An identity federation and security token translation module and method for operable engagement with a web application or an internet information service (IIS). A first server includes computer-executable instructions defining the identity federation and security token translation module for managing and facilitating a creation of a custom security principal object for a user requesting access to the web application. A data cache stores the custom security principal object in a non-transitory computer readable media. The identity federation and security token translation module may be changed without making changes to the web application or the IIS.