IVOA Recommendation: IVOA Single-Sign-On Profile: Authentication Mechanisms Version 1.01

TL;DR

This paper details the approved client-server authentication mechanisms for the IVOA single-sign-on profile, including digital signatures, TLS with passwords, and TLS with client certificates, with normative implementation rules based on existing standards.

Contribution

It standardizes and specifies the authentication mechanisms for IVOA's single-sign-on profile, providing normative rules referencing established standards.

Findings

Defines digital signatures for SOAP services

Specifies TLS with passwords for user sign-on

Recommends TLS with client certificates for other services

Abstract

Approved client-server authentication mechanisms are described for the IVOA single-sign-on profile: digital signatures (for SOAP services); TLS with passwords (for user sign-on points); TLS with client certificates (for everything else). Normative rules are given for the implementation of these mechanisms, mainly by reference to pre-existing standards.