A Service-Oriented Architecture For Authentication And Authorization