Äcdocutils.nodes
document
q
)Åq}q(U	nametypesq}q(X%���identifying principals (aka subjects)qNX���identity management serviceqNX���identity managementqNX���authentication serviceq	NX%���authenticating and retrieving a tokenq
NX���teragridprincipalnamesqàX���grouperqàX���symbolic principalsq
NX���edupersonprincipalnameqàX���using access tokensqNX	���hmac-sha1qàX���rsa-sha1qàX���oauth2.0qàX���foafqàX���rfc4514qàX,���encoding session information in http headersqNX���maceqàX���portal delegationqNX2���structure of metadata about authenticated sessionsqNX
���bearer tokensqàX���oauth1.0qàX ���authenticated session managementqNX0���authtoken references to an authenticated sessionqNX���rc4510qàX)���session management (alternative scenario)qNX8���identity management and authenticated session managementqNX���orcidq àuUsubstitution_defsq!}q"Uparse_messagesq#]q$(cdocutils.nodes
system_message
q%)Åq&}q'(U	rawsourceq(U�U
attributesq)}q*(Udupnamesq+]UlevelKUidsq,]Ubackrefsq-]UsourceXj���/var/lib/jenkins/jobs/API_Documentation_trunk/workspace/api-documentation/source/design/Authentication.txtq.Uclassesq/]Unamesq0]UlineMFUtypeUERRORq1uUparentq2cdocutils.nodes
list_item
q3)Åq4}q5(h(X0��`Bearer tokens`_ are unique string values issued by an authentication server that show
that a client is authorized for access; anyone holding the bearer token can use it to gain
access to a service. Service providers validate the token via either a call to the central authorization
service or cryptographically using the public key that corresponds to the private key with which
the authentication service signed the token.
These tokens must be used with TLS, and care must be taken to not leak the tokens via e.g. logs,
client storage locations, or via MITM attacks.
  * Pros: simple to implement on client, passed directly in Authorization header
  * Cons: Passed with every request, simple to capture, can use to steal session via replay attacks,
    may require centralized validation of tokens, requires TLS.

h)}q6(h+]h/]h-]h,]h0]uh2cdocutils.nodes
bullet_list
q7)Åq8}q9(h(U�h)}q:(Ubulletq;X
���*h,]h-]h+]h/]h0]uh2cdocutils.nodes
definition
q<)Åq=}q>(h(U�h)}q?(h+]h/]h-]h,]h0]uh2cdocutils.nodes
definition_list_item
q@)ÅqA}qB(h(XR��Bearer tokens
* `Bearer tokens`_ are unique string values issued by an authentication server that show
  that a client is authorized for access; anyone holding the bearer token can use it to gain
  access to a service. Service providers validate the token via either a call to the central authorization
  service or cryptographically using the public key that corresponds to the private key with which
  the authentication service signed the token.
  These tokens must be used with TLS, and care must be taken to not leak the tokens via e.g. logs,
  client storage locations, or via MITM attacks.
    * Pros: simple to implement on client, passed directly in Authorization header
    * Cons: Passed with every request, simple to capture, can use to steal session via replay attacks,
      may require centralized validation of tokens, requires TLS.

h2cdocutils.nodes
definition_list
qC)ÅqD}qE(h(U�h)}qF(h+]h/]h-]h,]h0]uh2h3)ÅqG}qH(h(Xf��Bearer tokens
  * `Bearer tokens`_ are unique string values issued by an authentication server that show
    that a client is authorized for access; anyone holding the bearer token can use it to gain
    access to a service. Service providers validate the token via either a call to the central authorization
    service or cryptographically using the public key that corresponds to the private key with which
    the authentication service signed the token.
    These tokens must be used with TLS, and care must be taken to not leak the tokens via e.g. logs,
    client storage locations, or via MITM attacks.
      * Pros: simple to implement on client, passed directly in Authorization header
      * Cons: Passed with every request, simple to capture, can use to steal session via replay attacks,
        may require centralized validation of tokens, requires TLS.

h2h7)ÅqI}qJ(h(U�h2cdocutils.nodes
section
qK)ÅqL}qM(h(U�h2hK)ÅqN}qO(h(U�h2hUsourceqPh.UtagnameqQUsectionqRh)}qS(h+]h/]h-]h,]qTU8identity-management-and-authenticated-session-managementqUah0]qVhauUlineqWKUdocumentqXhUchildrenqY]qZ(cdocutils.nodes
title
q[)Åq\}q](h(X8���Identity Management and Authenticated Session Managementq^h2hNhPh.hQUtitleq_h)}q`(h+]h/]h-]h,]h0]uhWKhXhhY]qacdocutils.nodes
Text
qbX8���Identity Management and Authenticated Session ManagementqcÖÅqd}qe(h(h^h2h\ubaubcdocutils.nodes
paragraph
qf)Åqg}qh(h(X∆��The planning and design for DataONE cybersecurity is predicated on the fact
that DataONE is a diverse collaboration of researchers, data providers, institutions,
coordinating nodes, member nodes, data collections and other infrastructure
components. As such, DataONE is inherently a virtual organization (VO).
DataONE, as an entity, spans many physical organizations and administrative
domains. The approach that DataONE follows for cybersecurity is one in which all
sensitive operations and or data/metadata resources within the DataONE VO
require users requesting access to the operation/resource to register and
authenticate with the DataONE system before an evaluation of rights to the
operation/resource can/will be performed. DataONE supports authentication
through CILogon, inlcuding both its InCommon partners such as Universities and OAuth
providers such as Google.  Thus, any given user may have multiple identities which are
verified through the authentication mechanisms from multiple providers, and these identities
can then be mapped to one another to manage changes as users change institutions and roles.
Once a user is authenticated and mapped to their DataONE identity, they can establish a session
to pass credentials to DataONE services by either 1) passing a CILogon or DataONE-issed X.509
certificate to the service provider as part of SSL negotiation, or 2) by providing an
authentication token that is provided in HTTP requests made to the DataONE nodes.qih2hNhPh.hQU	paragraphqjh)}qk(h+]h/]h-]h,]h0]uhWKhXhhY]qlhbX∆��The planning and design for DataONE cybersecurity is predicated on the fact
that DataONE is a diverse collaboration of researchers, data providers, institutions,
coordinating nodes, member nodes, data collections and other infrastructure
components. As such, DataONE is inherently a virtual organization (VO).
DataONE, as an entity, spans many physical organizations and administrative
domains. The approach that DataONE follows for cybersecurity is one in which all
sensitive operations and or data/metadata resources within the DataONE VO
require users requesting access to the operation/resource to register and
authenticate with the DataONE system before an evaluation of rights to the
operation/resource can/will be performed. DataONE supports authentication
through CILogon, inlcuding both its InCommon partners such as Universities and OAuth
providers such as Google.  Thus, any given user may have multiple identities which are
verified through the authentication mechanisms from multiple providers, and these identities
can then be mapped to one another to manage changes as users change institutions and roles.
Once a user is authenticated and mapped to their DataONE identity, they can establish a session
to pass credentials to DataONE services by either 1) passing a CILogon or DataONE-issed X.509
certificate to the service provider as part of SSL negotiation, or 2) by providing an
authentication token that is provided in HTTP requests made to the DataONE nodes.qmÖÅqn}qo(h(hih2hgubaubhf)Åqp}qq(h(XK���To this end, three services support identity management and authentication:qrh2hNhPh.hQhjh)}qs(h+]h/]h-]h,]h0]uhWKhXhhY]qthbXK���To this end, three services support identity management and authentication:quÖÅqv}qw(h(hrh2hpubaubh7)Åqx}qy(h(U�h2hNhPh.hQUbullet_listqzh)}q{(h;X
���*h,]h-]h+]h/]h0]uhWKhXhhY]q|(h3)Åq}}q~(h(X}���Identity Management - user account registration, identity mapping, group
management, and management of authentication tokens
h2hxhPh.hQU	list_itemqh)}qÄ(h+]h/]h-]h,]h0]uhWNhXhhY]qÅhf)ÅqÇ}qÉ(h(X|���Identity Management - user account registration, identity mapping, group
management, and management of authentication tokensqÑh2h}hPh.hQhjh)}qÖ(h+]h/]h-]h,]h0]uhWKhY]qÜhbX|���Identity Management - user account registration, identity mapping, group
management, and management of authentication tokensqáÖÅqà}qâ(h(hÑh2hÇubaubaubh3)Åqä}qã(h(X5���Authentication - establishing the identity of a user
h2hxhPh.hQhh)}qå(h+]h/]h-]h,]h0]uhWNhXhhY]qçhf)Åqé}qè(h(X4���Authentication - establishing the identity of a userqêh2hähPh.hQhjh)}që(h+]h/]h-]h,]h0]uhWKhY]qíhbX4���Authentication - establishing the identity of a userqìÖÅqî}qï(h(hêh2héubaubaubh3)Åqñ}qó(h(X_���Authenticated Session Management - establishing a timed-session that
identifies a DataONE user
h2hxhPh.hQhh)}qò(h+]h/]h-]h,]h0]uhWNhXhhY]qôhf)Åqö}qõ(h(X^���Authenticated Session Management - establishing a timed-session that
identifies a DataONE userqúh2hñhPh.hQhjh)}qù(h+]h/]h-]h,]h0]uhWKhY]qûhbX^���Authenticated Session Management - establishing a timed-session that
identifies a DataONE userqüÖÅq†}q°(h(húh2höubaubaubeubhK)Åq¢}q£(h(U�h2hNhPh.hQhRh)}q§(h+]h/]h-]h,]q•Uidentity-managementq¶ah0]qßhauhWK"hXhhY]q®(h[)Åq©}q™(h(X���Identity Managementq´h2h¢hPh.hQh_h)}q¨(h+]h/]h-]h,]h0]uhWK"hXhhY]q≠hbX���Identity ManagementqÆÖÅqØ}q∞(h(h´h2h©ubaubhf)Åq±}q≤(h(X`��Identity Management for DataONE addresses the need to identify users that
request the use of services and or data/metadata resources within DataONE
(DataONE does recognize that not all services/resources require user
identification, thus support for anonymous access to certain services/resources
is possible using a Public identity).  DataONE provides services for users to
register their identity with DataONE in a user account so as to create a unique
DataONE identifier, along with other attributes about that user. This account
information may be used for authorization and logging DataONE transactions.q≥h2h¢hPh.hQhjh)}q¥(h+]h/]h-]h,]h0]uhWK$hXhhY]qµhbX`��Identity Management for DataONE addresses the need to identify users that
request the use of services and or data/metadata resources within DataONE
(DataONE does recognize that not all services/resources require user
identification, thus support for anonymous access to certain services/resources
is possible using a Public identity).  DataONE provides services for users to
register their identity with DataONE in a user account so as to create a unique
DataONE identifier, along with other attributes about that user. This account
information may be used for authorization and logging DataONE transactions.q∂ÖÅq∑}q∏(h(h≥h2h±ubaubhf)Åqπ}q∫(h(X/��Users may have multiple identities as a result of distributed research endeavors
at different participating organizations and or changes in organizational
affiliation. Because of this, the DataONE Identity Management service will
support user identity mappings, which allows users to authenticate using any one
of their multiple identities, but still be recognized as the same DataONE
identity. When a DataONE authenticated session begins, information pertaining to
the user's identity is available for authorization purposes, which includes a
listing of all mapped identities associated with that user; these mapped
identities serve equally well for authorization decisions - that is, within
DataONE access control policies, reference to any mapped identity is the same as
using any other of the user's identities.qªh2h¢hPh.hQhjh)}qº(h+]h/]h-]h,]h0]uhWK-hXhhY]qΩhbX/��Users may have multiple identities as a result of distributed research endeavors
at different participating organizations and or changes in organizational
affiliation. Because of this, the DataONE Identity Management service will
support user identity mappings, which allows users to authenticate using any one
of their multiple identities, but still be recognized as the same DataONE
identity. When a DataONE authenticated session begins, information pertaining to
the user's identity is available for authorization purposes, which includes a
listing of all mapped identities associated with that user; these mapped
identities serve equally well for authorization decisions - that is, within
DataONE access control policies, reference to any mapped identity is the same as
using any other of the user's identities.qæÖÅqø}q¿(h(hªh2hπubaubhf)Åq¡}q¬(h(XU
��DataONE also supports the use of ORCID_ identifiers both for authentication and within
Access Policies.  In this scenario, a user can either map their ORCID identifier
to an existing CILogon Distinguished Name, or they can use ORCID as the primary mechanism
for logging into DataONE, in which case the ORCID is the user's primary identifier.h2h¢hPh.hQhjh)}q√(h+]h/]h-]h,]h0]uhWK9hXhhY]qƒ(hbX!���DataONE also supports the use of q≈ÖÅq∆}q«(h(X!���DataONE also supports the use of h2h¡ubcdocutils.nodes
reference
q»)Åq…}q (h(X���ORCID_UresolvedqÀK
h2h¡hQU	referenceqÃh)}qÕ(UnameX���ORCIDUrefuriqŒX���http://orcid.orgqœh,]h-]h+]h/]h0]uhY]q–hbX���ORCIDq—ÖÅq“}q”(h(U�h2h…ubaubhbX.
�� identifiers both for authentication and within
Access Policies.  In this scenario, a user can either map their ORCID identifier
to an existing CILogon Distinguished Name, or they can use ORCID as the primary mechanism
for logging into DataONE, in which case the ORCID is the user's primary identifier.q‘ÖÅq’}q÷(h(X.
�� identifiers both for authentication and within
Access Policies.  In this scenario, a user can either map their ORCID identifier
to an existing CILogon Distinguished Name, or they can use ORCID as the primary mechanism
for logging into DataONE, in which case the ORCID is the user's primary identifier.h2h¡ubeubhf)Åq◊}qÿ(h(Xm
��In addition, the Identity Management service provides a system for users to
create, store, and modify groups of users that can be used in access control
directives. Only the user creating a group will be allowed to delete the group
or to change the group's membership. Service APIs for group management are
outlined below in the Identity Management Service section.qŸh2h¢hPh.hQhjh)}q⁄(h+]h/]h-]h,]h0]uhWK>hXhhY]q€hbXm
��In addition, the Identity Management service provides a system for users to
create, store, and modify groups of users that can be used in access control
directives. Only the user creating a group will be allowed to delete the group
or to change the group's membership. Service APIs for group management are
outlined below in the Identity Management Service section.q‹ÖÅq›}qfi(h(hŸh2h◊ubaubcdocutils.nodes
note
qfl)Åq‡}q·(h(XL
��The Internet2 project has defined a product called Grouper that is a
standalone group management utility and that publishes a web interface for
interacting with the service.  It allows users and organizations to create
and manage groups.  See Grouper_ and earlier work from Internet2 on group
management through their MACE_ project.h2h¢hPh.hQUnoteq‚h)}q„(h+]h/]h-]h,]h0]uhWNhXhhY]q‰hf)ÅqÂ}qÊ(h(XL
��The Internet2 project has defined a product called Grouper that is a
standalone group management utility and that publishes a web interface for
interacting with the service.  It allows users and organizations to create
and manage groups.  See Grouper_ and earlier work from Internet2 on group
management through their MACE_ project.h2h‡hPh.hQhjh)}qÁ(h+]h/]h-]h,]h0]uhWKFhY]qË(hbXÛ���The Internet2 project has defined a product called Grouper that is a
standalone group management utility and that publishes a web interface for
interacting with the service.  It allows users and organizations to create
and manage groups.  See qÈÖÅqÍ}qÎ(h(XÛ���The Internet2 project has defined a product called Grouper that is a
standalone group management utility and that publishes a web interface for
interacting with the service.  It allows users and organizations to create
and manage groups.  See h2hÂubh»)ÅqÏ}qÌ(h(X���Grouper_hÀK
h2hÂhQhÃh)}qÓ(UnameX���GrouperhŒXA���https://spaces.internet2.edu/display/Grouper/Grouper+Web+ServicesqÔh,]h-]h+]h/]h0]uhY]qhbX���GrouperqÒÖÅqÚ}qÛ(h(U�h2hÏubaubhbXC��� and earlier work from Internet2 on group
management through their qÙÖÅqı}qˆ(h(XC��� and earlier work from Internet2 on group
management through their h2hÂubh»)Åq˜}q¯(h(X���MACE_hÀK
h2hÂhQhÃh)}q˘(UnameX���MACEhŒX+���http://middleware.internet2.edu/dir/groups/q˙h,]h-]h+]h/]h0]uhY]q˚hbX���MACEq¸ÖÅq˝}q˛(h(U�h2h˜ubaubhbX	��� project.qˇÖÅr�
��}r

��(h(X	��� project.h2hÂubeubaubcdocutils.nodes
target
r
��)År
��}r
��(h(XN���.. _Grouper: https://spaces.internet2.edu/display/Grouper/Grouper+Web+ServicesU
referencedr
��K
h2h¢hPh.hQUtargetr
��h)}r
��(hŒhÔh,]r
��Ugrouperr	
��ah-]h+]h/]h0]r

��hauhWKLhXhhY]ubj
��)År
��}r
��(h(X5���.. _MACE: http://middleware.internet2.edu/dir/groups/j
��K
h2h¢hPh.hQj
��h)}r

��(hŒh˙h,]r
��Umacer
��ah-]h+]h/]h0]r
��hauhWKNhXhhY]ubj
��)År
��}r
��(h(X���.. _ORCID: http://orcid.orgj
��K
h2h¢hPh.hQj
��h)}r
��(hŒhœh,]r
��Uorcidr
��ah-]h+]h/]h0]r
��h auhWKPhXhhY]ubhK)År
��}r
��(h(U�h2h¢hPh.hQhRh)}r
��(h+]h/]h-]h,]r
��U#identifying-principals-aka-subjectsr
��ah0]r
��hauhWKShXhhY]r
��(h[)År
��}r
��(h(X%���Identifying Principals (aka Subjects)r 
��h2j
��hPh.hQh_h)}r!
��(h+]h/]h-]h,]h0]uhWKShXhhY]r"
��hbX%���Identifying Principals (aka Subjects)r#
��ÖÅr$
��}r%
��(h(j 
��h2j
��ubaubhf)År&
��}r'
��(h(X√���Principals are users, groups of users, and system services within the DataONE
system.  They need to be represented in access policies, authentication
sessions, and other places within the system.r(
��h2j
��hPh.hQhjh)}r)
��(h+]h/]h-]h,]h0]uhWKUhXhhY]r*
��hbX√���Principals are users, groups of users, and system services within the DataONE
system.  They need to be represented in access policies, authentication
sessions, and other places within the system.r+
��ÖÅr,
��}r-
��(h(j(
��h2j&
��ubaubhf)År.
��}r/
��(h(XX
��The values for identifiers representing principals are unique, persistent,
non-reassignable strings.  Within those constraints, it is useful to use a
common convention for representing and scoping these principal names.  In DataONE,
Principals are currently represented in one of several forms, although future forms
may add to these as needed:r0
��h2j
��hPh.hQhjh)}r1
��(h+]h/]h-]h,]h0]uhWKYhXhhY]r2
��hbXX
��The values for identifiers representing principals are unique, persistent,
non-reassignable strings.  Within those constraints, it is useful to use a
common convention for representing and scoping these principal names.  In DataONE,
Principals are currently represented in one of several forms, although future forms
may add to these as needed:r3
��ÖÅr4
��}r5
��(h(j0
��h2j.
��ubaubh7)År6
��}r7
��(h(U�h2j
��hPh.hQhzh)}r8
��(h;X
���*h,]h-]h+]h/]h0]uhWK_hXhhY]r9
��(h3)År:
��}r;
��(h(Xÿ���X.509 Distinguished Names (DN)

Examples of the syntax for the representation of principals in an DN include::

    CN=Matt Jones A729,O=Google,C=US,DC=cilogon,DC=org
    UID=mbjones,O=NCEAS,DC=ecoinformatics,DC=org
h2j6
��hPh.hQhh)}r<
��(h+]h/]h-]h,]h0]uhWNhXhhY]r=
��(hf)År>
��}r?
��(h(X���X.509 Distinguished Names (DN)r@
��h2j:
��hPh.hQhjh)}rA
��(h+]h/]h-]h,]h0]uhWK_hY]rB
��hbX���X.509 Distinguished Names (DN)rC
��ÖÅrD
��}rE
��(h(j@
��h2j>
��ubaubhf)ÅrF
��}rG
��(h(XN���Examples of the syntax for the representation of principals in an DN include::h2j:
��hPh.hQhjh)}rH
��(h+]h/]h-]h,]h0]uhWKahY]rI
��hbXM���Examples of the syntax for the representation of principals in an DN include:rJ
��ÖÅrK
��}rL
��(h(XM���Examples of the syntax for the representation of principals in an DN include:h2jF
��ubaubcdocutils.nodes
literal_block
rM
��)ÅrN
��}rO
��(h(X_���CN=Matt Jones A729,O=Google,C=US,DC=cilogon,DC=org
UID=mbjones,O=NCEAS,DC=ecoinformatics,DC=orgh2j:
��hQU
literal_blockrP
��h)}rQ
��(U	xml:spacerR
��UpreserverS
��h,]h-]h+]h/]h0]uhWKchY]rT
��hbX_���CN=Matt Jones A729,O=Google,C=US,DC=cilogon,DC=org
UID=mbjones,O=NCEAS,DC=ecoinformatics,DC=orgrU
��ÖÅrV
��}rW
��(h(U�h2jN
��ubaubeubh3)ÅrX
��}rY
��(h(X«���ORCID Identifiers

Identifiers from ORCID are compatible with ISNI and take either a bare form or
are embedded in an orcid.org URL::

