1. Gateway Node Security Block Diagram ESG Gateway Node Confluence Server OpenID Filter Authz Service Callout Authorization Service (SSL) F-TDS OpenID Filter SSL AuthN Authz Service Callout Local AuthZ LAS OpenID Filter SSL AuthN Local AuthZ (Attribute Callout) Attribute Service (SSL)

2. Data Node Security Block Diagram ESG Data Node F-TDS OpenID Filter SSL AuthN Authz Service Callout Local AuthZ LAS OpenID Filter SSL AuthN Local AuthZ (Attribute Callout)

3. Request for Top Level Categories Confluence Server ESG Gateway Node Client wants to see all the top level categories available. LAS Data Node 1 F-TDS LAS Data Node 2 F-TDS LASF-TDS Product Requests Ajax Requests Client fires an Ajax request to the confluence server. (OpenID) Confluence server collects category information from all LASes in the system. (SSL) Confluence server returns combined results as one big JSON object. (SSL)

4. Request for the Grid of a Variable Confluence Server ESG Gateway Node Client needs the grid of a particular variable. LAS Data Node 1 F-TDS LAS Data Node 2 F-TDS LASF-TDS Product Requests Ajax Requests Client fires an Ajax request to the confluence server. (OpenID) Confluence server requests the info from the remote LAS. This avoids cross-site scripting problems. (SSL) Confluence server returns the requested grid JSON object. (SSL)

5. Request a product from a remote LAS: Confluence Server ESG Gateway Node User wants to see plot of one data variable. LAS Data Node 1 F-TDS LAS Data Node 2 F-TDS LAS F-TDS Product Requests Ajax Requests Client fires an LAS Product Request to the confluence server (OpenID). The confluence server returns the product to the client. (SSL) Confluence Server directs the product request to the LAS server that holds the data. (SSL) The remote LAS produces the product (including any analysis via F- TDS) and returns it to the confluence server. (SSL AuthN, Data http)

6. Difference of two varaibles, two data nodes: Confluence Server ESG Gateway Node Use wants to compare two variables from different data nodes. LAS Data Node 1 F-TDS LAS Data Node 2 F-TDS LAS F-TDS Product Requests OPeNDAP Requests Client fires an LAS Product Request to the confluence server. (OpenID) Confluence Server forwards the product request to local LAS. (SSL) Gateway LAS gets F-TDS URLs from remote LASes (SSL). URL resolution Gateway LAS gets data (including regridding) from remote F-TDSes. (SSL for AuthN, data on http) Gateway LAS makes product and returns it to the client. (SSL. Product access required OpenID)