 , wherein creating the user identifier further comprises:

creating the user identifier from information that identifies an organization.

14. The computer readable storage device of claim 8 , further including executable instructions that, when executed on the computer, cause the computer to perform operations comprising:

sending the web-service access token to a computer system configured to effectuate a service, wherein the computer system being in the first security realm.

15. The computer readable storage device of claim 8 , wherein creating the user identifier further comprises:

generating the user identifier from a hash of a username.

16. The computer readable storage device of claim 8 , wherein receiving the web-service access token further comprises:

receiving the web-service access token that was digitally signed by an authentication service in a second security realm.

17. A method, comprising:

obtaining, by one or more computers, a set of claims from a web-service access token issued by an authentication service in a first security realm, the web-service access token including information that identifies a user having an account in a second security realm, the web-service access token being based on a received user credential;

storing, by the one or more computers, a set of privileges generated from the claims in a system access token, the set of privileges controlling access to a thread of a process to access a system resource in a remote desktop session of a computer system;

validating, by the one or more computers, an access request by a user associated with the web-service access token to effectuate a remote desktop session comprising threads of processes accessing system resources of the computer system using the system access token; and

effectuating, by the one or more computers, the remote desktop session comprising threads of processes accessing system resources of the computer system associated with the system access token.

18. The method of claim 17 , further comprising:

sending the web-service access token to a computer system configured to effectuate a service, the computer system being in the first security realm.

19. The method of claim 17 , wherein the web-service access token issued by an authentication service was generated in response to receiving the web-service access token issued by a second authentication service in the second security realm.

20. The method of claim 17 , further comprising:

generating a user identifier from a hash of invariant information stored in the web-service access token.