Implementing an authorisation architecture in the EUDAT services federation

This paper describes the requirements and architecture of authorisation in a multi-disciplinary, multi-site, multi-stakeholder infrastructure which is using federated identity management. Stakeholders include administrators of sites, infrastructure, services, as well as data owners and community representatives. In order to be able to express and combine policies, we have based the authorisation infrastructure on XACML.