Exactly how is a user authenticated?
To be authenticated by DACS at a particular jurisdiction, a user must already be known to that jurisdiction; that is, the jurisdiction must have previously established some way of confirming the user’s identity, such as by providing the user with a username, secret password, and the name of the jurisdiction. Information provided by a user to establish his identity is directed to the DACS authentication web service at that jurisdiction (the user might select the jurisdiction from a menu). The DACS authentication service then invokes an authentication module (a DACS web service configured at the jurisdiction), forwarding it the information provided by the user. In the general case, a simple XML-based protocol is used between the DACS authentication service and an authentication module. The authentication module tells DACS whether or not the user has been successfully authenticated and it provides DACS with a name that identifies the user within the jurisdiction, perhaps an account name o
