7. An apparatus for authenticating a user within a data processing system to enable the user to access a controlled resource, the apparatus comprising: a processor; a computer memory holding computer program instructions which when executed by the processor perform a method comprising: generating an authentication assertion for the user at a first trust proxy within a first domain; at a system in a second domain, receiving a request from a client to access a controlled resource within the second domain; sending the authentication assertion from the first domain to a second trust proxy in the second domain by the second trust proxy pulling the authentication assertion from the first trust proxy after receipt at the system in the second domain of the request for the controlled resource; validating the authentication assertion at the second trust proxy in the second domain; upon validating the authentication assertion, building a session for the user so that the user appears to the system in the second domain as an authenticated user; and providing access to the controlled resource using the session.
10. The apparatus of claim 7 wherein the method further comprises: maintaining an indirect relationship between the first trust proxy and the second trust proxy through a trust broker.