Thredd Secure Framework

Thredd's Secure Framework is the combination of several components which enables clients to securely access Thredd's resources over mTLS (Mutual Transport Level Security). Thredd Portal sits at the centre of this, enabling Admins to manage their organisation's applications, users, and credentials to access Thredd services through a single user interface and dashboard.

Thredd supports industry standards for authentication, identity and access management, and secure network and API-level connectivity.

Key features

Identity and Access Management through Thredd Portal

• Standards-based authentication — support for OpenID Connect (OIDC) and SAML.
• Single-Sign On (SSO), self-service onboarding, and token lifecycle management.
• Secure Access Control — role-based access (RBAC) and user management.

Connectivity Services

• Secure network and API-level connectivity via VPN, TLS and mTLS.
• Certificate lifecycle management — request, revoke and renew certificates issued by Thredd's Certificate Authority through Thredd Portal.
• mTLS Termination for mTLS connections in an EHI mTLS setup.

Developer Tooling

• Securely access Thredd REST APIs and API Hub.
• Test connectivity to Thredd REST APIs and API Hub using the Postman Collection in a UAT environment.

Identity and Access Management through Thredd Portal

Thredd provides a Software as a Service (SaaS) capability that acts as the Identity Provider (IDP) to authenticate user access to Thredd's interfaces through logging in to Thredd Portal. It also acts as an OAuth OpenID Provider (OP) for the registration and management of customer applications, generation and validation of access tokens, and for the enforcement of access control policies.

Thredd supports using a Client Secret (which requires an access token from Thredd) for Client Authentication when connecting to the REST APIs.

Thredd Certificate Authority through Thredd Portal

Thredd adopts a self-service approach that enables Admin users to independently request and manage certificates for their applications from Thredd's Certificate Authority (CA) through Thredd Portal.

Client applications require a transport certificate to connect to services, depending on the configuration you choose. These are required for mTLS connections for establishing connections between resources.

Thredd Application	Certificates Required
REST API over mTLS	Transport Certificate for the mTLS connection, which you obtain from Thredd Portal.
SOAP API	Transport Certificate, which you obtain from Thredd.
External Host Interface (EHI) over mTLS	Server Certificate (which you obtain separately), Thredd Trust Chain (that you download from Thredd), and a Transport Certificate (which Thredd presents).
Thredd Portal	Certificates that are pre-installed by Thredd.