    0000-0003-0077-4738
    http://orcid.org/0000-0003-0077-4738
h2j6
��hPh.hQhh)}rZ
��(h+]h/]h-]h,]h0]uhWNhXhhY]r[
��(hf)År\
��}r]
��(h(X���ORCID Identifiersr^
��h2jX
��hPh.hQhjh)}r_
��(h+]h/]h-]h,]h0]uhWKfhY]r`
��hbX���ORCID Identifiersra
��ÖÅrb
��}rc
��(h(j^
��h2j\
��ubaubhf)Ård
��}re
��(h(Xq���Identifiers from ORCID are compatible with ISNI and take either a bare form or
are embedded in an orcid.org URL::h2jX
��hPh.hQhjh)}rf
��(h+]h/]h-]h,]h0]uhWKhhY]rg
��hbXp���Identifiers from ORCID are compatible with ISNI and take either a bare form or
are embedded in an orcid.org URL:rh
��ÖÅri
��}rj
��(h(Xp���Identifiers from ORCID are compatible with ISNI and take either a bare form or
are embedded in an orcid.org URL:h2jd
��ubaubjM
��)Årk
��}rl
��(h(X8���0000-0003-0077-4738
http://orcid.org/0000-0003-0077-4738h2jX
��hQjP
��h)}rm
��(jR
��jS
��h,]h-]h+]h/]h0]uhWKkhY]rn
��hbX8���0000-0003-0077-4738
http://orcid.org/0000-0003-0077-4738ro
��ÖÅrp
��}rq
��(h(U�h2jk
��ubaubeubeubhf)Årr
��}rs
��(h(X»��Within DataONE, values of :class:`Types.Subject` can be represented as the string
form of a Distinguished Name (DN) as defined in RFC4514_. Distinguished
Names are composed of a sequence of Relative Distinguished Names (RDNs), each of
which is composed of an attribute type and a value. Subjects are serialized to
strings with attribute types in upper case (a DataONE convention), case is
preserved for all values. RDNs are separated by commas, and ordering is
preserved. Values must be converted to strings following the encoding rules in
section 2.4 of RFC4514_. In summary, Subjects in DataONE are often represented as
Distinguished Names with the additional constraint that attribute types are in
upper case.h2j
��hPh.hQhjh)}rt
��(h+]h/]h-]h,]h0]uhWKnhXhhY]ru
��(hbX���Within DataONE, values of rv
��ÖÅrw
��}rx
��(h(X���Within DataONE, values of h2jr
��ubcsphinx.addnodes
pending_xref
ry
��)Årz
��}r{
��(h(X���:class:`Types.Subject`r|
��h2jr
��hPh.hQUpending_xrefr}
��h)}r~
��(UreftypeX���classUrefwarnr
��âU	reftargetrÄ
��X
���Types.SubjectU	refdomainX���pyrÅ
��h,]h-]Urefexplicitâh+]h/]h0]UrefdocrÇ
��X���design/AuthenticationrÉ
��Upy:classrÑ
��NU	py:modulerÖ
��NuhWKnhY]rÜ
��cdocutils.nodes
literal
rá
��)Årà
��}râ
��(h(j|
��h)}rä
��(h+]h/]rã
��(Uxrefrå
��jÅ
��X���py-classrç
��eh-]h,]h0]uh2jz
��hY]ré
��hbX
���Types.Subjectrè
��ÖÅrê
��}rë
��(h(U�h2jà
��ubahQUliteralrí
��ubaubhbXR��� can be represented as the string
form of a Distinguished Name (DN) as defined in rì
��ÖÅrî
��}rï
��(h(XR��� can be represented as the string
form of a Distinguished Name (DN) as defined in h2jr
��ubh»)Årñ
��}ró
��(h(X���RFC4514_hÀK
h2jr
��hQhÃh)}rò
��(UnameX���RFC4514hŒX"���http://tools.ietf.org/html/rfc4514rô
��h,]h-]h+]h/]h0]uhY]rö
��hbX���RFC4514rõ
��ÖÅrú
��}rù
��(h(U�h2jñ
��ubaubhbX°
��. Distinguished
Names are composed of a sequence of Relative Distinguished Names (RDNs), each of
which is composed of an attribute type and a value. Subjects are serialized to
strings with attribute types in upper case (a DataONE convention), case is
preserved for all values. RDNs are separated by commas, and ordering is
preserved. Values must be converted to strings following the encoding rules in
section 2.4 of rû
��ÖÅrü
��}r†
��(h(X°
��. Distinguished
Names are composed of a sequence of Relative Distinguished Names (RDNs), each of
which is composed of an attribute type and a value. Subjects are serialized to
strings with attribute types in upper case (a DataONE convention), case is
preserved for all values. RDNs are separated by commas, and ordering is
preserved. Values must be converted to strings following the encoding rules in
section 2.4 of h2jr
��ubh»)År°
��}r¢
��(h(X���RFC4514_hÀK
h2jr
��hQhÃh)}r£
��(UnameX���RFC4514hŒjô
��h,]h-]h+]h/]h0]uhY]r§
��hbX���RFC4514r•
��ÖÅr¶
��}rß
��(h(U�h2j°
��ubaubhbX��. In summary, Subjects in DataONE are often represented as
Distinguished Names with the additional constraint that attribute types are in
upper case.r®
��ÖÅr©
��}r™
��(h(X��. In summary, Subjects in DataONE are often represented as
Distinguished Names with the additional constraint that attribute types are in
upper case.h2jr
��ubeubhf)År´
��}r¨
��(h(X·���This approach enables simple string comparison to provide accurate results
within the DataONE infrastructure and services and is fully compatible with
existing services that utilize Distinguished Names as defined in RFC4510_.h2j
��hPh.hQhjh)}r≠
��(h+]h/]h-]h,]h0]uhWKyhXhhY]rÆ
��(hbXÿ���This approach enables simple string comparison to provide accurate results
within the DataONE infrastructure and services and is fully compatible with
existing services that utilize Distinguished Names as defined in rØ
��ÖÅr∞
��}r±
��(h(Xÿ���This approach enables simple string comparison to provide accurate results
within the DataONE infrastructure and services and is fully compatible with
existing services that utilize Distinguished Names as defined in h2j´
��ubcdocutils.nodes
problematic
r≤
��)År≥
��}r¥
��(h(X���RFC4510_rµ
��h2j´
��hPNhQUproblematicr∂
��h)}r∑
��(h,]r∏
��Uid2rπ
��ah-]h+]h/]h0]UrefidUid1r∫
��uhWNhXhhY]rª
��hbX���RFC4510_rº
��ÖÅrΩ
��}ræ
��(h(U�h2j≥
��ubaubhbX
���.ÖÅrø
��}r¿
��(h(X
���.h2j´
��ubeubj
��)År¡
��}r¬
��(h(X��.. _eduPersonPrincipalName: http://middleware.internet2.edu/eduperson/docs/internet2-mace-dir-eduperson-200806.html#eduPersonPrincipalNameh2j
��hPh.hQj
��h)}r√
��(hŒXn���http://middleware.internet2.edu/eduperson/docs/internet2-mace-dir-eduperson-200806.html#eduPersonPrincipalNameh,]rƒ
��Uedupersonprincipalnamer≈
��ah-]h+]h/]h0]r∆
��hauhWK~hXhhY]ubj
��)År«
��}r»
��(h(X��.. _TeraGridPrincipalNames: http://www.teragridforum.org/mediawiki/index.php?title=SAML_NameIDs_for_TeraGrid#TeraGrid_Principal_Name_Formath2j
��hPh.hQj
��h)}r…
��(hŒXo���http://www.teragridforum.org/mediawiki/index.php?title=SAML_NameIDs_for_TeraGrid#TeraGrid_Principal_Name_Formath,]r 
��Uteragridprincipalnamesr��ah-]h+]h/]h0]rÃ
��hauhWKÄhXhhY]ubj
��)ÅrÕ
��}rŒ
��(h(X1���.. _FOAF: http://xmlns.com/foaf/spec/#term_Personh2j
��hPh.hQj
��h)}rœ
��(hŒX'���http://xmlns.com/foaf/spec/#term_Personh,]r–
��Ufoafr—
��ah-]h+]h/]h0]r“
��hauhWKÇhXhhY]ubj
��)År”
��}r‘
��(h(X.���.. _RC4510: http://tools.ietf.org/html/rfc4510h2j
��hPh.hQj
��h)}r’
��(hŒX"���http://tools.ietf.org/html/rfc4510h,]r÷
��Urc4510r◊
��ah-]h+]h/]h0]rÿ
��hauhWKÑhXhhY]ubj
��)ÅrŸ
��}r⁄
��(h(X/���.. _RFC4514: http://tools.ietf.org/html/rfc4514j
��K
h2j
��hPh.hQj
��h)}r€
��(hŒjô
��h,]r‹
��Urfc4514r›
��ah-]h+]h/]h0]rfi
��hauhWKÜhXhhY]ubeubhK)Årfl
��}r‡
��(h(U�h2h¢hPh.hQhRh)}r·
��(h+]h/]h-]h,]r‚
��Usymbolic-principalsr„
��ah0]r‰
��h
auhWKähXhhY]rÂ
��(h[)ÅrÊ
��}rÁ
��(h(X���Symbolic PrincipalsrË
��h2jfl
��hPh.hQh_h)}rÈ
��(h+]h/]h-]h,]h0]uhWKähXhhY]rÍ
��hbX���Symbolic PrincipalsrÎ
��ÖÅrÏ
��}rÌ
��(h(jË
��h2jÊ
��ubaubhf)ÅrÓ
��}rÔ
��(h(X‚���In addition to named users, access policies can refer to several special symbolic groups of users
that do not need to be explicitly enumerated, but define classes of people in the
system.  The reserved symbolic principals are:r
��h2jfl
��hPh.hQhjh)}rÒ
��(h+]h/]h-]h,]h0]uhWKåhXhhY]rÚ
��hbX‚���In addition to named users, access policies can refer to several special symbolic groups of users
that do not need to be explicitly enumerated, but define classes of people in the
system.  The reserved symbolic principals are:rÛ
��ÖÅrÙ
��}rı
��(h(j
��h2jÓ
��ubaubh7)Årˆ
��}r˜
��(h(U�h2jfl
��hPh.hQhzh)}r¯
��(h;X
���*h,]h-]h+]h/]h0]uhWKêhXhhY]r˘
��(h3)År˙
��}r˚
��(h(X
��Verified authenticated users

  * A user who has a valid authentication token and an 'isVerified' flag.

    This designation is be used to ensure that users are in fact who they
    claim to be. These accounts have originated from trusted affiliate
    organizations or identity services or have been manually verified by an
    administrator. The identity information when logged during read operations
    should be fully trusted.

  * Represented using the special principal **verifiedUser**
h2jˆ
��hPh.hQhh)}r¸
��(h+]h/]h-]h,]h0]uhWNhXhhY]r˝
��(hf)År˛
��}rˇ
��(h(X���Verified authenticated usersr���h2j˙
��hPh.hQhjh)}r
��(h+]h/]h-]h,]h0]uhWKêhY]r��hbX���Verified authenticated usersr��ÖÅr��}r��(h(j���h2j˛
��ubaubcdocutils.nodes
block_quote
r��)År��}r��(h(U�h)}r	��(h+]h/]h-]h,]h0]uh2j˙
��hY]r
��h7)År��}r��(h(U�h)}r
��(h;X
���*h,]h-]h+]h/]h0]uh2j��hY]r��(h3)År��}r��(h(X|
��A user who has a valid authentication token and an 'isVerified' flag.

This designation is be used to ensure that users are in fact who they
claim to be. These accounts have originated from trusted affiliate
organizations or identity services or have been manually verified by an
administrator. The identity information when logged during read operations
should be fully trusted.
h)}r��(h+]h/]h-]h,]h0]uh2j��hY]r��(hf)År��}r��(h(XE���A user who has a valid authentication token and an 'isVerified' flag.r��h2j��hPh.hQhjh)}r��(h+]h/]h-]h,]h0]uhWKíhY]r��hbXE���A user who has a valid authentication token and an 'isVerified' flag.r��ÖÅr��}r��(h(j��h2j��ubaubhf)År��}r��(h(X4
��This designation is be used to ensure that users are in fact who they
claim to be. These accounts have originated from trusted affiliate
organizations or identity services or have been manually verified by an
administrator. The identity information when logged during read operations
should be fully trusted.r��h2j��hPh.hQhjh)}r��(h+]h/]h-]h,]h0]uhWKîhY]r��hbX4
��This designation is be used to ensure that users are in fact who they
claim to be. These accounts have originated from trusted affiliate
organizations or identity services or have been manually verified by an
administrator. The identity information when logged during read operations
should be fully trusted.r ��ÖÅr!��}r"��(h(j��h2j��ubaubehQhubh3)År#��}r$��(h(X9���Represented using the special principal **verifiedUser**
h)}r%��(h+]h/]h-]h,]h0]uh2j��hY]r&��hf)År'��}r(��(h(X8���Represented using the special principal **verifiedUser**h2j#��hPh.hQhjh)}r)��(h+]h/]h-]h,]h0]uhWKöhY]r*��(hbX(���Represented using the special principal r+��ÖÅr,��}r-��(h(X(���Represented using the special principal h2j'��ubcdocutils.nodes
strong
r.��)År/��}r0��(h(X���**verifiedUser**h)}r1��(h+]h/]h-]h,]h0]uh2j'��hY]r2��hbX���verifiedUserr3��ÖÅr4��}r5��(h(U�h2j/��ubahQUstrongr6��ubeubahQhubehQhzubahQUblock_quoter7��ubeubh3)År8��}r9��(h(Xı
��Authenticated users

  * Any user who has a valid authentication token is considered a member of
    the authenticated users group. This designation can be used in particular
    to require that user identity has been established, but not necessarily
    verified as accurate. Authenticated users may be restricted from certain
    [read] operations depending on the data owners' policy regarding access
    for untrusted identities.

  * Represented using the special principal **authenticatedUser**
h2jˆ
��hPh.hQhh)}r:��(h+]h/]h-]h,]h0]uhWNhXhhY]r;��(hf)År<��}r=��(h(X���Authenticated usersr>��h2j8��hPh.hQhjh)}r?��(h+]h/]h-]h,]h0]uhWKúhY]r@��hbX���Authenticated usersrA��ÖÅrB��}rC��(h(j>��h2j<��ubaubj��)ÅrD��}rE��(h(U�h)}rF��(h+]h/]h-]h,]h0]uh2j8��hY]rG��h7)ÅrH��}rI��(h(U�h)}rJ��(h;X
���*h,]h-]h+]h/]h0]uh2jD��hY]rK��(h3)ÅrL��}rM��(h(XÖ
��Any user who has a valid authentication token is considered a member of
the authenticated users group. This designation can be used in particular
to require that user identity has been established, but not necessarily
verified as accurate. Authenticated users may be restricted from certain
[read] operations depending on the data owners' policy regarding access
for untrusted identities.
h)}rN��(h+]h/]h-]h,]h0]uh2jH��hY]rO��hf)ÅrP��}rQ��(h(XÑ
��Any user who has a valid authentication token is considered a member of
the authenticated users group. This designation can be used in particular
to require that user identity has been established, but not necessarily
verified as accurate. Authenticated users may be restricted from certain
[read] operations depending on the data owners' policy regarding access
for untrusted identities.rR��h2jL��hPh.hQhjh)}rS��(h+]h/]h-]h,]h0]uhWKûhY]rT��hbXÑ
��Any user who has a valid authentication token is considered a member of
the authenticated users group. This designation can be used in particular
to require that user identity has been established, but not necessarily
verified as accurate. Authenticated users may be restricted from certain
[read] operations depending on the data owners' policy regarding access
for untrusted identities.rU��ÖÅrV��}rW��(h(jR��h2jP��ubaubahQhubh3)ÅrX��}rY��(h(X>���Represented using the special principal **authenticatedUser**
h)}rZ��(h+]h/]h-]h,]h0]uh2jH��hY]r[��hf)År\��}r]��(h(X=���Represented using the special principal **authenticatedUser**h2jX��hPh.hQhjh)}r^��(h+]h/]h-]h,]h0]uhWK•hY]r_��(hbX(���Represented using the special principal r`��ÖÅra��}rb��(h(X(���Represented using the special principal h2j\��ubj.��)Årc��}rd��(h(X���**authenticatedUser**h)}re��(h+]h/]h-]h,]h0]uh2j\��hY]rf��hbX���authenticatedUserrg��ÖÅrh��}ri��(h(U�h2jc��ubahQj6��ubeubahQhubehQhzubahQj7��ubeubh3)Årj��}rk��(h(X1��Public user

  * The Public user represents any user accessing services that does not have
    a valid session token, plus all of those who do have a valid token. If a
    token is found to be invalid, the user's privileges are immediately
    lowered to those of the symbolic 'public' user. For create, update, and
    delete operations, this typically means that the user has insufficient
    privileges to access the service. At times providers may want to provide
    public read access to resources.

  * Represented using the special principal **public**
h2jˆ
��hPh.hQhh)}rl��(h+]h/]h-]h,]h0]uhWNhXhhY]rm��(hf)Årn��}ro��(h(X���Public userrp��h2jj��hPh.hQhjh)}rq��(h+]h/]h-]h,]h0]uhWKßhY]rr��hbX���Public userrs��ÖÅrt��}ru��(h(jp��h2jn��ubaubj��)Årv��}rw��(h(U�h)}rx��(h+]h/]h-]h,]h0]uh2jj��hY]ry��h7)Årz��}r{��(h(U�h)}r|��(h;X
���*h,]h-]h+]h/]h0]uh2jv��hY]r}��(h3)År~��}r��(h(X–
��The Public user represents any user accessing services that does not have
a valid session token, plus all of those who do have a valid token. If a
token is found to be invalid, the user's privileges are immediately
lowered to those of the symbolic 'public' user. For create, update, and
delete operations, this typically means that the user has insufficient
privileges to access the service. At times providers may want to provide
public read access to resources.
h)}rÄ��(h+]h/]h-]h,]h0]uh2jz��hY]rÅ��hf)ÅrÇ��}rÉ��(h(Xœ
��The Public user represents any user accessing services that does not have
a valid session token, plus all of those who do have a valid token. If a
token is found to be invalid, the user's privileges are immediately
lowered to those of the symbolic 'public' user. For create, update, and
delete operations, this typically means that the user has insufficient
privileges to access the service. At times providers may want to provide
public read access to resources.rÑ��h2j~��hPh.hQhjh)}rÖ��(h+]h/]h-]h,]h0]uhWK©hY]rÜ��hbXœ
��The Public user represents any user accessing services that does not have
a valid session token, plus all of those who do have a valid token. If a
token is found to be invalid, the user's privileges are immediately
lowered to those of the symbolic 'public' user. For create, update, and
delete operations, this typically means that the user has insufficient
privileges to access the service. At times providers may want to provide
public read access to resources.rá��ÖÅrà��}râ��(h(jÑ��h2jÇ��ubaubahQhubh3)Årä��}rã��(h(X3���Represented using the special principal **public**
h)}rå��(h+]h/]h-]h,]h0]uh2jz��hY]rç��hf)Åré��}rè��(h(X2���Represented using the special principal **public**h2jä��hPh.hQhjh)}rê��(h+]h/]h-]h,]h0]uhWK±hY]rë��(hbX(���Represented using the special principal rí��ÖÅrì��}rî��(h(X(���Represented using the special principal h2jé��ubj.��)Årï��}rñ��(h(X
���**public**h)}ró��(h+]h/]h-]h,]h0]uh2jé��hY]rò��hbX���publicrô��ÖÅrö��}rõ��(h(U�h2jï��ubahQj6��ubeubahQhubehQhzubahQj7��ubeubeubeubhK)Årú��}rù��(h(U�h2h¢hPh.hQhRh)}rû��(h+]h/]h-]h,]rü��Uidentity-management-servicer†��ah0]r°��hauhWK¥hXhhY]r¢��(h[)År£��}r§��(h(X���Identity Management Servicer•��h2jú��hPh.hQh_h)}r¶��(h+]h/]h-]h,]h0]uhWK¥hXhhY]rß��hbX���Identity Management Servicer®��ÖÅr©��}r™��(h(j•��h2j£��ubaubhf)År´��}r¨��(h(X⁄
��The DataONE Identity Management service provides individuals with the ability
to register a DataONE user account with the system and to set information into
their profile.  This process creates a new identifier value for the user that
uniquely identifies them in DataONE from other DataONE users.  This
identifier is critical because it associates the user with an authenticated
session for use when requesting services and or data/metadata resources from
the DataONE nodes.r≠��h2jú��hPh.hQhjh)}rÆ��(h+]h/]h-]h,]h0]uhWK∂hXhhY]rØ��hbX⁄
��The DataONE Identity Management service provides individuals with the ability
to register a DataONE user account with the system and to set information into
their profile.  This process creates a new identifier value for the user that
uniquely identifies them in DataONE from other DataONE users.  This
identifier is critical because it associates the user with an authenticated
session for use when requesting services and or data/metadata resources from
the DataONE nodes.r∞��ÖÅr±��}r≤��(h(j≠��h2j´��ubaubhf)År≥��}r¥��(h(XN��The general application flow for a user to use DataONE services is to first log
into CILogon or ORCID with an identity of their choice, then to register that identity
with DataONE by calling the :func:`CN_auth.registerAccount` service. An authorized
third party (such as a site manager) can then call :func:`CN_auth.verifyAccount`
to verify that the real name, email address, and other biographical information
about the Person are correct. A user with more than one Identity can call
:func:`CN_auth.mapIdentity` to link those two identities together as equivalent
identities. Once this registration process is complete, future authentication
steps with CILogon will produce X.509 certificates that contain this
biographical and account information in the returned certficate, all of which
can be used by services to make authorization decisions.h2jú��hPh.hQhjh)}rµ��(h+]h/]h-]h,]h0]uhWKæhXhhY]r∂��(hbX√���The general application flow for a user to use DataONE services is to first log
into CILogon or ORCID with an identity of their choice, then to register that identity
with DataONE by calling the r∑��ÖÅr∏��}rπ��(h(X√���The general application flow for a user to use DataONE services is to first log
into CILogon or ORCID with an identity of their choice, then to register that identity
with DataONE by calling the h2j≥��ubjy
��)År∫��}rª��(h(X���:func:`CN_auth.registerAccount`rº��h2j≥��hPh.hQj}
��h)}r��(UreftypeX���funcj
��âjÄ
��X���CN_auth.registerAccountU	refdomainX���pyræ��h,]h-]Urefexplicitâh+]h/]h0]jÇ
��jÉ
��jÑ
��NjÖ
��NuhWKæhY]rø��já
��)År¿��}r¡��(h(jº��h)}r¬��(h+]h/]r√��(jå
��jæ��X���py-funcrƒ��eh-]h,]h0]uh2j∫��hY]r≈��hbX���CN_auth.registerAccount()r∆��ÖÅr«��}r»��(h(U�h2j¿��ubahQjí
��ubaubhbXK��� service. An authorized
third party (such as a site manager) can then call r…��ÖÅr ��}rÀ��(h(XK��� service. An authorized
third party (such as a site manager) can then call h2j≥��ubjy
��)ÅrÃ��}rÕ��(h(X���:func:`CN_auth.verifyAccount`rŒ��h2j≥��hPh.hQj}
��h)}rœ��(UreftypeX���funcj
��âjÄ
��X���CN_auth.verifyAccountU	refdomainX���pyr–��h,]h-]Urefexplicitâh+]h/]h0]jÇ
��jÉ
��jÑ
��NjÖ
��NuhWKæhY]r—��já
��)År“��}r”��(h(jŒ��h)}r‘��(h+]h/]r’��(jå
��j–��X���py-funcr÷��eh-]h,]h0]uh2jÃ��hY]r◊��hbX���CN_auth.verifyAccount()rÿ��ÖÅrŸ��}r⁄��(h(U�h2j“��ubahQjí
��ubaubhbXõ���
to verify that the real name, email address, and other biographical information
about the Person are correct. A user with more than one Identity can call
r€��ÖÅr‹��}r›��(h(Xõ���
to verify that the real name, email address, and other biographical information
about the Person are correct. A user with more than one Identity can call
h2j≥��ubjy
��)Årfi��}rfl��(h(X���:func:`CN_auth.mapIdentity`r‡��h2j≥��hPh.hQj}
��h)}r·��(UreftypeX���funcj
��âjÄ
��X���CN_auth.mapIdentityU	refdomainX���pyr‚��h,]h-]Urefexplicitâh+]h/]h0]jÇ
��jÉ
��jÑ
��NjÖ
��NuhWKæhY]r„��já
��)År‰��}rÂ��(h(j‡��h)}rÊ��(h+]h/]rÁ��(jå
��j‚��X���py-funcrË��eh-]h,]h0]uh2jfi��hY]rÈ��hbX���CN_auth.mapIdentity()rÍ��ÖÅrÎ��}rÏ��(h(U�h2j‰��ubahQjí
��ubaubhbXN
�� to link those two identities together as equivalent
identities. Once this registration process is complete, future authentication
steps with CILogon will produce X.509 certificates that contain this
biographical and account information in the returned certficate, all of which
can be used by services to make authorization decisions.rÌ��ÖÅrÓ��}rÔ��(h(XN
�� to link those two identities together as equivalent
identities. Once this registration process is complete, future authentication
steps with CILogon will produce X.509 certificates that contain this
biographical and account information in the returned certficate, all of which
can be used by services to make authorization decisions.h2j≥��ubeubh7)År��}rÒ��(h(U�h2jú��hPh.hQhzh)}rÚ��(h;X
���*h,]h-]h+]h/]h0]uhWK hXhhY]rÛ��(h3)ÅrÙ��}rı��(h(XO��:func:`CN_auth.registerAccount`

