System and method for single sign-on to resources across a network

1. A method for providing single sign-on across a plurality of resources, comprising:

receiving a request from a user to access a particular resource of the plurality of resources;

establishing a single sign-on (SSO) session for the user if an SSO session has not been established;

determining if the user has been authenticated to the particular resource, and if not, retrieving credentials for the user that are specific to the particular resource from a credential store, the credential store including a plurality of different credential sets for the user corresponding to different ones of the plurality of resources;

providing a token to a software client of the user;

operatively presenting the credentials retrieved from the credential store to the particular resource so as to create a session with the particular resource;

presenting a first user interface for a customer to configure access policies that define which of the plurality of resources can be accessed by the user;

discovering an authentication subsystem of the particular resource by simulating

a) an end user using a browser, and

b) the browser interacting with the particular resource;

communicating with the authentication subsystem to authenticate the user;

connecting to one or more user stores to retrieve attributes relating to the user;

utilizing the attributes to evaluate the access policies to determine whether or not the user should be granted access to the particular resource;

receiving the request from the user as a proxy address that differs from the actual address of the particular resource;

presenting a second user interface to allow the user to set credentials in the credential store relative to the particular resource;

using characteristics of the request to determine which of a plurality of authentication subsystems to use; and

wherein at least a portion of the characteristics of the request comprises one or more results of a previous authentication attempt for the same request with another one of the plurality of authentication subsystems.

2. The method of claim 1 , wherein the second user interface allows the user to set credentials in the credential store relative to the plurality of resources, and wherein the second user interface is different from the first user interface.

3. The method of claim 1 , including programmatically setting credentials relative to at least one of the plurality of resources.

4. The method of claim 1 , wherein the step of receiving the request from the user as a proxy address that differs from the actual address of the particular resource is performed by a Hypertext Transfer Protocol (HTTP) proxy.

5. The method of claim 4 , including creating the session with the particular resource utilizing the security assertion mark-up language (SAML) protocol.

6. The method of claim 1 , wherein the simulating of

the browser interacting with the particular resource includes simulating the browser interacting with a website.

7. The method of claim 1 , including:

receiving, from a remote resource location, the access policies; and

using the access policies in connecting to the one or more user stores to retrieve the attributes relating to the user.

8. The method of claim 7 , further comprising:

interacting with authentication handlers; and

dropping cookies for multiple domains so that subsequent requests from the user are recognized as coming from the user, even if the user requests resources from different domains, so as to allow the session to span multiple domains.

9. The method of claim 1 , including name-space-mapping to map the user's identity across user stores by:

providing a third-party user store user interface; and

automatically transforming data stored in the third-party user store for use in another resource.