1. A computer-performed method for controlling access to a resource in a computer system, the method comprising: receiving a request to access a resource including a first identifier associated with an entity; determining whether or not the first identifier is a member of a canonical namespace containing identifiers used to access resources in the computer system; responsive to determining that the first identifier is a member of the canonical namespace, accessing the resource using the first identifier; determining whether the first identifier has a mapping to the canonical namespace stored in an internal database; prior to determining whether the first identifier has a mapping to the canonical namespace stored in an internal database, determining whether or not the first identifier is present in an external mapping database that maps members of other namespaces to the canonical namespace; responsive to determining that the first identifier is present in the external mapping database, retrieving a second identifier for the entity within the canonical namespace from the external mapping database; responsive to determining that the first identifier is not a member of the canonical namespace and does not have a mapping to the canonical namespace stored in the internal database, and only if the second identifier is not retrieved from the external mapping database, automatically generating the second identifier and storing the second identifier in the internal database for further identification of the entity; and accessing the resource using the second identifier.