Register an identity with the DataONE IdentityService. When a user attempts to
use a given identity at DataONE, the user must first register the identity and
provide biographical information including their real name, real email
address, and other identifying attributes. Takes a Person description
including principal, givenName, familyName, and email address as input (other
elements from the Person description such as isMemberOf, equivalentIdentity,
and verifiedBy are ignored during registration because these elements are
populated by other services).
h2j��hPh.hQhh)}rˆ��(h+]h/]h-]h,]h0]uhWNhXhhY]r˜��(hf)År¯��}r˘��(h(X���:func:`CN_auth.registerAccount`r˙��h2jÙ��hPh.hQhjh)}r˚��(h+]h/]h-]h,]h0]uhWK hY]r¸��jy
��)År˝��}r˛��(h(j˙��h2j¯��hPh.hQj}
��h)}rˇ��(UreftypeX���funcj
��âjÄ
��X���CN_auth.registerAccountU	refdomainX���pyr���h,]h-]Urefexplicitâh+]h/]h0]jÇ
��jÉ
��jÑ
��NjÖ
��NuhWK hY]r
��já
��)År��}r��(h(j˙��h)}r��(h+]h/]r��(jå
��j���X���py-funcr��eh-]h,]h0]uh2j˝��hY]r��hbX���CN_auth.registerAccount()r��ÖÅr	��}r
��(h(U�h2j��ubahQjí
��ubaubaubhf)År��}r��(h(X-��Register an identity with the DataONE IdentityService. When a user attempts to
use a given identity at DataONE, the user must first register the identity and
provide biographical information including their real name, real email
address, and other identifying attributes. Takes a Person description
including principal, givenName, familyName, and email address as input (other
elements from the Person description such as isMemberOf, equivalentIdentity,
and verifiedBy are ignored during registration because these elements are
populated by other services).r
��h2jÙ��hPh.hQhjh)}r��(h+]h/]h-]h,]h0]uhWKÃhY]r��hbX-��Register an identity with the DataONE IdentityService. When a user attempts to
use a given identity at DataONE, the user must first register the identity and
provide biographical information including their real name, real email
address, and other identifying attributes. Takes a Person description
including principal, givenName, familyName, and email address as input (other
elements from the Person description such as isMemberOf, equivalentIdentity,
and verifiedBy are ignored during registration because these elements are
populated by other services).r��ÖÅr��}r��(h(j
��h2j��ubaubeubh3)År��}r��(h(Xä���:func:`CN_auth.verifyAccount`

Verify that an Person is an accurate portrayal of the real-life name and
identity of the named individual.
h2j��hPh.hQhh)}r��(h+]h/]h-]h,]h0]uhWNhXhhY]r��(hf)År��}r��(h(X���:func:`CN_auth.verifyAccount`r��h2j��hPh.hQhjh)}r��(h+]h/]h-]h,]h0]uhWK’hY]r��jy
��)År��}r��(h(j��h2j��hPh.hQj}
��h)}r��(UreftypeX���funcj
��âjÄ
��X���CN_auth.verifyAccountU	refdomainX���pyr��h,]h-]Urefexplicitâh+]h/]h0]jÇ
��jÉ
��jÑ
��NjÖ
��NuhWK’hY]r ��já
��)År!��}r"��(h(j��h)}r#��(h+]h/]r$��(jå
��j��X���py-funcr%��eh-]h,]h0]uh2j��hY]r&��hbX���CN_auth.verifyAccount()r'��ÖÅr(��}r)��(h(U�h2j!��ubahQjí
��ubaubaubhf)År*��}r+��(h(Xj���Verify that an Person is an accurate portrayal of the real-life name and
identity of the named individual.r,��h2j��hPh.hQhjh)}r-��(h+]h/]h-]h,]h0]uhWK◊hY]r.��hbXj���Verify that an Person is an accurate portrayal of the real-life name and
identity of the named individual.r/��ÖÅr0��}r1��(h(j,��h2j*��ubaubeubh3)År2��}r3��(h(Xü���:func:`CN_auth.mapIdentity`

Create an equivalence mapping between the identities listed for the users
authenticated and represented by session1 and session2.
h2j��hPh.hQhh)}r4��(h+]h/]h-]h,]h0]uhWNhXhhY]r5��(hf)År6��}r7��(h(X���:func:`CN_auth.mapIdentity`r8��h2j2��hPh.hQhjh)}r9��(h+]h/]h-]h,]h0]uhWK⁄hY]r:��jy
��)År;��}r<��(h(j8��h2j6��hPh.hQj}
��h)}r=��(UreftypeX���funcj
��âjÄ
��X���CN_auth.mapIdentityU	refdomainX���pyr>��h,]h-]Urefexplicitâh+]h/]h0]jÇ
��jÉ
��jÑ
��NjÖ
��NuhWK⁄hY]r?��já
��)År@��}rA��(h(j8��h)}rB��(h+]h/]rC��(jå
��j>��X���py-funcrD��eh-]h,]h0]uh2j;��hY]rE��hbX���CN_auth.mapIdentity()rF��ÖÅrG��}rH��(h(U�h2j@��ubahQjí
��ubaubaubhf)ÅrI��}rJ��(h(XÅ���Create an equivalence mapping between the identities listed for the users
authenticated and represented by session1 and session2.rK��h2j2��hPh.hQhjh)}rL��(h+]h/]h-]h,]h0]uhWK‹hY]rM��hbXÅ���Create an equivalence mapping between the identities listed for the users
authenticated and represented by session1 and session2.rN��ÖÅrO��}rP��(h(jK��h2jI��ubaubeubh3)ÅrQ��}rR��(h(Xß���:func:`CN_auth.confirmMapIdentity`

Confirm an equivalence mapping between the identities listed for the users
authenticated and represented by session1 and session2.
h2j��hPh.hQhh)}rS��(h+]h/]h-]h,]h0]uhWNhXhhY]rT��(hf)ÅrU��}rV��(h(X"���:func:`CN_auth.confirmMapIdentity`rW��h2jQ��hPh.hQhjh)}rX��(h+]h/]h-]h,]h0]uhWKflhY]rY��jy
��)ÅrZ��}r[��(h(jW��h2jU��hPh.hQj}
��h)}r\��(UreftypeX���funcj
��âjÄ
��X���CN_auth.confirmMapIdentityU	refdomainX���pyr]��h,]h-]Urefexplicitâh+]h/]h0]jÇ
��jÉ
��jÑ
��NjÖ
��NuhWKflhY]r^��já
��)År_��}r`��(h(jW��h)}ra��(h+]h/]rb��(jå
��j]��X���py-funcrc��eh-]h,]h0]uh2jZ��hY]rd��hbX���CN_auth.confirmMapIdentity()re��ÖÅrf��}rg��(h(U�h2j_��ubahQjí
��ubaubaubhf)Årh��}ri��(h(XÇ���Confirm an equivalence mapping between the identities listed for the users
authenticated and represented by session1 and session2.rj��h2jQ��hPh.hQhjh)}rk��(h+]h/]h-]h,]h0]uhWK·hY]rl��hbXÇ���Confirm an equivalence mapping between the identities listed for the users
authenticated and represented by session1 and session2.rm��ÖÅrn��}ro��(h(jj��h2jh��ubaubeubh3)Årp��}rq��(h(XÜ���:func:`CN_auth.getSubjectInfo`

Get the information about a Person, their equivalent identities, and the
Groups to which they belong.
h2j��hPh.hQhh)}rr��(h+]h/]h-]h,]h0]uhWNhXhhY]rs��(hf)Årt��}ru��(h(X���:func:`CN_auth.getSubjectInfo`rv��h2jp��hPh.hQhjh)}rw��(h+]h/]h-]h,]h0]uhWK‰hY]rx��jy
��)Åry��}rz��(h(jv��h2jt��hPh.hQj}
��h)}r{��(UreftypeX���funcj
��âjÄ
��X���CN_auth.getSubjectInfoU	refdomainX���pyr|��h,]h-]Urefexplicitâh+]h/]h0]jÇ
��jÉ
��jÑ
��NjÖ
��NuhWK‰hY]r}��já
��)År~��}r��(h(jv��h)}rÄ��(h+]h/]rÅ��(jå
��j|��X���py-funcrÇ��eh-]h,]h0]uh2jy��hY]rÉ��hbX���CN_auth.getSubjectInfo()rÑ��ÖÅrÖ��}rÜ��(h(U�h2j~��ubahQjí
��ubaubaubhf)Årá��}rà��(h(Xe���Get the information about a Person, their equivalent identities, and the
Groups to which they belong.râ��h2jp��hPh.hQhjh)}rä��(h+]h/]h-]h,]h0]uhWKÊhY]rã��hbXe���Get the information about a Person, their equivalent identities, and the
Groups to which they belong.rå��ÖÅrç��}ré��(h(jâ��h2já��ubaubeubh3)Årè��}rê��(h(XV���:func:`CN_auth.listSubjects`

Query for a matching set of users, groups, and systems.
h2j��hPh.hQhh)}rë��(h+]h/]h-]h,]h0]uhWNhXhhY]rí��(hf)Årì��}rî��(h(X���:func:`CN_auth.listSubjects`rï��h2jè��hPh.hQhjh)}rñ��(h+]h/]h-]h,]h0]uhWKÈhY]ró��jy
��)Årò��}rô��(h(jï��h2jì��hPh.hQj}
��h)}rö��(UreftypeX���funcj
��âjÄ
��X���CN_auth.listSubjectsU	refdomainX���pyrõ��h,]h-]Urefexplicitâh+]h/]h0]jÇ
��jÉ
��jÑ
��NjÖ
��NuhWKÈhY]rú��já
��)Årù��}rû��(h(jï��h)}rü��(h+]h/]r†��(jå
��jõ��X���py-funcr°��eh-]h,]h0]uh2jò��hY]r¢��hbX���CN_auth.listSubjects()r£��ÖÅr§��}r•��(h(U�h2jù��ubahQjí
��ubaubaubhf)År¶��}rß��(h(X7���Query for a matching set of users, groups, and systems.r®��h2jè��hPh.hQhjh)}r©��(h+]h/]h-]h,]h0]uhWKÎhY]r™��hbX7���Query for a matching set of users, groups, and systems.r´��ÖÅr¨��}r≠��(h(j®��h2j¶��ubaubeubh3)ÅrÆ��}rØ��(h(X|���:func:`CN_auth.createGroup`

Create a named group of users. Throws IdentifierNotUnique if the group name is
already in use.
h2j��hPh.hQhh)}r∞��(h+]h/]h-]h,]h0]uhWNhXhhY]r±��(hf)År≤��}r≥��(h(X���:func:`CN_auth.createGroup`r¥��h2jÆ��hPh.hQhjh)}rµ��(h+]h/]h-]h,]h0]uhWKÌhY]r∂��jy
��)År∑��}r∏��(h(j¥��h2j≤��hPh.hQj}
��h)}rπ��(UreftypeX���funcj
��âjÄ
��X���CN_auth.createGroupU	refdomainX���pyr∫��h,]h-]Urefexplicitâh+]h/]h0]jÇ
��jÉ
��jÑ
��NjÖ
��NuhWKÌhY]rª��já
��)Årº��}rΩ��(h(j¥��h)}ræ��(h+]h/]rø��(jå
��j∫��X���py-funcr¿��eh-]h,]h0]uh2j∑��hY]r¡��hbX���CN_auth.createGroup()r¬��ÖÅr√��}rƒ��(h(U�h2jº��ubahQjí
��ubaubaubhf)År≈��}r∆��(h(X^���Create a named group of users. Throws IdentifierNotUnique if the group name is
already in use.r«��h2jÆ��hPh.hQhjh)}r»��(h+]h/]h-]h,]h0]uhWKÔhY]r…��hbX^���Create a named group of users. Throws IdentifierNotUnique if the group name is
already in use.r ��ÖÅrÀ��}rÃ��(h(j«��h2j≈��ubaubeubh3)ÅrÕ��}rŒ��(h(X†���:func:`CN_auth.addGroupMembers`

Add the listed array of members to the named group, if and only if the user
represented in token originally created the group.
h2j��hPh.hQhh)}rœ��(h+]h/]h-]h,]h0]uhWNhXhhY]r–��(hf)År—��}r“��(h(X���:func:`CN_auth.addGroupMembers`r”��h2jÕ��hPh.hQhjh)}r‘��(h+]h/]h-]h,]h0]uhWKÚhY]r’��jy
��)År÷��}r◊��(h(j”��h2j—��hPh.hQj}
��h)}rÿ��(UreftypeX���funcj
��âjÄ
��X���CN_auth.addGroupMembersU	refdomainX���pyrŸ��h,]h-]Urefexplicitâh+]h/]h0]jÇ
��jÉ
��jÑ
��NjÖ
��NuhWKÚhY]r⁄��já
��)År€��}r‹��(h(j”��h)}r›��(h+]h/]rfi��(jå
��jŸ��X���py-funcrfl��eh-]h,]h0]uh2j÷��hY]r‡��hbX���CN_auth.addGroupMembers()r·��ÖÅr‚��}r„��(h(U�h2j€��ubahQjí
��ubaubaubhf)År‰��}rÂ��(h(X~���Add the listed array of members to the named group, if and only if the user
represented in token originally created the group.rÊ��h2jÕ��hPh.hQhjh)}rÁ��(h+]h/]h-]h,]h0]uhWKÙhY]rË��hbX~���Add the listed array of members to the named group, if and only if the user
represented in token originally created the group.rÈ��ÖÅrÍ��}rÎ��(h(jÊ��h2j‰��ubaubeubh3)ÅrÏ��}rÌ��(h(XÁ���:func:`CN_auth.removeGroupMembers`

Remove the listed array of members from the named group, if and only if the
user represented in token originally created the group or is an equivalent
identity of the user who created the group.
h2j��hPh.hQhh)}rÓ��(h+]h/]h-]h,]h0]uhWNhXhhY]rÔ��(hf)År��}rÒ��(h(X"���:func:`CN_auth.removeGroupMembers`rÚ��h2jÏ��hPh.hQhjh)}rÛ��(h+]h/]h-]h,]h0]uhWK˜hY]rÙ��jy
��)Årı��}rˆ��(h(jÚ��h2j��hPh.hQj}
��h)}r˜��(UreftypeX���funcj
��âjÄ
��X���CN_auth.removeGroupMembersU	refdomainX���pyr¯��h,]h-]Urefexplicitâh+]h/]h0]jÇ
��jÉ
��jÑ
��NjÖ
��NuhWK˜hY]r˘��já
��)År˙��}r˚��(h(jÚ��h)}r¸��(h+]h/]r˝��(jå
��j¯��X���py-funcr˛��eh-]h,]h0]uh2jı��hY]rˇ��hbX���CN_auth.removeGroupMembers()r���ÖÅr
��}r��(h(U�h2j˙��ubahQjí
��ubaubaubhf)År��}r��(h(X¬���Remove the listed array of members from the named group, if and only if the
user represented in token originally created the group or is an equivalent
identity of the user who created the group.r��h2jÏ��hPh.hQhjh)}r��(h+]h/]h-]h,]h0]uhWK˘hY]r��hbX¬���Remove the listed array of members from the named group, if and only if the
user represented in token originally created the group or is an equivalent
identity of the user who created the group.r��ÖÅr	��}r
��(h(j��h2j��ubaubeubeubcdocutils.nodes
figure
r��)År��}r
��(h(U�h2jú��hPh.hQUfigurer��h)}r��(h+]h/]h-]h,]h0]uhWK˛hXhhY]r��cdocutils.nodes
image
r��)År��}r��(h(X ���.. figure:: images/ident_01.png
h2j��hPh.hQUimager��h)}r��(UuriX���design/images/ident_01.pngr��h,]h-]h+]h/]U
candidatesr��}r��U
*j��sh0]uhWK˛hY]ubaubhf)År��}r��(h(Xd
��**Figure 1.** Identity Service is used to register an existing identity with
DataONE. In this example, the same user has two distinct pre-existing
identities. We register the primary identity with DataONE. We then request that
a secondary identity is mapped to the same Types.Subject. The user must then
confirm this equivalence between the two identities.h2jú��hPh.hQhjh)}r��(h+]h/]h-]h,]h0]uhWKˇhXhhY]r��(j.��)År��}r��(h(X
���**Figure 1.**h)}r��(h+]h/]h-]h,]h0]uh2j��hY]r ��hbX	���Figure 1.r!��ÖÅr"��}r#��(h(U�h2j��ubahQj6��ubhbXW
�� Identity Service is used to register an existing identity with
DataONE. In this example, the same user has two distinct pre-existing
identities. We register the primary identity with DataONE. We then request that
a secondary identity is mapped to the same Types.Subject. The user must then
confirm this equivalence between the two identities.r$��ÖÅr%��}r&��(h(XW
�� Identity Service is used to register an existing identity with
DataONE. In this example, the same user has two distinct pre-existing
identities. We register the primary identity with DataONE. We then request that
a secondary identity is mapped to the same Types.Subject. The user must then
confirm this equivalence between the two identities.h2j��ubeubcdocutils.nodes
comment
r'��)År(��}r)��(h(X&��@startuml images/ident_01.png
title Register two existing accounts as equivalent identities
participant "CILogon" as cilogon
participant "Client" as client << Application >>
  note right of client
    Client controlled by User
    who has two identities
  end note
participant "IdentityService" as ident << CNode >>

group username@NCEAS
  'authenticate as primary id
  client -> cilogon:authenticate with primary identity
  client <- cilogon: X.509
  'register this identity with DataONE
  client -> ident: registerAccount(Types.Session, Types.Person)
  ident --> client: Types.Subject
  client -> client:logout (dispose X.509)
end
...
group username@UCSB
  'authenticate as secondary id
  client -> cilogon:authenticate with secondary identity
  client <- cilogon: X.509
  'list existing Subjects
  client -> ident:listSubjects()
  ident --> client:Types.SubjectList
  client -> client:select equivalent Types.Subject
  'request to map identity with existing Subject
  client -> ident: mapIdentity(Types.Session, Types.Subject)
  ident --> client: boolean
  note left
    request must be
    confirmed before
    equivalence is final
  end note
  client -> client:logout (dispose X.509)
end
...
group username@NCEAS
  'authenticate as primary id
  client -> cilogon:authenticate with primary identity
  client <- cilogon: X.509
  'confirm mapping identity with DataONE
  client -> ident: confirmMapIdentity(Types.Session, Types.Subject)
  ident --> client: boolean
  note left
    equivalence is confirmed
  end note
  client -> client:logout (dispose X.509)
end

