# AuthN and AuthZ Flow

## Authentication & Authorization
[Authentication](wiki:Authentication)
and [Authorization](wiki:Authorization) in CORTEX are performed as a coordinated sequence that separates identity verification from access control. A researcher is first authenticated by their home institution using their existing campus credentials.

The proxy then enriches that authenticated identity with Virtual Organization membership and authorization information obtained from registry and LDAP before releasing the appropriate attributes to the protected application.  This model enables [Single Sign-On (SSO)](wiki:Single_sign-on) while ensuring that access decisions are based on collaboration membership, roles, and entitlements rather than campus identity alone.

## Login flow

```{image} _static/authn-authz-flow.svg
:width: 100%
:class: sd-m-auto
:name: cortex-architecture
```

:::{admonition} Guidance

Participating protected applications **SHOULD** delegate authentication and
authorization to the proxy and **SHOULD NOT** trust campus
IdPs directly.

:::

1. The researcher attempts to access a **protected application**.

2. The **protected application** redirects the authentication request to the **proxy**.

3. The **proxy** sends the user to the **discovery service** to select their home institution.

4. The **researcher** selects their home institution.

5. The **discovery service** returns the selected institution to the proxy.

6. The **proxy** forwards the authentication request to the selected **campus IdP**.

7. The **campus IdP** authenticates the **researcher** using their campus credentials.

8. The **campus IdP** returns the authenticated campus identity to the **proxy**.

9. The **proxy** queries **registry** to retrieve the researcher's virtual organisation membership.

10. The **proxy** queries the **LDAP** attribute authority to retrieve the researcher's collaboration identity, group memberships, roles, and entitlements.

11. The **registry** returns the researcher's collaboration membership information.

12. The **LDAP** Attribute Authority returns the researcher's Virtual Organization identity and authorization attributes.

13. The **proxy** combines the campus identity with the Virtual Organization membership and authorization attributes.

14. The **proxy** releases the appropriate attributes to the protected application according to its attribute release policy.

15. **Researcher** is granted access to  **protected application** based on the received attributes and authorization data.