Abstract: A method is disclosed for managing network resources in multiple administrative domains. According to the method, a user is authenticated in a first administrative domain. A token is generated for the user that identifies the user as being assigned a role. The token is configured to identify the user by the role to a component of a second administrative domain. When the user requests a resource of the second administrative domain, its component examines the token and the role to determine whether to grant access to the resource. As a result, the second administrative domain may grant the user access to its resources without re-authenticating the user in the second administrative domain.

Abstract: A method is provided to configure access to a plurality of data repositories. The data repositories each provide data objects for applications operated by users. A request is received to access data objects in the plurality of data repositories. The request may specify a parameter. Metadata is retrieved that characterizes a portion of the data objects stored in each data repository. One or more objects are selected from the data repositories using the parameter in the request and the metadata.