memory configured to store program logic; and

a processor configured to access the memory and to execute the program logic to perform operations comprising:

receiving a call over a network from an application in response to user interaction with the application via an interface, the application executing on an application service provider device remote to the system and the interface, the call comprising a policy identifier (ID) that corresponds to an identity policy that is one of a plurality of identity policies for dynamic deployment on behalf of the application;

executing a user authentication process that is defined by the identity policy that corresponds to the policy ID;

providing a user interface (UI) to the application over the network subsequent to receiving the call and based on the policy ID of the received call;

receiving a token request and an identity claim over the network from the application responsive to additional user interaction with the UI;

verifying the identity claim; and

providing a token configured to enable a user to access the application over the network to the application for consumption to complete the token request.