Construct cross-domain authentication and authorization in CNGI networks

This paper presents a novel scheme about cross- domain authentication and authorization middleware technology based on SAML (security assertion markup language) and XACML (extensible access control markup language). The middleware was constructed in CNGI (China next generation Internet) networks to demonstrate the advantage of unified infrastructure. It was built through integration with IdP (identity provider), SP (service provider) and DT (DigitalTrust) software products. Not only are the brief architecture and process of the middleware described in the paper, but also many useful experiences are summarized and suggestions are shared by us, the actual builders. Consequently, one kind of identity and privilege exchange mechanism was put into practical application. The unified management and deployment model would be a good example for consideration by future developers.