1. A method of permitting a first domain to access a second domain comprising: receiving, at the second domain, a request from the first domain, the request indicating an action to be performed in the second domain and further indicating a first user in the first domain on whose behalf the action is to be performed; looking up a second user in the second domain who corresponds to the first user; issuing an access token for the second user; and using the access token to perform the action under a persona of the second user.