 @endumlh2jú��hPh.hQUcommentr*��h)}r+��(jR
��jS
��h,]h-]h+]h/]h0]uhWM<
hXhhY]r,��hbX&��@startuml images/ident_01.png
title Register two existing accounts as equivalent identities
participant "CILogon" as cilogon
participant "Client" as client << Application >>
  note right of client
    Client controlled by User
    who has two identities
  end note
participant "IdentityService" as ident << CNode >>

group username@NCEAS
  'authenticate as primary id
  client -> cilogon:authenticate with primary identity
  client <- cilogon: X.509
  'register this identity with DataONE
  client -> ident: registerAccount(Types.Session, Types.Person)
  ident --> client: Types.Subject
  client -> client:logout (dispose X.509)
end
...
group username@UCSB
  'authenticate as secondary id
  client -> cilogon:authenticate with secondary identity
  client <- cilogon: X.509
  'list existing Subjects
  client -> ident:listSubjects()
  ident --> client:Types.SubjectList
  client -> client:select equivalent Types.Subject
  'request to map identity with existing Subject
  client -> ident: mapIdentity(Types.Session, Types.Subject)
  ident --> client: boolean
  note left
    request must be
    confirmed before
    equivalence is final
  end note
  client -> client:logout (dispose X.509)
end
...
group username@NCEAS
  'authenticate as primary id
  client -> cilogon:authenticate with primary identity
  client <- cilogon: X.509
  'confirm mapping identity with DataONE
  client -> ident: confirmMapIdentity(Types.Session, Types.Subject)
  ident --> client: boolean
  note left
    equivalence is confirmed
  end note
  client -> client:logout (dispose X.509)
end

 @endumlr-��ÖÅr.��}r/��(h(U�h2j(��ubaubj��)År0��}r1��(h(U�h2jú��hPh.hQj��h)}r2��(h+]h/]h-]h,]h0]uhWM>
hXhhY]r3��j��)År4��}r5��(h(X ���.. figure:: images/ident_02.png
h2j0��hPh.hQj��h)}r6��(UuriX���design/images/ident_02.pngr7��h,]h-]h+]h/]j��}r8��U
*j7��sh0]uhWM>
hY]ubaubhf)År9��}r:��(h(Xé
��**Figure 2.** Identity Service is used to register an existing identity with
DataONE. In this example, the user has an identity affiliation that is not
initially trusted. We register the identity with DataONE as unverified. An
administrator needs to verify the Person details before the identity is
considered fully verified. Some DataONE actions will be restricted until
verification is completed.h2jú��hPh.hQhjh)}r;��(h+]h/]h-]h,]h0]uhWM?
hXhhY]r<��(j.��)År=��}r>��(h(X
���**Figure 2.**h)}r?��(h+]h/]h-]h,]h0]uh2j9��hY]r@��hbX	���Figure 2.rA��ÖÅrB��}rC��(h(U�h2j=��ubahQj6��ubhbXÅ
�� Identity Service is used to register an existing identity with
DataONE. In this example, the user has an identity affiliation that is not
initially trusted. We register the identity with DataONE as unverified. An
administrator needs to verify the Person details before the identity is
considered fully verified. Some DataONE actions will be restricted until
verification is completed.rD��ÖÅrE��}rF��(h(XÅ
�� Identity Service is used to register an existing identity with
DataONE. In this example, the user has an identity affiliation that is not
initially trusted. We register the identity with DataONE as unverified. An
administrator needs to verify the Person details before the identity is
considered fully verified. Some DataONE actions will be restricted until
verification is completed.h2j9��ubeubj'��)ÅrG��}rH��(h(XM��@startuml images/ident_02.png
title Register untrusted account and verify it
participant "CILogon" as cilogon
participant "Client" as client << Application >>
  note right of client
    Client controlled by User
    and by Admin
  end note
participant "IdentityService" as ident << CNode >>

group username@google
  'authenticate as primary id
  client -> cilogon:authenticate with untrusted identity
  client <- cilogon: X.509
  'register this identity with DataONE
  client -> ident: registerAccount(Types.Session, Types.Person)
  ident --> client: Types.Subject
  client -> client:logout (dispose X.509)
end
...
group admin@UCSB
  'authenticate as secondary id
  client -> cilogon:administrator authenticate
  client <- cilogon: X.509
  client -> ident:getSubjectInfo(Types.Session, Types.Subject)
  ident --> client:Types.Person
  note left
    Administrator must
    verify Person details
  end note
  'request to map identity with existing Subject
  client -> ident: verifyIdentity(Types.Session, Types.Subject)
  ident --> client: boolean
  client -> client:logout (dispose X.509)
end

 @endumlh2jú��hPh.hQj*��h)}rI��(jR
��jS
��h,]h-]h+]h/]h0]uhWMl
hXhhY]rJ��hbXM��@startuml images/ident_02.png
title Register untrusted account and verify it
participant "CILogon" as cilogon
participant "Client" as client << Application >>
  note right of client
    Client controlled by User
    and by Admin
  end note
participant "IdentityService" as ident << CNode >>

group username@google
  'authenticate as primary id
  client -> cilogon:authenticate with untrusted identity
  client <- cilogon: X.509
  'register this identity with DataONE
  client -> ident: registerAccount(Types.Session, Types.Person)
  ident --> client: Types.Subject
  client -> client:logout (dispose X.509)
end
...
group admin@UCSB
  'authenticate as secondary id
  client -> cilogon:administrator authenticate
  client <- cilogon: X.509
  client -> ident:getSubjectInfo(Types.Session, Types.Subject)
  ident --> client:Types.Person
  note left
    Administrator must
    verify Person details
  end note
  'request to map identity with existing Subject
  client -> ident: verifyIdentity(Types.Session, Types.Subject)
  ident --> client: boolean
  client -> client:logout (dispose X.509)
end

 @endumlrK��ÖÅrL��}rM��(h(U�h2jG��ubaubj��)ÅrN��}rO��(h(U�h2jú��hPh.hQj��h)}rP��(h+]h/]h-]h,]h0]uhWMn
hXhhY]rQ��j��)ÅrR��}rS��(h(X ���.. figure:: images/ident_03.png
h2jN��hPh.hQj��h)}rT��(UuriX���design/images/ident_03.pngrU��h,]h-]h+]h/]j��}rV��U
*jU��sh0]uhWMn
hY]ubaubhf)ÅrW��}rX��(h(Xfl���**Figure 3.** Identity Service is used to manage groups. The group creator is
initially the only user able to add and remove group members. List editing
permissions must be granted for other group members to edit the group.h2jú��hPh.hQhjh)}rY��(h+]h/]h-]h,]h0]uhWMo
hXhhY]rZ��(j.��)År[��}r\��(h(X
���**Figure 3.**h)}r]��(h+]h/]h-]h,]h0]uh2jW��hY]r^��hbX	���Figure 3.r_��ÖÅr`��}ra��(h(U�h2j[��ubahQj6��ubhbX“��� Identity Service is used to manage groups. The group creator is
initially the only user able to add and remove group members. List editing
permissions must be granted for other group members to edit the group.rb��ÖÅrc��}rd��(h(X“��� Identity Service is used to manage groups. The group creator is
initially the only user able to add and remove group members. List editing
permissions must be granted for other group members to edit the group.h2jW��ubeubj'��)Åre��}rf��(h(XÅ��@startuml images/ident_03.png
title Group management
participant "CILogon" as cilogon
participant "Client" as client << Application >>
  note right of client
    Client controlled by
    group administrator
  end note
participant "IdentityService" as ident << CNode >>

group admin@UCSB
  'authenticate as admin id
  client -> cilogon:authenticate admin identity
  client <- cilogon: X.509
  'create group
  client -> ident: createGroup(Types.Session, Types.Subject)
  ident --> client: Types.Identifier
  'add members
  client -> ident: addGroupMembers(Types.Session, Types.Subject, Types.SubjectList)
  ident --> client: Types.Identifier
  note left
    Administrator can
    edit group
  end note
  'remove members
  client -> ident: removeGroupMembers(Types.Session, Types.Subject, Types.SubjectList)
  ident --> client: Types.Identifier
  client -> client:logout (dispose X.509)
end

 @endumlh2jú��hPh.hQj*��h)}rg��(jR
��jS
��h,]h-]h+]h/]h0]uhWMì
hXhhY]rh��hbX��@startuml images/ident_03.png
title Group management
participant "CILogon" as cilogon
participant "Client" as client << Application >>
  note right of client
    Client controlled by
    group administrator
  end note
participant "IdentityService" as ident << CNode >>

group admin@UCSB
  'authenticate as admin id
  client -> cilogon:authenticate admin identity
  client <- cilogon: X.509
  'create group
  client -> ident: createGroup(Types.Session, Types.Subject)
  ident --> client: Types.Identifier
  'add members
  client -> ident: addGroupMembers(Types.Session, Types.Subject, Types.SubjectList)
  ident --> client: Types.Identifier
  note left
    Administrator can
    edit group
  end note
  'remove members
  client -> ident: removeGroupMembers(Types.Session, Types.Subject, Types.SubjectList)
  ident --> client: Types.Identifier
  client -> client:logout (dispose X.509)
end

 @endumlri��ÖÅrj��}rk��(h(U�h2je��ubaubeubhK)Årl��}rm��(h(U�h2h¢hPh.hQhRh)}rn��(h+]h/]h-]h,]ro��Uauthentication-servicerp��ah0]rq��h	auhWMï
hXhhY]rr��(h[)Års��}rt��(h(X���Authentication Serviceru��h2jl��hPh.hQh_h)}rv��(h+]h/]h-]h,]h0]uhWMï
hXhhY]rw��hbX���Authentication Servicerx��ÖÅry��}rz��(h(ju��h2js��ubaubhf)År{��}r|��(h(Xû��DataONE is working closely with the CILogon project to streamline and
incorporate user identities that originate from academic and commercial
institutions in the U.S. that are members of the InCommon federation or through
more globally accessible identity providers like Google, Facebook, and Yahoo!.
CILogon acts as an intermediary broker of "short-lived" identity assertions that
are made by users verifying their identity through their home institution or
identity provider service. These assertions are converted by CILogon into a
longer-lived and more commonly recognized X.509 identity certificate, which can
then be reused a number of times when interacting with DataONE. A benefit of
adopting identity management through CILogon is that
users who regularly identify themselves through their home institution or other
identity service will now be able to access DataONE resources without yet
another identity to manage.r}��h2jl��hPh.hQhjh)}r~��(h+]h/]h-]h,]h0]uhWMó
hXhhY]r��hbXû��DataONE is working closely with the CILogon project to streamline and
incorporate user identities that originate from academic and commercial
institutions in the U.S. that are members of the InCommon federation or through
more globally accessible identity providers like Google, Facebook, and Yahoo!.
CILogon acts as an intermediary broker of "short-lived" identity assertions that
are made by users verifying their identity through their home institution or
identity provider service. These assertions are converted by CILogon into a
longer-lived and more commonly recognized X.509 identity certificate, which can
then be reused a number of times when interacting with DataONE. A benefit of
adopting identity management through CILogon is that
users who regularly identify themselves through their home institution or other
identity service will now be able to access DataONE resources without yet
another identity to manage.rÄ��ÖÅrÅ��}rÇ��(h(j}��h2j{��ubaubhf)ÅrÉ��}rÑ��(h(XA��The DataONE Authentication Service provides a set of services for validating the
identity of users and services and then establishing limited duration sessions
that are represented by an X.509 cryptographically-signed certificate or an
an authentication API key. A single session is always associated with a single
user. The Authentication Service uses various methods
to validate the identity of a user in the system, and then produces SubjectInfo and
potentially a session certificate in the form of a X.509
certificate that contains the relevant properties for that session.rÖ��h2jl��hPh.hQhjh)}rÜ��(h+]h/]h-]h,]h0]uhWM•
hXhhY]r�hbXA��The DataONE Authentication Service provides a set of services for validating the
identity of users and services and then establishing limited duration sessions
that are represented by an X.509 cryptographically-signed certificate or an
an authentication API key. A single session is always associated with a single
user. The Authentication Service uses various methods
to validate the identity of a user in the system, and then produces SubjectInfo and
potentially a session certificate in the form of a X.509
certificate that contains the relevant properties for that session.rà��ÖÅrâ��}rä��(h(jÖ��h2jÉ��ubaubhf)Årã��}rå��(h(X��The CILogon service supports authentication by redirecting authentication
requests to a pre-approved list of Identity Providers associated with user's
home institutions. The main source of these Identity Providers are the
institutions that are members of the InCommon federation. Users only need to
authenticate with their home institution, thereby protecting user credentials by
preventing 3rd party clients and services from handling those credentials, and
rather only passing the credentials to the user's trusted institutional
provider.rç��h2jl��hPh.hQhjh)}ré��(h+]h/]h-]h,]h0]uhWMÆ
hXhhY]r�hbX��The CILogon service supports authentication by redirecting authentication
requests to a pre-approved list of Identity Providers associated with user's
home institutions. The main source of these Identity Providers are the
institutions that are members of the InCommon federation. Users only need to
authenticate with their home institution, thereby protecting user credentials by
preventing 3rd party clients and services from handling those credentials, and
rather only passing the credentials to the user's trusted institutional
provider.rê��ÖÅrë��}rí��(h(jç��h2jã��ubaubhf)Årì��}rî��(h(X��In general, the user will initiate the request for a session from DataONE
through either a dedicated DataONE desktop application or through a web-browser
connected to a DataONE web server. After contacting CILogon, the user will be
redirected to their institutional provider, which in turn will certify that the
user successfully authenticated to CILogon. CILogon then will contact the
DataONE Identity service to gather biographical attributes and additional
identity attributes such as group memberships and equivalent identities, and
produce an X.509 certificate containing these attributes and with a limited duration.
This certificate represents a “valid session” via the digitally signed “authentication token” (see below) that
is generated by DataONE upon authenticating the user by one of the above
mechanisms. The certificate is then returned to the user for subsequent
interactions with DataONE, and can be provided to services that need identity
information information necessary to perform authorization processing.rï��h2jl��hPh.hQhjh)}rñ��(h+]h/]h-]h,]h0]uhWM∑
hXhhY]ró��hbX��In general, the user will initiate the request for a session from DataONE
through either a dedicated DataONE desktop application or through a web-browser
connected to a DataONE web server. After contacting CILogon, the user will be
redirected to their institutional provider, which in turn will certify that the
user successfully authenticated to CILogon. CILogon then will contact the
DataONE Identity service to gather biographical attributes and additional
identity attributes such as group memberships and equivalent identities, and
produce an X.509 certificate containing these attributes and with a limited duration.
This certificate represents a “valid session” via the digitally signed “authentication token” (see below) that
is generated by DataONE upon authenticating the user by one of the above
mechanisms. The certificate is then returned to the user for subsequent
interactions with DataONE, and can be provided to services that need identity
information information necessary to perform authorization processing.rò��ÖÅrô��}rö��(h(jï��h2jì��ubaubhf)Årõ��}rú��(h(X]��DataONE web clients will likely use CILogon Portal Delegation
(http://www.cilogon.org/portal-delegation) to manage user certificates (rather
than the browser). The portal acts as a proxy for the user when interacting
with underlying DataONE services that require authentication or authorization.
Instead of direct browser-based certificate management, the portal requests and
stores user certificates and opaquely presents them to DataONE. This does
require development of an extra web application "layer" that provides user
session/certificate management in conjunction with the defined
DataONE services.h2jl��hPh.hQhjh)}rù��(h+]h/]h-]h,]h0]uhWM≈
hXhhY]rû��(hbX?���DataONE web clients will likely use CILogon Portal Delegation
(rü��ÖÅr†��}r°��(h(X?���DataONE web clients will likely use CILogon Portal Delegation
(h2jõ��ubh»)År¢��}r£��(h(X(���http://www.cilogon.org/portal-delegationr§��h)}r•��(Urefurij§��h,]h-]h+]h/]h0]uh2jõ��hY]r¶��hbX(���http://www.cilogon.org/portal-delegationrß��ÖÅr®��}r©��(h(U�h2j¢��ubahQhÃubhbXˆ
��) to manage user certificates (rather
than the browser). The portal acts as a proxy for the user when interacting
with underlying DataONE services that require authentication or authorization.
Instead of direct browser-based certificate management, the portal requests and
stores user certificates and opaquely presents them to DataONE. This does
require development of an extra web application "layer" that provides user
session/certificate management in conjunction with the defined
DataONE services.r™��ÖÅr´��}r¨��(h(Xˆ
��) to manage user certificates (rather
than the browser). The portal acts as a proxy for the user when interacting
with underlying DataONE services that require authentication or authorization.
Instead of direct browser-based certificate management, the portal requests and
stores user certificates and opaquely presents them to DataONE. This does
require development of an extra web application "layer" that provides user
session/certificate management in conjunction with the defined
DataONE services.h2jõ��ubeubhf)År≠��}rÆ��(h(Xë���Obtaining a CILogon X.509 certificate requires that the user authenticate
through the CILogon InCommon identity services as outlined in Figure 4.rØ��h2jl��hPh.hQhjh)}r∞��(h+]h/]h-]h,]h0]uhWMœ
hXhhY]r±��hbXë���Obtaining a CILogon X.509 certificate requires that the user authenticate
through the CILogon InCommon identity services as outlined in Figure 4.r≤��ÖÅr≥��}r¥��(h(jØ��h2j≠��ubaubhfl)Årµ��}r∂��(h(XS���A proposal for mapping existing KNB accounts is included at the bottom of Figure 4.r∑��h2jl��hPh.hQh‚h)}r∏��(h+]h/]h-]h,]h0]uhWNhXhhY]rπ��hf)År∫��}rª��(h(j∑��h2jµ��hPh.hQhjh)}rº��(h+]h/]h-]h,]h0]uhWM‘
hY]rΩ��hbXS���A proposal for mapping existing KNB accounts is included at the bottom of Figure 4.ræ��ÖÅrø��}r¿��(h(j∑��h2j∫��ubaubaubj��)År¡��}r¬��(h(X���.. image:: images/auth_03.png
h2jl��hPh.hQj��h)}r√��(UuriX���design/images/auth_03.pngrƒ��h,]h-]h+]h/]j��}r≈��U
*jƒ��sh0]uhWM◊
hXhhY]ubhf)År∆��}r«��(h(XŒ
��**Figure 4.** Detailed sequence of events for authentication through CILogon -
Client authentication through the CILogon service; CILogon, using Shibboleth,
requests a SAML authentication through a registered *Identity Provider* (IdP);
the IdP confirms identity and returns SAML response to CILogon; client continues
process, the portal delegate requests Certificate from CILogon;
CILogon generates X509 certificate and returns it to portal for use with DataONE.h2jl��hPh.hQhjh)}r»��(h+]h/]h-]h,]h0]uhWMÿ
hXhhY]r…��(j.��)År ��}rÀ��(h(X
���**Figure 4.**h)}rÃ��(h+]h/]h-]h,]h0]uh2j∆��hY]rÕ��hbX	���Figure 4.rŒ��ÖÅrœ��}r–��(h(U�h2j ��ubahQj6��ubhbXƒ��� Detailed sequence of events for authentication through CILogon -
Client authentication through the CILogon service; CILogon, using Shibboleth,
requests a SAML authentication through a registered r—��ÖÅr“��}r”��(h(Xƒ��� Detailed sequence of events for authentication through CILogon -
Client authentication through the CILogon service; CILogon, using Shibboleth,
requests a SAML authentication through a registered h2j∆��ubcdocutils.nodes
emphasis
r‘��)År’��}r÷��(h(X���*Identity Provider*h)}r◊��(h+]h/]h-]h,]h0]uh2j∆��hY]rÿ��hbX���Identity ProviderrŸ��ÖÅr⁄��}r€��(h(U�h2j’��ubahQUemphasisr‹��ubhbXÍ��� (IdP);
the IdP confirms identity and returns SAML response to CILogon; client continues
process, the portal delegate requests Certificate from CILogon;
CILogon generates X509 certificate and returns it to portal for use with DataONE.r›��ÖÅrfi��}rfl��(h(XÍ��� (IdP);
the IdP confirms identity and returns SAML response to CILogon; client continues
process, the portal delegate requests Certificate from CILogon;
CILogon generates X509 certificate and returns it to portal for use with DataONE.h2j∆��ubeubj'��)År‡��}r·��(h(X«��@startuml images/auth_03.png
title Detailed CILogon Authentication Sequence
participant "IdentityService" as IS << CNode >>
participant "Client Browser" as D1 << Application >>
participant "Portal" as Portal
participant "CILogon" as CI
participant "Identity Provider" as IP

D1->CI: Select IdP
CI-->D1: IdP Redirect
note right
    CIlogon redirect to IdP using
    "document.forms[0].submit()"
    posting SAML request to IdP
end note
D1->IP: Identity Verification
IP-->D1: CILogon Redirect
note right
    IdP redirect to CILogon using
    "document.forms[0].submit()"
    posting SAML response to CILogon
end note
create Portal
D1 -> Portal
Portal->CI: "Download Certificate"
CI->IS: getPrincipalInfo(Principal)
IS-->CI: PrincipalList
CI->CI: Generate and Sign X.509
CI-->Portal: X.509

group For existing KNB identities
  participant "Metacat API" as Metacat
  create Metacat

  D1->Metacat: authenticate with KNB identity/credentials
  D1<--Metacat: session
  D1->Portal: get token
  D1<--Portal: token
  D1->Metacat: "Map Identites" (token)
  Metacat->Portal: verify token
  Portal-->Metacat: valid token
  Metacat->IS: mapIdentity(MN, CILogon, KNB)
  note right
    using trusted MN certificate
  end note
end

@endumlh2jl��hPh.hQj*��h)}r‚��(jR
��jS
��h,]h-]h+]h/]h0]uhWMhXhhY]r„��hbX«��@startuml images/auth_03.png
title Detailed CILogon Authentication Sequence
participant "IdentityService" as IS << CNode >>
participant "Client Browser" as D1 << Application >>
participant "Portal" as Portal
participant "CILogon" as CI
participant "Identity Provider" as IP

D1->CI: Select IdP
CI-->D1: IdP Redirect
note right
    CIlogon redirect to IdP using
    "document.forms[0].submit()"
    posting SAML request to IdP
end note
D1->IP: Identity Verification
IP-->D1: CILogon Redirect
note right
    IdP redirect to CILogon using
    "document.forms[0].submit()"
    posting SAML response to CILogon
end note
create Portal
D1 -> Portal
Portal->CI: "Download Certificate"
CI->IS: getPrincipalInfo(Principal)
IS-->CI: PrincipalList
CI->CI: Generate and Sign X.509
CI-->Portal: X.509

group For existing KNB identities
  participant "Metacat API" as Metacat
  create Metacat

