AuthN and AuthZ Flow

AuthN and AuthZ Flow#

Authentication & Authorization#

Authentication and Authorization in CORTEX are performed as a coordinated sequence that separates identity verification from access control. A researcher is first authenticated by their home institution using their existing campus credentials.

The proxy then enriches that authenticated identity with Virtual Organization membership and authorization information obtained from registry and LDAP before releasing the appropriate attributes to the protected application. This model enables Single Sign-On (SSO) while ensuring that access decisions are based on collaboration membership, roles, and entitlements rather than campus identity alone.

Login flow#

_images/authn-authz-flow.svg

Guidance

Participating protected applications SHOULD delegate authentication and authorization to the proxy and SHOULD NOT trust campus IdPs directly.

  1. The researcher attempts to access a protected application.

  2. The protected application redirects the authentication request to the proxy.

  3. The proxy sends the user to the discovery service to select their home institution.

  4. The researcher selects their home institution.

  5. The discovery service returns the selected institution to the proxy.

  6. The proxy forwards the authentication request to the selected campus IdP.

  7. The campus IdP authenticates the researcher using their campus credentials.

  8. The campus IdP returns the authenticated campus identity to the proxy.

  9. The proxy queries registry to retrieve the researcher’s virtual organisation membership.

  10. The proxy queries the LDAP attribute authority to retrieve the researcher’s collaboration identity, group memberships, roles, and entitlements.

  11. The registry returns the researcher’s collaboration membership information.

  12. The LDAP Attribute Authority returns the researcher’s Virtual Organization identity and authorization attributes.

  13. The proxy combines the campus identity with the Virtual Organization membership and authorization attributes.

  14. The proxy releases the appropriate attributes to the protected application according to its attribute release policy.

  15. Researcher is granted access to protected application based on the received attributes and authorization data.