Security

• User sends LSID ref and credentials to the Access Point
• Access Point returns data and metadata or denies access as follows:
  1. the credentials are passed to a User Directory
  2. the User Directory passes the corresponding user to the Authorization Authority
  3. the Authorization Authority returns the user attributes in the form of a (possibly signed) SAML assertion
  4. this assertion, together with the lsid and its corresponding metadata are passed to the Policy Enforcement Point (PEP)
  5. the PEP uses these three inputs to form an XACML request that is passed to a Policy Decision Point (PDP) that is preloaded with an XACML Policy Set.
  6. the PDP evaluates the request against its policy set and returns an XACML response to the PEP
  7. the PEP decodes the response and either allows data/metadata to be returned to the user or denies access.