Abstract: Systems and methods authenticate an end user of an enterprise with an external service provider. The enterprise comprises an identity provider and an entitlements data store that communicate via web services calls. The identity provider makes a determination of whether an end user is authorized to access the external service provider based on: (i) authentication of the end user by the identity provider; and (ii) data from the entitlements data store for the end user with respect to the external service provider. Upon a determination by the identity provider that the end user is authorized to access the external service provider, the identity provider send a SAML token to the end user. The SAML token comprises an XML representation of entitlement information for the end user for the external service provider.