  D1->Metacat: authenticate with KNB identity/credentials
  D1<--Metacat: session
  D1->Portal: get token
  D1<--Portal: token
  D1->Metacat: "Map Identites" (token)
  Metacat->Portal: verify token
  Portal-->Metacat: valid token
  Metacat->IS: mapIdentity(MN, CILogon, KNB)
  note right
    using trusted MN certificate
  end note
end

@endumlr‰��ÖÅrÂ��}rÊ��(h(U�h2j‡��ubaubhf)ÅrÁ��}rË��(h(X¡
��The CILogon X.509 certificate provides a portable credential that binds a user‚Äôs
public key to their distinguished name or another significant identifier (e.g.,
email) that is stored in the “subject” field of the certificate. Once generated,
the CILogon X.509 certificate has a specified span of time in which it is
considered valid; this information is stored in the “valid not before” and
‚Äúvalid not after‚Äù fields of the certificate.rÈ��h2jl��hPh.hQhjh)}rÍ��(h+]h/]h-]h,]h0]uhWMhXhhY]rÎ��hbX¡
��The CILogon X.509 certificate provides a portable credential that binds a user‚Äôs
public key to their distinguished name or another significant identifier (e.g.,
email) that is stored in the “subject” field of the certificate. Once generated,
the CILogon X.509 certificate has a specified span of time in which it is
considered valid; this information is stored in the “valid not before” and
‚Äúvalid not after‚Äù fields of the certificate.rÏ��ÖÅrÌ��}rÓ��(h(jÈ��h2jÁ��ubaubhf)ÅrÔ��}r��(h(X÷
��Processing the CILogon X.509 certificate requires a verification exchange
between the service provider (DataONE) and the external user. Upon receiving a
service request from the user, the DataONE service provider will first determine
that the user’s CILogon X.509 certificate sent with the request is valid (i.e.,
verify issuer signature and confirm valid date span) and then use the attributes
in the certificate to make authorization decisions regarding the request.rÒ��h2jl��hPh.hQhjh)}rÚ��(h+]h/]h-]h,]h0]uhWMhXhhY]rÛ��hbX÷
��Processing the CILogon X.509 certificate requires a verification exchange
between the service provider (DataONE) and the external user. Upon receiving a
service request from the user, the DataONE service provider will first determine
that the user’s CILogon X.509 certificate sent with the request is valid (i.e.,
verify issuer signature and confirm valid date span) and then use the attributes
in the certificate to make authorization decisions regarding the request.rÙ��ÖÅrı��}rˆ��(h(jÒ��h2jÔ��ubaubj��)År˜��}r¯��(h(X���.. image:: images/auth_01.png
h2jl��hPh.hQj��h)}r˘��(UuriX���design/images/auth_01.pngr˙��h,]h-]h+]h/]j��}r˚��U
*j˙��sh0]uhWM hXhhY]ubhf)År¸��}r˝��(h(XŒ���**Figure 5.** Authentication and session management assuming that the CN only
runs an Identity service, and that the CILogon server runs the session
management service as part of the authentication process.h2jl��hPh.hQhjh)}r˛��(h+]h/]h-]h,]h0]uhWM!hXhhY]rˇ��(j.��)År���}r
��(h(X
���**Figure 5.**h)}r��(h+]h/]h-]h,]h0]uh2j¸��hY]r��hbX	���Figure 5.r��ÖÅr��}r��(h(U�h2j���ubahQj6��ubhbX¡��� Authentication and session management assuming that the CN only
runs an Identity service, and that the CILogon server runs the session
management service as part of the authentication process.r��ÖÅr��}r	��(h(X¡��� Authentication and session management assuming that the CN only
runs an Identity service, and that the CILogon server runs the session
management service as part of the authentication process.h2j¸��ubeubeubeubhLhK)År
��}r��(h(U�h2hNhPh.hQhRh)}r��(h+]h/]h-]h,]r
��U%authenticating-and-retrieving-a-tokenr��ah0]r��h
auhWMõhXhhY]r��(h[)År��}r��(h(X%���Authenticating and Retrieving a Tokenr��h2j
��hPh.hQh_h)}r��(h+]h/]h-]h,]h0]uhWMõhXhhY]r��hbX%���Authenticating and Retrieving a Tokenr��ÖÅr��}r��(h(j��h2j��ubaubhf)År��}r��(h(X
��Because we wish to support many different identity providers,
there is no single "login" method. Different identity providers will
inherently utilize different methods for having users prove their identity.
Initially, DataONE will target these avenues for authentication:r��h2j
��hPh.hQhjh)}r��(h+]h/]h-]h,]h0]uhWMúhXhhY]r��hbX
��Because we wish to support many different identity providers,
there is no single "login" method. Different identity providers will
inherently utilize different methods for having users prove their identity.
Initially, DataONE will target these avenues for authentication:r��ÖÅr��}r ��(h(j��h2j��ubaubh7)År!��}r"��(h(U�h2j
��hPh.hQhzh)}r#��(h;X
���*h,]h-]h+]h/]h0]uhWM°hXhhY]r$��h3)År%��}r&��(h(X^���CILogon - Users can continue to authenticate using CILogon identities much like they do today.r'��h2j!��hPh.hQhh)}r(��(h+]h/]h-]h,]h0]uhWNhXhhY]r)��hf)År*��}r+��(h(j'��h2j%��hPh.hQhjh)}r,��(h+]h/]h-]h,]h0]uhWM°hY]r-��hbX^���CILogon - Users can continue to authenticate using CILogon identities much like they do today.r.��ÖÅr/��}r0��(h(j'��h2j*��ubaubaubaubhf)År1��}r2��(h(X‰���The portal keeps track of their successful authnetication from whichever IdP they choose, and will
issue an authentication token for that user.
To begin the CILogon authorization process in the CN portal, users can navigate to::h2j
��hPh.hQhjh)}r3��(h+]h/]h-]h,]h0]uhWM¢hXhhY]r4��hbX„���The portal keeps track of their successful authnetication from whichever IdP they choose, and will
issue an authentication token for that user.
To begin the CILogon authorization process in the CN portal, users can navigate to:r5��ÖÅr6��}r7��(h(X„���The portal keeps track of their successful authnetication from whichever IdP they choose, and will
issue an authentication token for that user.
To begin the CILogon authorization process in the CN portal, users can navigate to:h2j1��ubaubjM
��)År8��}r9��(h(X>���https://<cn-host>/portal/startRequest[?target=<some_final_uri>h2j
��hPh.hQjP
��h)}r:��(jR
��jS
��h,]h-]h+]h/]h0]uhWM¶hXhhY]r;��hbX>���https://<cn-host>/portal/startRequest[?target=<some_final_uri>r<��ÖÅr=��}r>��(h(U�h2j8��ubaubh7)År?��}r@��(h(U�h2j
��hPh.hQhzh)}rA��(h;X
���*h,]h-]h+]h/]h0]uhWM©hXhhY]rB��h3)ÅrC��}rD��(h(Xa���ORCID - Using a similar workflow as with CILogon, users can opt to authenticate using their ORCIDrE��h2j?��hPh.hQhh)}rF��(h+]h/]h-]h,]h0]uhWNhXhhY]rG��hf)ÅrH��}rI��(h(jE��h2jC��hPh.hQhjh)}rJ��(h+]h/]h-]h,]h0]uhWM©hY]rK��hbXa���ORCID - Using a similar workflow as with CILogon, users can opt to authenticate using their ORCIDrL��ÖÅrM��}rN��(h(jE��h2jH��ubaubaubaubhf)ÅrO��}rP��(h(XÍ���accounts using OAuth 2.0. After successfully authenticating with the ORCID identity provider, an
authentication token can be retrieved from the portal.
To begin the ORCID authorization process in the CN portal, users can navigate to::h2j
��hPh.hQhjh)}rQ��(h+]h/]h-]h,]h0]uhWM™hXhhY]rR��hbXÈ���accounts using OAuth 2.0. After successfully authenticating with the ORCID identity provider, an
authentication token can be retrieved from the portal.
To begin the ORCID authorization process in the CN portal, users can navigate to:rS��ÖÅrT��}rU��(h(XÈ���accounts using OAuth 2.0. After successfully authenticating with the ORCID identity provider, an
authentication token can be retrieved from the portal.
To begin the ORCID authorization process in the CN portal, users can navigate to:h2jO��ubaubjM
��)ÅrV��}rW��(h(X+���https://<cn-host>/portal/oauth?action=starth2j
��hPh.hQjP
��h)}rX��(jR
��jS
��h,]h-]h+]h/]h0]uhWMÆhXhhY]rY��hbX+���https://<cn-host>/portal/oauth?action=startrZ��ÖÅr[��}r\��(h(U�h2jV��ubaubh7)År]��}r^��(h(U�h2j
��hPh.hQhzh)}r_��(h;X
���*h,]h-]h+]h/]h0]uhWM∞hXhhY]r`��h3)Åra��}rb��(h(Xh���LDAP - Existing Ecoinformatics account holders can opt to continue using those identites to authenticaterc��h2j]��hPh.hQhh)}rd��(h+]h/]h-]h,]h0]uhWNhXhhY]re��hf)Årf��}rg��(h(jc��h2ja��hPh.hQhjh)}rh��(h+]h/]h-]h,]h0]uhWM∞hY]ri��hbXh���LDAP - Existing Ecoinformatics account holders can opt to continue using those identites to authenticaterj��ÖÅrk��}rl��(h(jc��h2jf��ubaubaubaubhf)Årm��}rn��(h(Xfl���with the DataONE portal. This is a more direct method of authentication and is meant to bridge the gap between
our legacy account system and newer SSO options available above.
To authenticate using LDAP, users can post to::h2j
��hPh.hQhjh)}ro��(h+]h/]h-]h,]h0]uhWM±hXhhY]rp��hbXfi���with the DataONE portal. This is a more direct method of authentication and is meant to bridge the gap between
our legacy account system and newer SSO options available above.
To authenticate using LDAP, users can post to:rq��ÖÅrr��}rs��(h(Xfi���with the DataONE portal. This is a more direct method of authentication and is meant to bridge the gap between
our legacy account system and newer SSO options available above.
To authenticate using LDAP, users can post to:h2jm��ubaubjM
��)Årt��}ru��(h(X���https://<cn-host>/portal/ldaph2j
��hPh.hQjP
��h)}rv��(jR
��jS
��h,]h-]h+]h/]h0]uhWMµhXhhY]rw��hbX���https://<cn-host>/portal/ldaprx��ÖÅry��}rz��(h(U�h2jt��ubaubhf)År{��}r|��(h(X7���The following parameters are requred (*) or supported::r}��h2j
��hPh.hQhjh)}r~��(h+]h/]h-]h,]h0]uhWM∑hXhhY]r��hbX6���The following parameters are requred (*) or supported:rÄ��ÖÅrÅ��}rÇ��(h(X6���The following parameters are requred (*) or supported:h2j{��ubaubjM
��)ÅrÉ��}rÑ��(h(XÑ���username* - the full LDAP DN
password* - the user's LDAP password
target - any URI to be redirected to upon successful authentictionh2j
��hPh.hQjP
��h)}r��(jR
��jS
��h,]h-]h+]h/]h0]uhWMπhXhhY]rÜ��hbXÑ���username* - the full LDAP DN
password* - the user's LDAP password
target - any URI to be redirected to upon successful authentictionrá��ÖÅrà��}râ��(h(U�h2jÉ��ubaubhf)Årä��}rã��(h(Xÿ���In all cases, users will retrieve an authentication token from the CN Portal after they have successfully authenticated with
their IdP of choice and been redirected back to the CN Portal. The auth token endpoint is::h2j
��hPh.hQhjh)}rå��(h+]h/]h-]h,]h0]uhWMΩhXhhY]rç��hbX◊���In all cases, users will retrieve an authentication token from the CN Portal after they have successfully authenticated with
their IdP of choice and been redirected back to the CN Portal. The auth token endpoint is:ré��ÖÅrè��}rê��(h(X◊���In all cases, users will retrieve an authentication token from the CN Portal after they have successfully authenticated with
their IdP of choice and been redirected back to the CN Portal. The auth token endpoint is:h2j�ubaubjM
��)Årë��}rí��(h(X���https://<cn-host>/portal/tokenh2j
��hPh.hQjP
��h)}r�(jR
��jS
��h,]h-]h+]h/]h0]uhWM¿hXhhY]rî��hbX���https://<cn-host>/portal/tokenrï��ÖÅrñ��}ró��(h(U�h2jë��ubaubhf)Årò��}rô��(h(Xl���Note that the same browser session used to authenticate should be used to retrieve the authentication token.rö��h2j
��hPh.hQhjh)}rõ��(h+]h/]h-]h,]h0]uhWM¬hXhhY]rú��hbXl���Note that the same browser session used to authenticate should be used to retrieve the authentication token.rù��ÖÅrû��}rü��(h(jö��h2jò��ubaubeubhK)År†��}r°��(h(U�h2hNhPh.hQhRh)}r¢��(h+]h/]h-]h,]r£��U authenticated-session-managementr§��ah0]r•��hauhWM»hXhhY]r¶��(h[)Årß��}r®��(h(X ���Authenticated Session Managementr©��h2j†��hPh.hQh_h)}r™��(h+]h/]h-]h,]h0]uhWM»hXhhY]r´��hbX ���Authenticated Session Managementr¨��ÖÅr≠��}rÆ��(h(j©��h2jß��ubaubhf)ÅrØ��}r∞��(h(X«��For DataONE, identity management and verification is only the first step in
ensuring system-wide security. Many service calls within DataONE will require
authentication of the caller to create an authenticated session with a limited
duration for access to DataONE services. The process of authentication for most
users will begin with identity verification and downloading of the X.509
certificate from CILogon. This download will often happen from within a local
desktop DataONE application, which is acting on behalf of the user and can then
use the certificate to represent the authenticated session when it makes
requests to DataONE service providers. Both the desktop application and the
DataONE service provider can verify (1) that the certificate originated from
CILogon and (2) that the owner of the certificate, the user, is the actual party
requesting authentication with DataONE (user identity verification is performed
as prerequisite of the certificate).r±��h2j†��hPh.hQhjh)}r≤��(h+]h/]h-]h,]h0]uhWM hXhhY]r≥��hbX«��For DataONE, identity management and verification is only the first step in
ensuring system-wide security. Many service calls within DataONE will require
authentication of the caller to create an authenticated session with a limited
duration for access to DataONE services. The process of authentication for most
users will begin with identity verification and downloading of the X.509
certificate from CILogon. This download will often happen from within a local
desktop DataONE application, which is acting on behalf of the user and can then
use the certificate to represent the authenticated session when it makes
requests to DataONE service providers. Both the desktop application and the
DataONE service provider can verify (1) that the certificate originated from
CILogon and (2) that the owner of the certificate, the user, is the actual party
requesting authentication with DataONE (user identity verification is performed
as prerequisite of the certificate).r¥��ÖÅrµ��}r∂��(h(j±��h2jØ��ubaubhf)År∑��}r∏��(h(XÙ��Passed from DataONE system to DataONE system, such as making requests from a
client application to a Member Node, the certificate is a reference to an
authenticated session that contains all the necessary information identifying
the user of the original service call and other attributes used to determine
authorization in the DataONE system. The certificate itself will have a short
"time to live", thereby limiting the duration of malicious activity if a rogue
application or user were to intercept the certificate. The certificate will also
have limited applicability, in that it will be intended to be used from a
particular host location on the internet, and have other restrictions that
prevent it from being broadly used as a surrogate for the user.rπ��h2j†��hPh.hQhjh)}r∫��(h+]h/]h-]h,]h0]uhWMÿhXhhY]rª��hbXÙ��Passed from DataONE system to DataONE system, such as making requests from a
client application to a Member Node, the certificate is a reference to an
authenticated session that contains all the necessary information identifying
the user of the original service call and other attributes used to determine
authorization in the DataONE system. The certificate itself will have a short
"time to live", thereby limiting the duration of malicious activity if a rogue
application or user were to intercept the certificate. The certificate will also
have limited applicability, in that it will be intended to be used from a
particular host location on the internet, and have other restrictions that
prevent it from being broadly used as a surrogate for the user.rº��ÖÅrΩ��}ræ��(h(jπ��h2j∑��ubaubhf)Årø��}r¿��(h(X	��Services internal to the DataONE system may operate autonomously to perform
maintenance tasks or other asynchronous activities that are not bound to a
particular user. In these cases, a certificate will still be generated, but
without the prerequisite identity verification. Such certificates will have a
special system identity that signifies it is a "trusted" principal of the
DataONE system. For most instances, this certificate will serve identically to
one generated during the authentication process of normal user.r¡��h2j†��hPh.hQhjh)}r¬��(h+]h/]h-]h,]h0]uhWM„hXhhY]r√��hbX	��Services internal to the DataONE system may operate autonomously to perform
maintenance tasks or other asynchronous activities that are not bound to a
particular user. In these cases, a certificate will still be generated, but
without the prerequisite identity verification. Such certificates will have a
special system identity that signifies it is a "trusted" principal of the
DataONE system. For most instances, this certificate will serve identically to
one generated during the authentication process of normal user.rƒ��ÖÅr≈��}r∆��(h(j¡��h2jø��ubaubeubhK)År«��}r»��(h(U�h2hNhPh.hQhRh)}r…��(h+]h/]h-]h,]r ��Uportal-delegationrÀ��ah0]rÃ��hauhWMÏhXhhY]rÕ��(h[)ÅrŒ��}rœ��(h(X���Portal Delegationr–��h2j«��hPh.hQh_h)}r—��(h+]h/]h-]h,]h0]uhWMÏhXhhY]r“��hbX���Portal Delegationr”��ÖÅr‘��}r’��(h(j–��h2jŒ��ubaubhf)År÷��}r◊��(h(XÖ���For web clients, we can use the CILogon portal delegation approach. Note that
the CN and portal are assumed to be on the same server.rÿ��h2j«��hPh.hQhjh)}rŸ��(h+]h/]h-]h,]h0]uhWMÓhXhhY]r⁄��hbXÖ���For web clients, we can use the CILogon portal delegation approach. Note that
the CN and portal are assumed to be on the same server.r€��ÖÅr‹��}r›��(h(jÿ��h2j÷��ubaubj'��)Årfi��}rfl��(h(XW��@startuml images/portal_01.png
participant "Browser" as browser
participant "CN" as cn
participant "Metacat" as metacat
participant "Portal" as portal
participant "CILogon" as cilogon
group login
portal -> cilogon: get certificate
portal <- cilogon: certificate
portal -> browser: cookie
end
group https://cn-dev.dataone.org/cn/v1/object/blah
browser -> cn: get(cookie)
cn --> portal: get certificate (cookie)
note right
   same server
end note
cn <-- portal: certificate
cn -> metacat: get(certificate)
note right
   different server
end note
cn <- metacat: object
browser <- cn: object
end
@endumlh2j«��hPh.hQj*��h)}r‡��(jR
��jS
��h,]h-]h+]h/]h0]uhWMhXhhY]r·��hbXW��@startuml images/portal_01.png
participant "Browser" as browser
participant "CN" as cn
participant "Metacat" as metacat
participant "Portal" as portal
participant "CILogon" as cilogon
group login
portal -> cilogon: get certificate
portal <- cilogon: certificate
portal -> browser: cookie
end
group https://cn-dev.dataone.org/cn/v1/object/blah
browser -> cn: get(cookie)
cn --> portal: get certificate (cookie)
note right
   same server
end note
cn <-- portal: certificate
cn -> metacat: get(certificate)
note right
   different server
end note
cn <- metacat: object
browser <- cn: object
end
@endumlr‚��ÖÅr„��}r‰��(h(U�h2jfi��ubaubj��)ÅrÂ��}rÊ��(h(X ���.. image:: images/portal_01.png
h2j«��hPh.hQj��h)}rÁ��(UuriX���design/images/portal_01.pngrË��h,]h-]h+]h/]j��}rÈ��U
*jË��sh0]uhWMhXhhY]ubhf)ÅrÍ��}rÎ��(h(X{
��**Figure 7.** Authenticated "read" going through CN. The browser is the client
with no certificate. The portal keeps the user's client certificate. The CN
looks up the client certificate using the client cookie. The CN includes the
client certificate in the request that is sent to Metacat. Object is returned to
the client as though it was retrieved directly with a certificate.h2j«��hPh.hQhjh)}rÏ��(h+]h/]h-]h,]h0]uhWMhXhhY]rÌ��(j.��)ÅrÓ��}rÔ��(h(X
���**Figure 7.**h)}r��(h+]h/]h-]h,]h0]uh2jÍ��hY]rÒ��hbX	���Figure 7.rÚ��ÖÅrÛ��}rÙ��(h(U�h2jÓ��ubahQj6��ubhbXn
�� Authenticated "read" going through CN. The browser is the client
with no certificate. The portal keeps the user's client certificate. The CN
looks up the client certificate using the client cookie. The CN includes the
client certificate in the request that is sent to Metacat. Object is returned to
the client as though it was retrieved directly with a certificate.rı��ÖÅrˆ��}r˜��(h(Xn
�� Authenticated "read" going through CN. The browser is the client
with no certificate. The portal keeps the user's client certificate. The CN
looks up the client certificate using the client cookie. The CN includes the
client certificate in the request that is sent to Metacat. Object is returned to
the client as though it was retrieved directly with a certificate.h2jÍ��ubeubeubhK)År¯��}r˘��(h(U�h2hNhPh.hQhRh)}r˙��(h+]h/]h-]h,]r˚��U'session-management-alternative-scenarior¸��ah0]r˝��hauhWMhXhhY]r˛��(h[)Årˇ��}r���(h(X)���Session Management (Alternative Scenario)r
��h2j¯��hPh.hQh_h)}r��(h+]h/]h-]h,]h0]uhWMhXhhY]r��hbX)���Session Management (Alternative Scenario)r��ÖÅr��}r��(h(j
��h2jˇ��ubaubhf)År��}r��(h(XS���This is a deprecated scenario that describes the use of a separate Session
Service.r	��h2j¯��hPh.hQhjh)}r
��(h+]h/]h-]h,]h0]uhWMhXhhY]r��hbXS���This is a deprecated scenario that describes the use of a separate Session
Service.r��ÖÅr
��}r��(h(j	��h2j��ubaubhK)År��}r��(h(U�h2j¯��hPh.hQhRh)}r��(h+]h/]h-]h,]r��U0authtoken-references-to-an-authenticated-sessionr��ah0]r��hauhWMhXhhY]r��(h[)År��}r��(h(X0���AuthToken references to an Authenticated Sessionr��h2j��hPh.hQh_h)}r��(h+]h/]h-]h,]h0]uhWMhXhhY]r��hbX0���AuthToken references to an Authenticated Sessionr��ÖÅr��}r��(h(j��h2j��ubaubhf)År��}r��(h(X˝
��Each DataONE :class:`Types.AuthToken` is a unique identifier that is affiliated
with and specifies the authentication session associated with a particular
request. DataONE AuthToken References are UUID values that are created by the
DataONE Session Service when a client requests that a session be established. A
client requests that a session be established from a particular Internet
Protocol address, and all service requests associated with that session MUST
originate from that Internet Protocol address.h2j��hPh.hQhjh)}r ��(h+]h/]h-]h,]h0]uhWMhXhhY]r!��(hbX
���Each DataONE r"��ÖÅr#��}r$��(h(X
���Each DataONE h2j��ubjy
��)År%��}r&��(h(X���:class:`Types.AuthToken`r'��h2j��hPh.hQj}
��h)}r(��(UreftypeX���classj
��âjÄ
��X���Types.AuthTokenU	refdomainX���pyr)��h,]h-]Urefexplicitâh+]h/]h0]jÇ
��jÉ
��jÑ
��NjÖ
��NuhWMhY]r*��já
��)År+��}r,��(h(j'��h)}r-��(h+]h/]r.��(jå
��j)��X���py-classr/��eh-]h,]h0]uh2j%��hY]r0��hbX���Types.AuthTokenr1��ÖÅr2��}r3��(h(U�h2j+��ubahQjí
��ubaubhbXÿ
�� is a unique identifier that is affiliated
with and specifies the authentication session associated with a particular
request. DataONE AuthToken References are UUID values that are created by the
DataONE Session Service when a client requests that a session be established. A
client requests that a session be established from a particular Internet
Protocol address, and all service requests associated with that session MUST
originate from that Internet Protocol address.r4��ÖÅr5��}r6��(h(Xÿ
�� is a unique identifier that is affiliated
with and specifies the authentication session associated with a particular
request. DataONE AuthToken References are UUID values that are created by the
DataONE Session Service when a client requests that a session be established. A
client requests that a session be established from a particular Internet
Protocol address, and all service requests associated with that session MUST
originate from that Internet Protocol address.h2j��ubeubhf)År7��}r8��(h(XY��The DataONE AuthToken reference is a unique identifier that references a session
that has been established for the purposes of interacting with particular
DataONE service providers. DataONE AuthTokens are generally passed in the header
of an HTTP request to a service, thereby supporting clients that utilize
authentication and those that do not, as well as Member Nodes that support
authentication and those that don't. Any Member Nodes or clients that do not
support authentication and access control will simply ignore the presence of the
AuthToken in the HTTP header information if one is present.r9��h2j��hPh.hQhjh)}r:��(h+]h/]h-]h,]h0]uhWM'hXhhY]r;��hbXY��The DataONE AuthToken reference is a unique identifier that references a session
that has been established for the purposes of interacting with particular
DataONE service providers. DataONE AuthTokens are generally passed in the header
of an HTTP request to a service, thereby supporting clients that utilize
authentication and those that do not, as well as Member Nodes that support
authentication and those that don't. Any Member Nodes or clients that do not
support authentication and access control will simply ignore the presence of the
AuthToken in the HTTP header information if one is present.r<��ÖÅr=��}r>��(h(j9��h2j7��ubaubhf)År?��}r@��(h(X©���The DataONE HTTP header containing the AuthToken has the name 'x-AuthToken' and
contains an identifier value that is a UUID URN; for example, one might send the
header::h2j��hPh.hQhjh)}rA��(h+]h/]h-]h,]h0]uhWM0hXhhY]rB��hbX®���The DataONE HTTP header containing the AuthToken has the name 'x-AuthToken' and
contains an identifier value that is a UUID URN; for example, one might send the
header:rC��ÖÅrD��}rE��(h(X®���The DataONE HTTP header containing the AuthToken has the name 'x-AuthToken' and
contains an identifier value that is a UUID URN; for example, one might send the
header:h2j?��ubaubjM
��)ÅrF��}rG��(h(X:���x-AuthToken: urn:uuid:f689d586-59a6-11e0-8dac-3f586cd046b9h2j��hPh.hQjP
��h)}rH��(jR
��jS
��h,]h-]h+]h/]h0]uhWM4hXhhY]rI��hbX:���x-AuthToken: urn:uuid:f689d586-59a6-11e0-8dac-3f586cd046b9rJ��ÖÅrK��}rL��(h(U�h2jF��ubaubhf)ÅrM��}rN��(h(X@
��This session reference is used to indicate the session that should be used for
requests, and has limited duration based on the session expiration time.
AuthToken references refer to sessions that have limited duration and other
constraints on their validity, and these constraints MUST be validated by
service providers.rO��h2j��hPh.hQhjh)}rP��(h+]h/]h-]h,]h0]uhWM6hXhhY]rQ��hbX@
��This session reference is used to indicate the session that should be used for
requests, and has limited duration based on the session expiration time.
AuthToken references refer to sessions that have limited duration and other
constraints on their validity, and these constraints MUST be validated by
service providers.rR��ÖÅrS��}rT��(h(jO��h2jM��ubaubhf)ÅrU��}rV��(h(XÌ
��If a Node or other data one service provider receives a service request with the
DataONE x-AuthToken header, then the service SHOULD retrieve the associated
:class:`SAML.Assertion` data in order to confirm that the client has
appropriately authenticated with the DataONE session service. If the service
needs to make authorization decisions, the service MUST validate the the
associated session data, check validity constraints on the session, and then
proceed to make authorization decisions.h2j��hPh.hQhjh)}rW��(h+]h/]h-]h,]h0]uhWM<hXhhY]rX��(hbXù���If a Node or other data one service provider receives a service request with the
DataONE x-AuthToken header, then the service SHOULD retrieve the associated
rY��ÖÅrZ��}r[��(h(Xù���If a Node or other data one service provider receives a service request with the
DataONE x-AuthToken header, then the service SHOULD retrieve the associated
h2jU��ubjy
��)År\��}r]��(h(X���:class:`SAML.Assertion`r^��h2jU��hPh.hQj}
��h)}r_��(UreftypeX���classj
��âjÄ
��X���SAML.AssertionU	refdomainX���pyr`��h,]h-]Urefexplicitâh+]h/]h0]jÇ
��jÉ
��jÑ
��NjÖ
��NuhWM<hY]ra��já
��)Årb��}rc��(h(j^��h)}rd��(h+]h/]re��(jå
��j`��X���py-classrf��eh-]h,]h0]uh2j\��hY]rg��hbX���SAML.Assertionrh��ÖÅri��}rj��(h(U�h2jb��ubahQjí
��ubaubhbX9
�� data in order to confirm that the client has
appropriately authenticated with the DataONE session service. If the service
needs to make authorization decisions, the service MUST validate the the
associated session data, check validity constraints on the session, and then
proceed to make authorization decisions.rk��ÖÅrl��}rm��(h(X9
�� data in order to confirm that the client has
appropriately authenticated with the DataONE session service. If the service
needs to make authorization decisions, the service MUST validate the the
associated session data, check validity constraints on the session, and then
proceed to make authorization decisions.h2jU��ubeubhf)Årn��}ro��(h(X¡
��While making authorization decisions, the service should apply any AccessPolicy
rules that reference the identifier for the Principal, any identifier in the
'equivalentIdentity' attributes in the session, any groups that are referenced
in an 'isMemberOf' attribute in the session, and any polices that reference the
DataONE 'AuthenticatedUser' or 'VerifiedUser' identities. All of these
identities are valid identities for the authenticated session.rp��h2j��hPh.hQhjh)}rq��(h+]h/]h-]h,]h0]uhWMDhXhhY]rr��hbX¡
��While making authorization decisions, the service should apply any AccessPolicy
rules that reference the identifier for the Principal, any identifier in the
'equivalentIdentity' attributes in the session, any groups that are referenced
in an 'isMemberOf' attribute in the session, and any polices that reference the
DataONE 'AuthenticatedUser' or 'VerifiedUser' identities. All of these
identities are valid identities for the authenticated session.rs��ÖÅrt��}ru��(h(jp��h2jn��ubaubhf)Årv��}rw��(h(XB
��If a Member Node or Coordinating Node receives an AuthToken that is invalid, can
not be found using the :func:`CN_auth.getAuthSession` method, or is determined
to not be satisfying the constraints of the session (such as wrong source IP
Address), then the service MUST return an :class:`Exceptions.InvalidToken`
exception.h2j��hPh.hQhjh)}rx��(h+]h/]h-]h,]h0]uhWMKhXhhY]ry��(hbXh���If a Member Node or Coordinating Node receives an AuthToken that is invalid, can
not be found using the rz��ÖÅr{��}r|��(h(Xh���If a Member Node or Coordinating Node receives an AuthToken that is invalid, can
not be found using the h2jv��ubjy
��)År}��}r~��(h(X���:func:`CN_auth.getAuthSession`r��h2jv��hPh.hQj}
��h)}r��(UreftypeX���funcj
��âjÄ
��X���CN_auth.getAuthSessionU	refdomainX���pyrÅ��h,]h-]Urefexplicitâh+]h/]h0]jÇ
��jÉ
��jÑ
��NjÖ
��NuhWMKhY]rÇ��já
��)ÅrÉ��}rÑ��(h(j��h)}rÖ��(h+]h/]rÜ��(jå
��jÅ��X���py-funcrá��eh-]h,]h0]uh2j}��hY]rà��hbX���CN_auth.getAuthSession()râ��ÖÅrä��}rã��(h(U�h2jÉ��ubahQjí
��ubaubhbX�� method, or is determined
to not be satisfying the constraints of the session (such as wrong source IP
Address), then the service MUST return an rå��ÖÅrç��}ré��(h(Xë��� method, or is determined
to not be satisfying the constraints of the session (such as wrong source IP
Address), then the service MUST return an h2jv��ubjy
��)Årè��}rê��(h(X ���:class:`Exceptions.InvalidToken`rë��h2jv��hPh.hQj}
��h)}r�(UreftypeX���classj
��âjÄ
��X���Exceptions.InvalidTokenU	refdomainX���pyrì��h,]h-]Urefexplicitâh+]h/]h0]jÇ
��jÉ
��jÑ
��NjÖ
��NuhWMKhY]rî��já
��)Årï��}rñ��(h(jë��h)}ró��(h+]h/]rò��(jå
��jì��X���py-classrô��eh-]h,]h0]uh2jè��hY]rö��hbX���Exceptions.InvalidTokenrõ��ÖÅrú��}rù��(h(U�h2jï��ubahQjí
��ubaubhbX���
exception.rû��ÖÅrü��}r†��(h(X���
exception.h2jv��ubeubhf)År°��}r¢��(h(X“
��If a Member Node or Coordinating Node receives a service request in which there
is no x-AuthToken header, or if the header is empty, then the request should be
considered to be validated as the DataONE 'Public' user. This user may be denied
access to certain services as determined by appropriate access policies, or it
may be granted access to services when appropriate (e.g., to perform a
:func:`MN_read.get` operation on a data set marked for Public read access).h2j��hPh.hQhjh)}r£��(h+]h/]h-]h,]h0]uhWMQhXhhY]r§��(hbXá
��If a Member Node or Coordinating Node receives a service request in which there
is no x-AuthToken header, or if the header is empty, then the request should be
considered to be validated as the DataONE 'Public' user. This user may be denied
access to certain services as determined by appropriate access policies, or it
may be granted access to services when appropriate (e.g., to perform a
r•��ÖÅr¶��}rß��(h(Xá
��If a Member Node or Coordinating Node receives a service request in which there
is no x-AuthToken header, or if the header is empty, then the request should be
considered to be validated as the DataONE 'Public' user. This user may be denied
access to certain services as determined by appropriate access policies, or it
may be granted access to services when appropriate (e.g., to perform a
h2j°��ubjy
��)År®��}r©��(h(X���:func:`MN_read.get`r™��h2j°��hPh.hQj}
��h)}r´��(UreftypeX���funcj
��âjÄ
��X���MN_read.getU	refdomainX���pyr¨��h,]h-]Urefexplicitâh+]h/]h0]jÇ
��jÉ
��jÑ
��NjÖ
��NuhWMQhY]r≠��já
��)ÅrÆ��}rØ��(h(j™��h)}r∞��(h+]h/]r±��(jå
��j¨��X���py-funcr≤��eh-]h,]h0]uh2j®��hY]r≥��hbX
���MN_read.get()r¥��ÖÅrµ��}r∂��(h(U�h2jÆ��ubahQjí
��ubaubhbX8��� operation on a data set marked for Public read access).r∑��ÖÅr∏��}rπ��(h(X8��� operation on a data set marked for Public read access).h2j°��ubeubh7)År∫��}rª��(h(U�h2j��hPh.hQhzh)}rº��(h;X
���*h,]h-]h+]h/]h0]uhWMXhXhhY]rΩ��(h3)Åræ��}rø��(h(X7���:func:`CN_auth.login` returns :class:`Types.AuthToken`
h2j∫��hPh.hQhh)}r¿��(h+]h/]h-]h,]h0]uhWNhXhhY]r¡��hf)År¬��}r√��(h(X6���:func:`CN_auth.login` returns :class:`Types.AuthToken`h2jæ��hPh.hQhjh)}rƒ��(h+]h/]h-]h,]h0]uhWMXhY]r≈��(jy
��)År∆��}r«��(h(X���:func:`CN_auth.login`r»��h2j¬��hPh.hQj}
��h)}r…��(UreftypeX���funcj
��âjÄ
��X
���CN_auth.loginU	refdomainX���pyr ��h,]h-]Urefexplicitâh+]h/]h0]jÇ
��jÉ
��jÑ
��NjÖ
��NuhWMXhY]rÀ��já
��)ÅrÃ��}rÕ��(h(j»��h)}rŒ��(h+]h/]rœ��(jå
��j ��X���py-funcr–��eh-]h,]h0]uh2j∆��hY]r—��hbX���CN_auth.login()r“��ÖÅr”��}r‘��(h(U�h2jÃ��ubahQjí
��ubaubhbX	��� returns r’��ÖÅr÷��}r◊��(h(X	��� returns h2j¬��ubjy
��)Årÿ��}rŸ��(h(X���:class:`Types.AuthToken`r⁄��h2j¬��hPh.hQj}
��h)}r€��(UreftypeX���classj
��âjÄ
��X���Types.AuthTokenU	refdomainX���pyr‹��h,]h-]Urefexplicitâh+]h/]h0]jÇ
��jÉ
��jÑ
��NjÖ
��NuhWMXhY]r›��já
��)Årfi��}rfl��(h(j⁄��h)}r‡��(h+]h/]r·��(jå
��j‹��X���py-classr‚��eh-]h,]h0]uh2jÿ��hY]r„��hbX���Types.AuthTokenr‰��ÖÅrÂ��}rÊ��(h(U�h2jfi��ubahQjí
��ubaubeubaubh3)ÅrÁ��}rË��(h(X@���:func:`CN_auth.getAuthSession` returns :class:`SAML.Assertion`

