16. The method of claim 10 wherein the instructions further cause the system to receive identity information for a second user from the at least one first user, and generate a first resource token for the second user.
10. A method, comprising: providing at least one processor and computer software, written on non-transitory computer readable media and containing instructions stored in a memory and executable by the at least one processor to: receive, by a credentialing and access control system, identity and authentication information associated with at least one internal identity from at least one electronic identity provider that is external to the credentialing and access control system, based on permission granted by at least one user; generate at least a first physical resource token for permitting physical access to a first physical resource; associate the first physical resource token with the at least one internal identity; receive, by the credentialing and access control system and from the at least one user, identity and authentication information derived from the external identity provider that is associated with the at least one internal identity; receive, by the credentialing and access control system, an indication of interaction of the first physical resource token with the first physical resource; and grant access to the first physical resource.