1. A method for authenticating a user within a data processing system, the method comprising: generating an authentication assertion for the user at a first trust proxy within a first domain; receiving at a system in a second domain a request from a client operated by the user to access a controlled resource within the second domain; sending the authentication assertion from the first domain to a second trust proxy in the second domain; and validating the authentication assertion at the second trust proxy in the second domain.