h2j∫��hPh.hQhh)}rÈ��(h+]h/]h-]h,]h0]uhWNhXhhY]rÍ��hf)ÅrÎ��}rÏ��(h(X>���:func:`CN_auth.getAuthSession` returns :class:`SAML.Assertion`rÌ��h2jÁ��hPh.hQhjh)}rÓ��(h+]h/]h-]h,]h0]uhWMZhY]rÔ��(jy
��)År��}rÒ��(h(X���:func:`CN_auth.getAuthSession`rÚ��h2jÎ��hPh.hQj}
��h)}r��(UreftypeX���funcj
��âjÄ
��X���CN_auth.getAuthSessionU	refdomainX���pyrÙ��h,]h-]Urefexplicitâh+]h/]h0]jÇ
��jÉ
��jÑ
��NjÖ
��NuhWMZhY]rı��já
��)Årˆ��}r˜��(h(jÚ��h)}r¯��(h+]h/]r˘��(jå
��jÙ��X���py-funcr˙��eh-]h,]h0]uh2j��hY]r˚��hbX���CN_auth.getAuthSession()r¸��ÖÅr˝��}r˛��(h(U�h2jˆ��ubahQjí
��ubaubhbX	��� returns rˇ��ÖÅr���}r
��(h(X	��� returns h2j��ubjy
��)År��}r��(h(X���:class:`SAML.Assertion`r��h2jÎ��hPh.hQj}
��h)}r��(UreftypeX���classj
��âjÄ
��X���SAML.AssertionU	refdomainX���pyr��h,]h-]Urefexplicitâh+]h/]h0]jÇ
��jÉ
��jÑ
��NjÖ
��NuhWMZhY]r��já
��)År��}r	��(h(j��h)}r
��(h+]h/]r��(jå
��j��X���py-classr��eh-]h,]h0]uh2j��hY]r
��hbX���SAML.Assertionr��ÖÅr��}r��(h(U�h2j��ubahQjí
��ubaubeubaubeubeubhK)År��}r��(h(U�h2j¯��hPh.hQhRh)}r��(h+]h/]h-]h,]r��U2structure-of-metadata-about-authenticated-sessionsr��ah0]r��hauhWM^hXhhY]r��(h[)År��}r��(h(X2���Structure of metadata about Authenticated Sessionsr��h2j��hPh.hQh_h)}r��(h+]h/]h-]h,]h0]uhWM^hXhhY]r��hbX2���Structure of metadata about Authenticated Sessionsr��ÖÅr��}r��(h(j��h2j��ubaubhf)År ��}r!��(h(X-��Metadata about authenticated sessions are represented as a
:class:`SAML.Assertion`. Details of the fields to be included in an
:class:`SAML.Assertion` include Subject, Address, givenName, sn, mail,
equivalentIdentity, and group membership, among other fields. These fields are
all mapped to SAML2 Assertion elements, as illustrated in the following example
of an authenticated session represented by a SAML Assertion. Note that these
SAML Assertion messages are returned when Member Nodes and Coordinating Nodes
make calls to :func:`CN_auth.getAuthSession`.h2j��hPh.hQhjh)}r"��(h+]h/]h-]h,]h0]uhWM`hXhhY]r#��(hbX;���Metadata about authenticated sessions are represented as a
r$��ÖÅr%��}r&��(h(X;���Metadata about authenticated sessions are represented as a
h2j ��ubjy
��)År'��}r(��(h(X���:class:`SAML.Assertion`r)��h2j ��hPh.hQj}
��h)}r*��(UreftypeX���classj
��âjÄ
��X���SAML.AssertionU	refdomainX���pyr+��h,]h-]Urefexplicitâh+]h/]h0]jÇ
��jÉ
��jÑ
��NjÖ
��NuhWM`hY]r,��já
��)År-��}r.��(h(j)��h)}r/��(h+]h/]r0��(jå
��j+��X���py-classr1��eh-]h,]h0]uh2j'��hY]r2��hbX���SAML.Assertionr3��ÖÅr4��}r5��(h(U�h2j-��ubahQjí
��ubaubhbX-���. Details of the fields to be included in an
r6��ÖÅr7��}r8��(h(X-���. Details of the fields to be included in an
h2j ��ubjy
��)År9��}r:��(h(X���:class:`SAML.Assertion`r;��h2j ��hPh.hQj}
��h)}r<��(UreftypeX���classj
��âjÄ
��X���SAML.AssertionU	refdomainX���pyr=��h,]h-]Urefexplicitâh+]h/]h0]jÇ
��jÉ
��jÑ
��NjÖ
��NuhWM`hY]r>��já
��)År?��}r@��(h(j;��h)}rA��(h+]h/]rB��(jå
��j=��X���py-classrC��eh-]h,]h0]uh2j9��hY]rD��hbX���SAML.AssertionrE��ÖÅrF��}rG��(h(U�h2j?��ubahQjí
��ubaubhbXx
�� include Subject, Address, givenName, sn, mail,
equivalentIdentity, and group membership, among other fields. These fields are
all mapped to SAML2 Assertion elements, as illustrated in the following example
of an authenticated session represented by a SAML Assertion. Note that these
SAML Assertion messages are returned when Member Nodes and Coordinating Nodes
make calls to rH��ÖÅrI��}rJ��(h(Xx
�� include Subject, Address, givenName, sn, mail,
equivalentIdentity, and group membership, among other fields. These fields are
all mapped to SAML2 Assertion elements, as illustrated in the following example
of an authenticated session represented by a SAML Assertion. Note that these
SAML Assertion messages are returned when Member Nodes and Coordinating Nodes
make calls to h2j ��ubjy
��)ÅrK��}rL��(h(X���:func:`CN_auth.getAuthSession`rM��h2j ��hPh.hQj}
��h)}rN��(UreftypeX���funcj
��âjÄ
��X���CN_auth.getAuthSessionU	refdomainX���pyrO��h,]h-]Urefexplicitâh+]h/]h0]jÇ
��jÉ
��jÑ
��NjÖ
��NuhWM`hY]rP��já
��)ÅrQ��}rR��(h(jM��h)}rS��(h+]h/]rT��(jå
��jO��X���py-funcrU��eh-]h,]h0]uh2jK��hY]rV��hbX���CN_auth.getAuthSession()rW��ÖÅrX��}rY��(h(U�h2jQ��ubahQjí
��ubaubhbX
���.ÖÅrZ��}r[��(h(X
���.h2j ��ubeubj��)År\��}r]��(h(U�h2j��hPh.hQj��h)}r^��(h+]h/]h-]h,]h0]uhWMjhXhhY]r_��j��)År`��}ra��(h(X���.. figure:: images/auth_02.png
h2j\��hPh.hQj��h)}rb��(UuriX���design/images/auth_02.pngrc��h,]h-]h+]h/]j��}rd��U
*jc��sh0]uhWMjhY]ubaubhf)Åre��}rf��(h(XD
��**Figure 8.** Authentication and session management assuming that the CN runs a
seperate SessionService that creates and tracks sessions. This is an alternative
scenario based on the idea that CILogon may not be able to make calls to the
Identity Service, in which case the separate Session Service would need to be
created.h2j��hPh.hQhjh)}rg��(h+]h/]h-]h,]h0]uhWMkhXhhY]rh��(j.��)Åri��}rj��(h(X
���**Figure 8.**h)}rk��(h+]h/]h-]h,]h0]uh2je��hY]rl��hbX	���Figure 8.rm��ÖÅrn��}ro��(h(U�h2ji��ubahQj6��ubhbX7
�� Authentication and session management assuming that the CN runs a
seperate SessionService that creates and tracks sessions. This is an alternative
scenario based on the idea that CILogon may not be able to make calls to the
Identity Service, in which case the separate Session Service would need to be
created.rp��ÖÅrq��}rr��(h(X7
�� Authentication and session management assuming that the CN runs a
seperate SessionService that creates and tracks sessions. This is an alternative
scenario based on the idea that CILogon may not be able to make calls to the
Identity Service, in which case the separate Session Service would need to be
created.h2je��ubeubjM
��)Års��}rt��(h(X1��<saml:Assertion
   xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
   xmlns:xs="http://www.w3.org/2001/XMLSchema"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   Version="2.0"

