11. A computer program product in a non-transitory computer storage medium for use in a data processing system for authenticating a user to enable the user to access a controlled resource, the computer program product holding computer program instructions which when executed by the data processing system perform a method comprising: generating an authentication assertion for the user at a first trust proxy within a first domain; at a system in a second domain, receiving a request from a client to access a controlled resource within the second domain; sending the authentication assertion from the first domain to a second trust proxy in the second domain by the second trust proxy pulling the authentication assertion from the first trust proxy after receipt at the system in the second domain of the request for the controlled resource; validating the authentication assertion at the second trust proxy in the second domain; upon validating the authentication assertion, building a session for the user so that the user appears to the system in the second domain as an authenticated user; and providing access to the controlled resource using the session.
11. A computer program product in a non-transitory computer storage medium for use in a data processing system for authenticating a user to enable the user to access a controlled resource, the computer program product holding computer program instructions which when executed by the data processing system perform a method comprising: generating an authentication assertion for the user at a first trust proxy within a first domain; at a system in a second domain, receiving a request from a client to access a controlled resource within the second domain; sending the authentication assertion from the first domain to a second trust proxy in the second domain by the second trust proxy pulling the authentication assertion from the first trust proxy after receipt at the system in the second domain of the request for the controlled resource; validating the authentication assertion at the second trust proxy in the second domain; upon validating the authentication assertion, building a session for the user so that the user appears to the system in the second domain as an authenticated user; and providing access to the controlled resource using the session. 12. The computer program product of claim 11 wherein the method further comprises: determining within the first domain to generate the authentication assertion for the user at the first trust proxy prior to receipt of the request for the controlled resource at the system in the second domain.