Authentication and Authorization Architecture for AstroGrid and the Virtual Observatory

Although the bulk of the data useful to the Virtual Observatory are in the public domain and have uniform, read-only access from archives, there are several important cases where appropriate access varies from user to user. We outline these cases and list the desirable feature of an access-control system to cover them. AstroGrid is building such a system and we describe its architecture: X.500 names and X.509 certificates for user identity; a Public Key Infrastructure for authentication of identity; and the Community Privilege Service for sharing authorization information.