   ID="urn:uuid:f7eca768-59c0-11e0-bf7d-fbbaa0f3405c"

   IssueInstant="2004-12-05T09:22:05Z">

   <saml:Issuer>https://cn.dataone.org/identity</saml:Issuer>
   <ds:Signature
     xmlns:ds="http://www.w3.org/2000/09/xmldsig#">...</ds:Signature>
   <saml:Subject>
     <saml:NameID
       Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName"
       SPProvidedID="CN=Some User,O=University One,C=US">
       uid=jones,o=NCEAS,dc=ecoinformatics,dc=org
     </saml:NameID>
     <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
       <saml:SubjectConfirmationData Address="10.0.45.21" />
     </saml:SubjectConfirmation>
   </saml:Subject>
   <saml:Conditions
     NotBefore="2004-12-05T09:17:05Z"
     NotOnOrAfter="2004-12-05T09:27:05Z">
   </saml:Conditions>
   <saml:AuthnStatement AuthnInstant="2010-11-25T13:15:13Z">
     <saml:AuthnContext>
       <saml:AuthnContextClassRef>
         urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
       </saml:AuthnContextClassRef>
       <!-- Note: One might also use X509 certs to authenticate, in which case the
            context class would be:
            urn:oasis:names:tc:SAML:2.0:ac:classes:X509
       -->
     </saml:AuthnContext>
   </saml:AuthnStatement>
   <saml:AttributeStatement>
     <saml:Attribute
       xmlns:x500="urn:oasis:names:tc:SAML:2.0:profiles:attribute:X500"
       x500:Encoding="LDAP"
       NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
       Name="urn:oid:2.5.4.42"
       FriendlyName="givenName">
       <saml:AttributeValue xsi:type="xs:string">Tom</saml:AttributeValue>
     </saml:Attribute>
     <saml:Attribute
       xmlns:x500="urn:oasis:names:tc:SAML:2.0:profiles:attribute:X500"
       x500:Encoding="LDAP"
       NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
       Name="urn:oid:2.5.4.4"
       FriendlyName="sn">
       <saml:AttributeValue xsi:type="xs:string">Thumb</saml:AttributeValue>
     </saml:Attribute>
     <saml:Attribute
       xmlns:x500="urn:oasis:names:tc:SAML:2.0:profiles:attribute:X500"
       x500:Encoding="LDAP"
       NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
       Name="urn:oid:1.3.6.1.4.1.1466.115.121.1.26"
       FriendlyName="mail">
       <saml:AttributeValue xsi:type="xs:string">someone@gmail.com</saml:AttributeValue>
     </saml:Attribute>
     <saml:Attribute
       xmlns:x500="urn:oasis:names:tc:SAML:2.0:profiles:attribute:X500"
       x500:Encoding="LDAP"
       NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
       Name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1"
       FriendlyName="isMemberOf">
       <saml:AttributeValue xsi:type="xs:string">
         cn=staff,o=NCEAS,dc=dataone,dc=org
       </saml:AttributeValue>
     </saml:Attribute>
     <saml:Attribute 
       NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
       Name="urn:oasis:names:tc:SAML:2.0:profiles:session:sessionId"
       FriendlyName="sessionId"
       xsi:type="xs:string">urn:uuid:f7eca768-59c0-11e0-bf7d-fbbaa0f3405c
     </saml:Attribute>
     <saml:Attribute 
       NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
       Name="urn:dataone:attributenames:equivalentIdentity"
       FriendlyName="equivalentIdentity"
       xsi:type="xs:string">mbjones@NCEAS
     </saml:Attribute>
     <saml:Attribute 
       NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
       Name="urn:dataone:attributenames:equivalentIdentity"
       FriendlyName="equivalentIdentity"
       xsi:type="xs:string">
         /DC=org/DC=cilogon/C=US/O=ProtectNetwork/CN=Matthew Jones A332
     </saml:Attribute>
   </saml:AttributeStatement>
</saml:Assertion>
h2j��hPh.hQjP
��h)}ru��(Ulinenosrv��âUlanguagerw��cdocutils.nodes
reprunicode
rx��X���xmlry��ÖÅrz��}r{��bh+]jR
��jS
��h,]h-]UsourceXt���/var/lib/jenkins/jobs/API_Documentation_trunk/workspace/api-documentation/source/design/saml-2-assertion-example.xmlUhighlight_argsr|��}r}��Ulinenostartr~��K
sh/]h0]uhWMqhXhhY]r��hbX1��<saml:Assertion
   xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
   xmlns:xs="http://www.w3.org/2001/XMLSchema"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   Version="2.0"

   ID="urn:uuid:f7eca768-59c0-11e0-bf7d-fbbaa0f3405c"

   IssueInstant="2004-12-05T09:22:05Z">

   <saml:Issuer>https://cn.dataone.org/identity</saml:Issuer>
   <ds:Signature
     xmlns:ds="http://www.w3.org/2000/09/xmldsig#">...</ds:Signature>
   <saml:Subject>
     <saml:NameID
       Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName"
       SPProvidedID="CN=Some User,O=University One,C=US">
       uid=jones,o=NCEAS,dc=ecoinformatics,dc=org
     </saml:NameID>
     <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
       <saml:SubjectConfirmationData Address="10.0.45.21" />
     </saml:SubjectConfirmation>
   </saml:Subject>
   <saml:Conditions
     NotBefore="2004-12-05T09:17:05Z"
     NotOnOrAfter="2004-12-05T09:27:05Z">
   </saml:Conditions>
   <saml:AuthnStatement AuthnInstant="2010-11-25T13:15:13Z">
     <saml:AuthnContext>
       <saml:AuthnContextClassRef>
         urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
       </saml:AuthnContextClassRef>
       <!-- Note: One might also use X509 certs to authenticate, in which case the
            context class would be:
            urn:oasis:names:tc:SAML:2.0:ac:classes:X509
       -->
     </saml:AuthnContext>
   </saml:AuthnStatement>
   <saml:AttributeStatement>
     <saml:Attribute
       xmlns:x500="urn:oasis:names:tc:SAML:2.0:profiles:attribute:X500"
       x500:Encoding="LDAP"
       NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
       Name="urn:oid:2.5.4.42"
       FriendlyName="givenName">
       <saml:AttributeValue xsi:type="xs:string">Tom</saml:AttributeValue>
     </saml:Attribute>
     <saml:Attribute
       xmlns:x500="urn:oasis:names:tc:SAML:2.0:profiles:attribute:X500"
       x500:Encoding="LDAP"
       NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
       Name="urn:oid:2.5.4.4"
       FriendlyName="sn">
       <saml:AttributeValue xsi:type="xs:string">Thumb</saml:AttributeValue>
     </saml:Attribute>
     <saml:Attribute
       xmlns:x500="urn:oasis:names:tc:SAML:2.0:profiles:attribute:X500"
       x500:Encoding="LDAP"
       NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
       Name="urn:oid:1.3.6.1.4.1.1466.115.121.1.26"
       FriendlyName="mail">
       <saml:AttributeValue xsi:type="xs:string">someone@gmail.com</saml:AttributeValue>
     </saml:Attribute>
     <saml:Attribute
       xmlns:x500="urn:oasis:names:tc:SAML:2.0:profiles:attribute:X500"
       x500:Encoding="LDAP"
       NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
       Name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1"
       FriendlyName="isMemberOf">
       <saml:AttributeValue xsi:type="xs:string">
         cn=staff,o=NCEAS,dc=dataone,dc=org
       </saml:AttributeValue>
     </saml:Attribute>
     <saml:Attribute 
       NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
       Name="urn:oasis:names:tc:SAML:2.0:profiles:session:sessionId"
       FriendlyName="sessionId"
       xsi:type="xs:string">urn:uuid:f7eca768-59c0-11e0-bf7d-fbbaa0f3405c
     </saml:Attribute>
     <saml:Attribute 
       NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
       Name="urn:dataone:attributenames:equivalentIdentity"
       FriendlyName="equivalentIdentity"
       xsi:type="xs:string">mbjones@NCEAS
     </saml:Attribute>
     <saml:Attribute 
       NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
       Name="urn:dataone:attributenames:equivalentIdentity"
       FriendlyName="equivalentIdentity"
       xsi:type="xs:string">
         /DC=org/DC=cilogon/C=US/O=ProtectNetwork/CN=Matthew Jones A332
     </saml:Attribute>
   </saml:AttributeStatement>
</saml:Assertion>
rÄ��ÖÅrÅ��}rÇ��(h(U�h2js��ubaubj'��)ÅrÉ��}rÑ��(h(X¬
��@startuml images/auth_01.png
participant "MN" as mn << MNode >>
participant "Client" as app_client << Application >>
participant "CILogon" as cilogon << CNode >>
participant "IdentityService" as ident << CNode >>

app_client -> cilogon: authenticate()
cilogon -> ident: getPrincipalInfo(Principal)
cilogon <- ident: PrincipalList
app_client <- cilogon: X.509
app_client -> mn: get(X.509, pid)
mn -> mn: isAuthorized()
app_client <- mn: object
@endumlh2j��hPh.hQj*��h)}r��(jR
��jS
��h,]h-]h+]h/]h0]uhWMÉhXhhY]rÜ��hbX¬
��@startuml images/auth_01.png
participant "MN" as mn << MNode >>
participant "Client" as app_client << Application >>
participant "CILogon" as cilogon << CNode >>
participant "IdentityService" as ident << CNode >>

app_client -> cilogon: authenticate()
cilogon -> ident: getPrincipalInfo(Principal)
cilogon <- ident: PrincipalList
app_client <- cilogon: X.509
app_client -> mn: get(X.509, pid)
mn -> mn: isAuthorized()
app_client <- mn: object
@endumlrá��ÖÅrà��}râ��(h(U�h2jÉ��ubaubj'��)Årä��}rã��(h(Xá��@startuml images/auth_02.png
participant "CILogon" as cilogon << CNode >>
participant "Client" as app_client << Application >>
participant "MN" as mn << MNode >>
participant "SessionService" as session << CNode >>
participant "IdentityService" as ident << CNode >>

app_client -> cilogon: authenticate()
app_client <- cilogon: X.509
app_client -> session: newSession(X.509)
session -> ident: getPrincipalInfo(Principal)
session <- ident: PrincipalList
app_client <- session: token

app_client -> mn: get(token, pid)
mn -> session: getAuthSession(token)
mn <- session: AuthSession Assertion
mn -> mn: isAuthorized()
app_client <- mn: object
@endumlh2j��hPh.hQj*��h)}r�(jR
��jS
��h,]h-]h+]h/]h0]uhWMöhXhhY]rç��hbXá��@startuml images/auth_02.png
participant "CILogon" as cilogon << CNode >>
participant "Client" as app_client << Application >>
participant "MN" as mn << MNode >>
participant "SessionService" as session << CNode >>
participant "IdentityService" as ident << CNode >>

app_client -> cilogon: authenticate()
app_client <- cilogon: X.509
app_client -> session: newSession(X.509)
session -> ident: getPrincipalInfo(Principal)
session <- ident: PrincipalList
app_client <- session: token

app_client -> mn: get(token, pid)
mn -> session: getAuthSession(token)
mn <- session: AuthSession Assertion
mn -> mn: isAuthorized()
app_client <- mn: object
@endumlré��ÖÅrè��}rê��(h(U�h2jä��ubaubeubeubeubhPh.hQhRh)}rë��(h+]h/]h-]h,]rí��Uusing-access-tokensrì��ah0]rî��hauhWM&hXhhY]rï��(h[)Årñ��}ró��(h(X���Using Access Tokensrò��h2hLhPh.hQh_h)}rô��(h+]h/]h-]h,]h0]uhWM&hXhhY]rö��hbX���Using Access Tokensrõ��ÖÅrú��}rù��(h(jò��h2jñ��ubaubhf)Årû��}rü��(h(Xà��Some clients have difficulty handling X.509 certificates, and so the DataONE V2 API
also supports the use of **access tokens** as a mechanism for clients to identifiy themselves
for API calls.  In this scenario, the user authenticates with the DataONE Portal, and then
obtains an access token directly from the DataONE Portal.
The client then uses this information to pass access tokens to
service providers using an HTTP "Authorization" header.
The service provider (e.g., MN), must then validate the access token to ensure that the
request is coming from a host with a valid token and that the request is not being repeated via session hijacking.h2hLhPh.hQhjh)}r†��(h+]h/]h-]h,]h0]uhWM'hXhhY]r°��(hbXm���Some clients have difficulty handling X.509 certificates, and so the DataONE V2 API
also supports the use of r¢��ÖÅr£��}r§��(h(Xm���Some clients have difficulty handling X.509 certificates, and so the DataONE V2 API
also supports the use of h2jû��ubj.��)År•��}r¶��(h(X���**access tokens**h)}rß��(h+]h/]h-]h,]h0]uh2jû��hY]r®��hbX
���access tokensr©��ÖÅr™��}r´��(h(U�h2j•��ubahQj6��ubhbX
�� as a mechanism for clients to identifiy themselves
for API calls.  In this scenario, the user authenticates with the DataONE Portal, and then
obtains an access token directly from the DataONE Portal.
The client then uses this information to pass access tokens to
service providers using an HTTP "Authorization" header.
The service provider (e.g., MN), must then validate the access token to ensure that the
request is coming from a host with a valid token and that the request is not being repeated via session hijacking.r¨��ÖÅr≠��}rÆ��(h(X
�� as a mechanism for clients to identifiy themselves
for API calls.  In this scenario, the user authenticates with the DataONE Portal, and then
obtains an access token directly from the DataONE Portal.
The client then uses this information to pass access tokens to
service providers using an HTTP "Authorization" header.
The service provider (e.g., MN), must then validate the access token to ensure that the
request is coming from a host with a valid token and that the request is not being repeated via session hijacking.h2jû��ubeubhf)ÅrØ��}r∞��(h(XÓ
��DataONE considered different scenarios for the structure and meaning of these access
tokens, largely following the OAuth1.0_ and OAuth2.0_ specifications.
These two specification propose related but different mechanisms for generating and utilizing
access tokens.  Decision making fell along two axes: 1) what does an acces token represent,
and 2) how does a service provider validate an access token.  The main choices were, in order of
both increasing security and increasing complexity, are:h2hLhPh.hQhjh)}r±��(h+]h/]h-]h,]h0]uhWM0hXhhY]r≤��(hbXs���DataONE considered different scenarios for the structure and meaning of these access
tokens, largely following the r≥��ÖÅr¥��}rµ��(h(Xs���DataONE considered different scenarios for the structure and meaning of these access
tokens, largely following the h2jØ��ubh»)År∂��}r∑��(h(X	���OAuth1.0_hÀK
h2jØ��hQhÃh)}r∏��(UnameX���OAuth1.0hŒX"���http://tools.ietf.org/html/rfc5849rπ��h,]h-]h+]h/]h0]uhY]r∫��hbX���OAuth1.0rª��ÖÅrº��}rΩ��(h(U�h2j∂��ubaubhbX��� and ræ��ÖÅrø��}r¿��(h(X��� and h2jØ��ubh»)År¡��}r¬��(h(X	���OAuth2.0_hÀK
h2jØ��hQhÃh)}r√��(UnameX���OAuth2.0hŒX#���https://tools.ietf.org/html/rfc6749rƒ��h,]h-]h+]h/]h0]uhY]r≈��hbX���OAuth2.0r∆��ÖÅr«��}r»��(h(U�h2j¡��ubaubhbXd
�� specifications.
These two specification propose related but different mechanisms for generating and utilizing
access tokens.  Decision making fell along two axes: 1) what does an acces token represent,
and 2) how does a service provider validate an access token.  The main choices were, in order of
both increasing security and increasing complexity, are:r…��ÖÅr ��}rÀ��(h(Xd
�� specifications.
These two specification propose related but different mechanisms for generating and utilizing
access tokens.  Decision making fell along two axes: 1) what does an acces token represent,
and 2) how does a service provider validate an access token.  The main choices were, in order of
both increasing security and increasing complexity, are:h2jØ��ubeubh7)ÅrÃ��}rÕ��(h(U�h2hLhPh.hQhzh)}rŒ��(h;X
���*h,]h-]h+]h/]h0]uhWM8hXhhY]rœ��(h3)År–��}r—��(h(X
���Bearer tokensr“��h2jÃ��hPh.hQhh)}r”��(h+]h/]h-]h,]h0]uhWNhXhhY]r‘��hf)År’��}r÷��(h(j“��h2j–��hPh.hQhjh)}r◊��(h+]h/]h-]h,]h0]uhWM8hY]rÿ��hbX
���Bearer tokensrŸ��ÖÅr⁄��}r€��(h(j“��h2j’��ubaubaubh3)År‹��}r›��(h(X&���HMAC tokens with shared symmetric keysrfi��h2jÃ��hPh.hQhh)}rfl��(h+]h/]h-]h,]h0]uhWNhXhhY]r‡��hf)År·��}r‚��(h(jfi��h2j‹��hPh.hQhjh)}r„��(h+]h/]h-]h,]h0]uhWM9hY]r‰��hbX&���HMAC tokens with shared symmetric keysrÂ��ÖÅrÊ��}rÁ��(h(jfi��h2j·��ubaubaubh3)ÅrË��}rÈ��(h(X2���RSA-SHA1 tokens using RSA private/public keypairs
h2jÃ��hPh.hQhh)}rÍ��(h+]h/]h-]h,]h0]uhWNhXhhY]rÎ��hf)ÅrÏ��}rÌ��(h(X1���RSA-SHA1 tokens using RSA private/public keypairsrÓ��h2jË��hPh.hQhjh)}rÔ��(h+]h/]h-]h,]h0]uhWM:hY]r��hbX1���RSA-SHA1 tokens using RSA private/public keypairsrÒ��ÖÅrÚ��}rÛ��(h(jÓ��h2jÏ��ubaubaubeubhf)ÅrÙ��}rı��(h(XN���We ultimately decided to use the simpler Bearer Token approach outlined below:rˆ��h2hLhPh.hQhjh)}r˜��(h+]h/]h-]h,]h0]uhWM<hXhhY]r¯��hbXN���We ultimately decided to use the simpler Bearer Token approach outlined below:r˘��ÖÅr˙��}r˚��(h(jˆ��h2jÙ��ubaubhIj
��)År¸��}r˝��(h(X0���.. _OAuth1.0: http://tools.ietf.org/html/rfc5849j
��K
h2hLhPh.hQj
��h)}r˛��(hŒjπ��h,]rˇ��Uoauth1-0r���ah-]h+]h/]h0]r
��hauhWMKhXhhY]ubj
��)År��}r��(h(X1���.. _OAuth2.0: https://tools.ietf.org/html/rfc6749j
��K
h2hLhPh.hQj
��h)}r��(hŒjƒ��h,]r��Uoauth2-0r��ah-]h+]h/]h0]r��hauhWMMhXhhY]ubj
��)År��}r	��(h(X6���.. _Bearer tokens: https://tools.ietf.org/html/rfc6750j
��K
h2hLhPh.hQj
��h)}r
��(hŒX#���https://tools.ietf.org/html/rfc6750r��h,]r��U
bearer-tokensr
��ah-]h+]h/]h0]r��hauhWMOhXhhY]ubj
��)År��}r��(h(X?���.. _HMAC-SHA1: http://tools.ietf.org/html/rfc5849#section-3.4.2h2hLhPh.hQj
��h)}r��(hŒX0���http://tools.ietf.org/html/rfc5849#section-3.4.2h,]r��U	hmac-sha1r��ah-]h+]h/]h0]r��hauhWMQhXhhY]ubj
��)År��}r��(h(X>���.. _RSA-SHA1: http://tools.ietf.org/html/rfc5849#section-3.4.3h2hLhPh.hQj
��h)}r��(hŒX0���http://tools.ietf.org/html/rfc5849#section-3.4.3h,]r��Ursa-sha1r��ah-]h+]h/]h0]r��hauhWMShXhhY]ubj��)År��}r��(h(X���.. image:: images/auth_04.png
h2hLhPh.hQj��h)}r��(UuriX���design/images/auth_04.pngr��h,]h-]h+]h/]j��}r��U
*j��sh0]uhWMVhXhhY]ubhf)År ��}r!��(h(X°
��**Figure 6.** Scenarios for using OAuth access tokens in HTTP Authorization headers as
a mechanism to establish client identity and authorization.
The user authenticates with the DataONE Portal to establish their identity, and the portal
issues a client-specific token. For Bearer Tokens, the Portal issues
a signed, reusable access token that is sent to service providers and verified using an asymmetric public key.h2hLhPh.hQhjh)}r"��(h+]h/]h-]h,]h0]uhWMWhXhhY]r#��(j.��)År$��}r%��(h(X
���**Figure 6.**h)}r&��(h+]h/]h-]h,]h0]uh2j ��hY]r'��hbX	���Figure 6.r(��ÖÅr)��}r*��(h(U�h2j$��ubahQj6��ubhbXî
�� Scenarios for using OAuth access tokens in HTTP Authorization headers as
a mechanism to establish client identity and authorization.
The user authenticates with the DataONE Portal to establish their identity, and the portal
issues a client-specific token. For Bearer Tokens, the Portal issues
a signed, reusable access token that is sent to service providers and verified using an asymmetric public key.r+��ÖÅr,��}r-��(h(Xî
�� Scenarios for using OAuth access tokens in HTTP Authorization headers as
a mechanism to establish client identity and authorization.
The user authenticates with the DataONE Portal to establish their identity, and the portal
issues a client-specific token. For Bearer Tokens, the Portal issues
a signed, reusable access token that is sent to service providers and verified using an asymmetric public key.h2j ��ubeubj'��)År.��}r/��(h(X”��@startuml images/auth_04.png
title Detailed Access Token Authentication Scenarios
participant "KNB" as MN << MNode >>
participant "R Client" as R << Application >>
participant "Portal" as Portal <<CNode>>
participant "Web Client" as Web << Application >>
participant "CILogon" as CI
participant "Identity Provider" as IP

Web->CI: Select IdP
CI-->Web: IdP Redirect
Web->IP: Identity Verification
IP-->Web: CILogon Redirect
Web -> Portal: follow redirect to profile page

group Bearer Token Scenario
    Portal->R: copy access_token
    R->MN: get(access_token, pid)
    MN-->Portal: getPublicKey()
    MN<--Portal: public_key
    MN->MN: validateToken(access_token, public_key)
    R<-MN: data or NotAuthorized
end

@endumlh2hLhPh.hQj*��h)}r0��(jR
��jS
��h,]h-]h+]h/]h0]uhWMwhXhhY]r1��hbX”��@startuml images/auth_04.png
title Detailed Access Token Authentication Scenarios
participant "KNB" as MN << MNode >>
participant "R Client" as R << Application >>
participant "Portal" as Portal <<CNode>>
participant "Web Client" as Web << Application >>
participant "CILogon" as CI
participant "Identity Provider" as IP

Web->CI: Select IdP
CI-->Web: IdP Redirect
Web->IP: Identity Verification
IP-->Web: CILogon Redirect
Web -> Portal: follow redirect to profile page

group Bearer Token Scenario
    Portal->R: copy access_token
    R->MN: get(access_token, pid)
    MN-->Portal: getPublicKey()
    MN<--Portal: public_key
    MN->MN: validateToken(access_token, public_key)
    R<-MN: data or NotAuthorized
end

@endumlr2��ÖÅr3��}r4��(h(U�h2j.��ubaubhK)År5��}r6��(h(U�h2hLhPh.hQhRh)}r7��(h+]h/]h-]h,]r8��U,encoding-session-information-in-http-headersr9��ah0]r:��hauhWMyhXhhY]r;��(h[)År<��}r=��(h(X,���Encoding Session information in HTTP headersr>��h2j5��hPh.hQh_h)}r?��(h+]h/]h-]h,]h0]uhWMyhXhhY]r@��hbX,���Encoding Session information in HTTP headersrA��ÖÅrB��}rC��(h(j>��h2j<��ubaubhf)ÅrD��}rE��(h(Xy���When clients wish to use an authentication token, they will include the
token value in the Authorization request header::h2j5��hPh.hQhjh)}rF��(h+]h/]h-]h,]h0]uhWM{hXhhY]rG��hbXx���When clients wish to use an authentication token, they will include the
token value in the Authorization request header:rH��ÖÅrI��}rJ��(h(Xx���When clients wish to use an authentication token, they will include the
token value in the Authorization request header:h2jD��ubaubjM
��)ÅrK��}rL��(h(X#���Authorization: Bearer <token_value>h2j5��hPh.hQjP
��h)}rM��(jR
��jS
��h,]h-]h+]h/]h0]uhWM~hXhhY]rN��hbX#���Authorization: Bearer <token_value>rO��ÖÅrP��}rQ��(h(U�h2jK��ubaubhf)ÅrR��}rS��(h(XÌ���This is consistent with the OAuth 2 specification that states how Bearer tokens_
should be  transmitted to the service.
Service providers should inspect the request for
this token and use it when a client x509 certificate is not present.h2j5��hPh.hQhjh)}rT��(h+]h/]h-]h,]h0]uhWMÄhXhhY]rU��(hbXI���This is consistent with the OAuth 2 specification that states how Bearer rV��ÖÅrW��}rX��(h(XI���This is consistent with the OAuth 2 specification that states how Bearer h2jR��ubj≤
��)ÅrY��}rZ��(h(X���tokens_r[��h2jR��hPNhQj∂
��h)}r\��(h,]r]��Uid4r^��ah-]h+]h/]h0]UrefidUid3r_��uhWNhXhhY]r`��hbX���tokens_ra��ÖÅrb��}rc��(h(U�h2jY��ubaubhbXù���
should be  transmitted to the service.
Service providers should inspect the request for
this token and use it when a client x509 certificate is not present.rd��ÖÅre��}rf��(h(Xù���
should be  transmitted to the service.
Service providers should inspect the request for
this token and use it when a client x509 certificate is not present.h2jR��ubeubhf)Årg��}rh��(h(XÔ���When services wish to verify the JSON Web Token (JWT) , they should use the public
certificate of the token issuing service (i.e., the CN's public server certificate).
A utility is included in the d1_portal project with example code below.ri��h2j5��hPh.hQhjh)}rj��(h+]h/]h-]h,]h0]uhWMÖhXhhY]rk��hbXÔ���When services wish to verify the JSON Web Token (JWT) , they should use the public
certificate of the token issuing service (i.e., the CN's public server certificate).
A utility is included in the d1_portal project with example code below.rl��ÖÅrm��}rn��(h(ji��h2jg��ubaubj'��)Åro��}rp��(h(X
��Verify token::

// get the token
String token = request.getHeader("Authorization");
token = token.split(" ")[1];

// parse the JWT
SignedJWT signedJWT = SignedJWT.parse(token);

// verify the token using server's public key
JWSVerifier verifier = new RSASSAVerifier(publicKey);
boolean verified = signedJWT.verify(verifier);

// check payload for subject ("sub"), expiration ("exp"), etc...
String subject = signedJWT.getJWTClaimsSet().getSubject();
Date expDate = signedJWT.getJWTClaimsSet().getExpirationTime();h2j5��hPh.hQj*��h)}rq��(jR
��jS
��h,]h-]h+]h/]h0]uhWMôhXhhY]rr��hbX
��Verify token::

// get the token
String token = request.getHeader("Authorization");
token = token.split(" ")[1];

// parse the JWT
SignedJWT signedJWT = SignedJWT.parse(token);

// verify the token using server's public key
JWSVerifier verifier = new RSASSAVerifier(publicKey);
boolean verified = signedJWT.verify(verifier);

// check payload for subject ("sub"), expiration ("exp"), etc...
String subject = signedJWT.getJWTClaimsSet().getSubject();
Date expDate = signedJWT.getJWTClaimsSet().getExpirationTime();rs��ÖÅrt��}ru��(h(U�h2jo��ubaubeubeubhPh.hQhzh)}rv��(h;X
���*h,]h-]h+]h/]h0]uhWM>hXhhY]rw��hGaubhPNhQhh)}rx��(h+]h/]h-]h,]h0]uhWNhXhhY]ry��hDaubhY]rz��hAahQUdefinition_listr{��ubhPh.hQUdefinition_list_itemr|��h)}r}��(h+]h/]h-]h,]h0]uhWMIhY]r~��(cdocutils.nodes
term
r��)ÅrÄ��}rÅ��(h(X
���Bearer tokensr��h2hAhPh.hQUtermr��h)}r��(h+]h/]h-]h,]h0]uhWMIhY]r��hbX
���Bearer tokensrÜ��ÖÅrá��}rà��(h(jÇ��h2jÄ��ubaubh=eubhY]râ��h8ahQU
definitionrä��ubhY]rã��h4ahQhzubhY]rå��(hf)Årç��}ré��(h(X8��`Bearer tokens`_ are unique string values issued by an authentication server that show
that a client is authorized for access; anyone holding the bearer token can use it to gain
access to a service. Service providers validate the token via either a call to the central authorization
service or cryptographically using the public key that corresponds to the private key with which
the authentication service signed the token.
These tokens must be used with TLS, and care must be taken to not leak the tokens via e.g. logs,
client storage locations, or via MITM attacks.h2h4hPh.hQhjh)}rè��(h+]h/]h-]h,]h0]uhWM?hY]rê��(h»)Årë��}rí��(h(X���`Bearer tokens`_hÀK
h2jç��hQhÃh)}rì��(UnameX
���Bearer tokenshŒj��h,]h-]h+]h/]h0]uhY]rî��hbX
���Bearer tokensrï��ÖÅrñ��}ró��(h(U�h2jë��ubaubhbX(�� are unique string values issued by an authentication server that show
that a client is authorized for access; anyone holding the bearer token can use it to gain
access to a service. Service providers validate the token via either a call to the central authorization
service or cryptographically using the public key that corresponds to the private key with which
the authentication service signed the token.
These tokens must be used with TLS, and care must be taken to not leak the tokens via e.g. logs,
client storage locations, or via MITM attacks.rò��ÖÅrô��}rö��(h(X(�� are unique string values issued by an authentication server that show
that a client is authorized for access; anyone holding the bearer token can use it to gain
access to a service. Service providers validate the token via either a call to the central authorization
service or cryptographically using the public key that corresponds to the private key with which
the authentication service signed the token.
These tokens must be used with TLS, and care must be taken to not leak the tokens via e.g. logs,
client storage locations, or via MITM attacks.h2jç��ubeubj��)Årõ��}rú��(h(U�h)}rù��(h+]h/]h-]h,]h0]uh2h4hY]rû��h7)Årü��}r†��(h(U�h)}r°��(h;X
���*h,]h-]h+]h/]h0]uh2jõ��hY]r¢��(h3)År£��}r§��(h(XL���Pros: simple to implement on client, passed directly in Authorization headerr•��h)}r¶��(h+]h/]h-]h,]h0]uh2jü��hY]rß��hf)År®��}r©��(h(j•��h2j£��hPh.hQhjh)}r™��(h+]h/]h-]h,]h0]uhWMFhY]r´��hbXL���Pros: simple to implement on client, passed directly in Authorization headerr¨��ÖÅr≠��}rÆ��(h(j•��h2j®��ubaubahQhubh3)ÅrØ��}r∞��(h(Xû���Cons: Passed with every request, simple to capture, can use to steal session via replay attacks,
may require centralized validation of tokens, requires TLS.

h)}r±��(h+]h/]h-]h,]h0]uh2jü��hY]r≤��hf)År≥��}r¥��(h(Xú���Cons: Passed with every request, simple to capture, can use to steal session via replay attacks,
may require centralized validation of tokens, requires TLS.rµ��h2jØ��hPh.hQhjh)}r∂��(h+]h/]h-]h,]h0]uhWMGhY]r∑��hbXú���Cons: Passed with every request, simple to capture, can use to steal session via replay attacks,
may require centralized validation of tokens, requires TLS.r∏��ÖÅrπ��}r∫��(h(jµ��h2j≥��ubaubahQhubehQhzubahQj7��ubehQhubhY]rª��hf)Årº��}rΩ��(h(X���Unexpected indentation.h)}ræ��(h+]h/]h-]h,]h0]uh2h&hY]rø��hbX���Unexpected indentation.r¿��ÖÅr¡��}r¬��(h(U�h2jº��ubahQhjubahQUsystem_messager√��ubh%)Årƒ��}r≈��(h(U�h2j
��hPh.hQj√��h)}r∆��(h+]UlevelKh,]h-]Usourceh.h/]h0]UlineM¢UtypeUWARNINGr«��uhWM°hXhhY]r»��hf)År…��}r ��(h(X;���Bullet list ends without a blank line; unexpected unindent.h)}rÀ��(h+]h/]h-]h,]h0]uh2jƒ��hY]rÃ��hbX;���Bullet list ends without a blank line; unexpected unindent.rÕ��ÖÅrŒ��}rœ��(h(U�h2j…��ubahQhjubaubh%)År–��}r—��(h(U�h2j
��hPh.hQj√��h)}r“��(h+]UlevelKh,]h-]Usourceh.h/]h0]UlineM™Utypej«��uhWM©hXhhY]r”��hf)År‘��}r’��(h(X;���Bullet list ends without a blank line; unexpected unindent.h)}r÷��(h+]h/]h-]h,]h0]uh2j–��hY]r◊��hbX;���Bullet list ends without a blank line; unexpected unindent.rÿ��ÖÅrŸ��}r⁄��(h(U�h2j‘��ubahQhjubaubh%)År€��}r‹��(h(U�h2j
��hPh.hQj√��h)}r›��(h+]UlevelKh,]h-]Usourceh.h/]h0]UlineM±Utypej«��uhWM∞hXhhY]rfi��hf)Årfl��}r‡��(h(X;���Bullet list ends without a blank line; unexpected unindent.h)}r·��(h+]h/]h-]h,]h0]uh2j€��hY]r‚��hbX;���Bullet list ends without a blank line; unexpected unindent.r„��ÖÅr‰��}rÂ��(h(U�h2jfl��ubahQhjubaubeUcurrent_sourcerÊ��NU
decorationrÁ��NUautofootnote_startrË��K
Unameidsr��}r��(hj
��hj†��hh¶h	jp��h
j��hj��hj	
��h
j„
��hj≈
��hjì��hj��hj��hj��hj—
��hj›
��hj9��hj
��hjÀ��hj��hj
��hj���hj§��hj��hj◊
��hj¸��hhUh j
��uhY]r��hNah(U�Utransformerr��NU
footnote_refsrÌ��}rÓ��UrefnamesrÔ��}r��(X���rfc4510rÒ��]rÚ��h»)ÅrÛ��}rÙ��(h(jµ
��h)}rı��(UnameX���RFC4510h,]h-]h+]Urefnamerˆ��jÒ��h/]h0]uh2j´
��hY]r˜��hbX���RFC4510r¯��ÖÅr˘��}r˙��(h(U�h2jÛ��ubahQhÃubaX
���bearer tokens]r˚��jë��aX���rfc4514]r¸��(jñ
��j°
��eX���grouper]r˝��hÏaX���oauth1.0]r˛��j∂��aX���tokensrˇ��]r�	��h»)År
	��}r	��(h(j[��h)}r	��(Unamejˇ��h,]h-]h+]jˆ��jˇ��h/]h0]uh2jR��hY]r	��hbX���tokensr	��ÖÅr	��}r	��(h(U�h2j
	��ubahQhÃubaX���mace]r	��h˜aX���orcid]r		��h…aX���oauth2.0]r
	��j¡��auUsymbol_footnotesr	��]r	��Uautofootnote_refsr
	��]r	��Usymbol_footnote_refsr	��]r	��U	citationsr	��]r	��hXhUcurrent_liner	��NUtransform_messagesr	��]r	��(h%)År	��}r	��(h(U�h)}r	��(h+]UlevelKh,]r	��j∫
��ah-]r	��jπ
��aUsourceh.h/]h0]UlineKyUtypeh1uhY]r	��hf)År	��}r	��(h(U�h)}r	��(h+]h/]h-]h,]h0]uh2j	��hY]r	��hbX���Unknown target name: "rfc4510".r 	��ÖÅr!	��}r"	��(h(U�h2j	��ubahQhjubahQj√��ubh%)År#	��}r$	��(h(U�h)}r%	��(h+]UlevelKh,]r&	��j_��ah-]r'	��j^��aUsourceh.h/]h0]UlineMÄUtypeh1uhY]r(	��hf)År)	��}r*	��(h(U�h)}r+	��(h+]h/]h-]h,]h0]uh2j#	��hY]r,	��hbX���Unknown target name: "tokens".r-	��ÖÅr.	��}r/	��(h(U�h2j)	��ubahQhjubahQj√��ubh%)År0	��}r1	��(h(U�h)}r2	��(h+]UlevelK
h,]h-]Usourceh.h/]h0]UlineK~UtypeUINFOr3	��uhY]r4	��hf)År5	��}r6	��(h(U�h)}r7	��(h+]h/]h-]h,]h0]uh2j0	��hY]r8	��hbX<���Hyperlink target "edupersonprincipalname" is not referenced.r9	��ÖÅr:	��}r;	��(h(U�h2j5	��ubahQhjubahQj√��ubh%)År<	��}r=	��(h(U�h)}r>	��(h+]UlevelK
h,]h-]Usourceh.h/]h0]UlineKÄUtypej3	��uhY]r?	��hf)År@	��}rA	��(h(U�h)}rB	��(h+]h/]h-]h,]h0]uh2j<	��hY]rC	��hbX<���Hyperlink target "teragridprincipalnames" is not referenced.rD	��ÖÅrE	��}rF	��(h(U�h2j@	��ubahQhjubahQj√��ubh%)ÅrG	��}rH	��(h(U�h)}rI	��(h+]UlevelK
h,]h-]Usourceh.h/]h0]UlineKÇUtypej3	��uhY]rJ	��hf)ÅrK	��}rL	��(h(U�h)}rM	��(h+]h/]h-]h,]h0]uh2jG	��hY]rN	��hbX*���Hyperlink target "foaf" is not referenced.rO	��ÖÅrP	��}rQ	��(h(U�h2jK	��ubahQhjubahQj√��ubh%)ÅrR	��}rS	��(h(U�h)}rT	��(h+]UlevelK
h,]h-]Usourceh.h/]h0]UlineKÑUtypej3	��uhY]rU	��hf)ÅrV	��}rW	��(h(U�h)}rX	��(h+]h/]h-]h,]h0]uh2jR	��hY]rY	��hbX,���Hyperlink target "rc4510" is not referenced.rZ	��ÖÅr[	��}r\	��(h(U�h2jV	��ubahQhjubahQj√��ubh%)År]	��}r^	��(h(U�h)}r_	��(h+]UlevelK
h,]h-]Usourceh.h/]h0]UlineMQUtypej3	��uhY]r`	��hf)Åra	��}rb	��(h(U�h)}rc	��(h+]h/]h-]h,]h0]uh2j]	��hY]rd	��hbX/���Hyperlink target "hmac-sha1" is not referenced.re	��ÖÅrf	��}rg	��(h(U�h2ja	��ubahQhjubahQj√��ubh%)Årh	��}ri	��(h(U�h)}rj	��(h+]UlevelK
h,]h-]Usourceh.h/]h0]UlineMSUtypej3	��uhY]rk	��hf)Årl	��}rm	��(h(U�h)}rn	��(h+]h/]h-]h,]h0]uh2jh	��hY]ro	��hbX.���Hyperlink target "rsa-sha1" is not referenced.rp	��ÖÅrq	��}rr	��(h(U�h2jl	��ubahQhjubahQj√��ubeUreporterrs	��NUid_startrt	��KU
autofootnotesru	��]rv	��U
citation_refsrw	��}rx	��Uindirect_targetsry	��]rz	��Usettingsr{	��(cdocutils.frontend
Values
r|	��or}	��}r~	��(Ufootnote_backlinksr	��K
Urecord_dependenciesrÄ	��NUrfc_base_urlrÅ	��Uhttps://tools.ietf.org/html/rÇ	��U	tracebackrÉ	��àUpep_referencesrÑ	��NUstrip_commentsrÖ	��NU
toc_backlinksrÜ	��Uentryrá	��U
language_coderà	��Uenrâ	��U	datestamprä	��NUreport_levelrã	��KU_destinationrå	��NU
halt_levelrç	��KU
strip_classesré	��Nh_NUerror_encoding_error_handlerrè	��Ubackslashreplacerê	��Udebugrë	��NUembed_stylesheetrí	��âUoutput_encoding_error_handlerrì	��Ustrictrî	��U
sectnum_xformrï	��K
Udump_transformsrñ	��NU
docinfo_xformró	��K
Uwarning_streamrò	��NUpep_file_url_templaterô	��Upep-%04drö	��Uexit_status_levelrõ	��KUconfigrú	��NUstrict_visitorrù	��NUcloak_email_addressesrû	��àUtrim_footnote_reference_spacerü	��âUenvr†	��NUdump_pseudo_xmlr°	��NUexpose_internalsr¢	��NUsectsubtitle_xformr£	��âUsource_linkr§	��NUrfc_referencesr•	��NUoutput_encodingr¶	��Uutf-8rß	��U
source_urlr®	��NUinput_encodingr©	��U	utf-8-sigr™	��U_disable_configr´	��NU	id_prefixr¨	��U�U	tab_widthr≠	��KUerror_encodingrÆ	��UUTF-8rØ	��U_sourcer∞	��h.Ugettext_compactr±	��àU	generatorr≤	��NUdump_internalsr≥	��NUsmart_quotesr¥	��âUpep_base_urlrµ	��U https://www.python.org/dev/peps/r∂	��Usyntax_highlightr∑	��Ulongr∏	��Uinput_encoding_error_handlerrπ	��jî	��Uauto_id_prefixr∫	��Uidrª	��Udoctitle_xformrº	��âUstrip_elements_with_classesrΩ	��NU
_config_filesræ	��]Ufile_insertion_enabledrø	��àUraw_enabledr¿	��K
U
dump_settingsr¡	��NubUsymbol_footnote_startr¬	��K�Uidsr√	��}rƒ	��(j„
��jfl
��hUhNj��j��j9��j5��j∫
��j	��j��j
��j��j«
��j	
��j
��j^��jY��j
��j��jπ
��j≥
��j_��j#	��j
��j
��j��j��j��j��j≈
��j¡
��j—
��jÕ
��j¸��j¯��j›
��jŸ
��j��j��jÀ��j«��j
��j
��j§��j†��j���j¸��jì��hLj†��jú��jp��jl��j◊
��j”
��j
��j
��h¶h¢j��j��uUsubstitution_namesr≈	��}r∆	��hQhXh)}r«	��(h+]h,]h-]Usourceh.h/]h0]uU	footnotesr»	��]r…	��Urefidsr 	��}rÀ	��ub.