GA4GH Passport

The core of the Passport is a collection of Visas—digitally signed JSON Web Tokens (JWTs) that assert a user's identity, institutional affiliation, and specific data access permissions. Each Visa is a verifiable claim, such as 'is a bona fide researcher' or 'has completed bioethics training,' issued by a trusted Passport Visa Issuer. These tokens are embedded in the standard OpenID Connect id_token or returned from the /userinfo endpoint, allowing downstream Resource Servers to parse and enforce access policies without manual intervention.

The Passport standard relies on a Public Key Infrastructure (PKI) to establish a chain of trust. Visa Issuers sign each token with their private key, and Resource Servers validate the signature against a publicly available JSON Web Key Set (JWKS). This decentralized trust model eliminates the need for a central authority. The specification defines the ga4gh_passport_v1 claim within a standard JWT, containing an array of Passport Visa Objects that can be independently verified, ensuring non-repudiation and integrity of access claims.

The Passport is a core component of the broader GA4GH Authentication and Authorization Infrastructure (AAI). It functions as the authorization layer on top of the OpenID Connect authentication protocol. A researcher authenticates with their home institution (the Broker), which issues a Passport containing Visas. When querying a federated data resource, the Passport is presented to the Passport Clearinghouse, a centralized service that validates tokens, resolves identities, and distributes the verified claims to participating nodes, enabling a single sign-on experience across the global genomics network.

The specification defines a taxonomy of Visa types to encode common access conditions:

• AffiliationAndRole: Asserts institutional membership and a specific role (e.g., 'faculty', 'postdoc').
• AcceptedTermsAndPolicies: Proves a user has agreed to a specific data use policy or code of conduct.
• ResearcherStatus: Encodes a binary claim of being a bona fide researcher.
• ControlledAccessGrants: Links a user to a specific dataset they are authorized to access, often referencing a Data Access Committee (DAC) approval.
• LinkedIdentities: Binds multiple external identities (e.g., ORCID, eRA Commons) to a single Passport identity.

By embedding structured, verifiable claims directly into the authentication flow, the Passport enables fully automated authorization decisions. A Policy Enforcement Point (PEP) at a data repository can parse the Passport's Visas and evaluate them against a Policy Decision Point (PDP) using a rules engine. For example, a rule might state: 'Grant access to Dataset X if a valid ControlledAccessGrants Visa for Dataset X is present AND an AcceptedTermsAndPolicies Visa for the GRU data use ontology is present.' This eliminates manual email-based access requests and accelerates cross-institutional research.

The Passport Clearinghouse is a centralized or federated service that acts as a trust broker. Its API, defined by the standard, accepts a Passport JWT, validates all embedded Visas against their respective issuers' JWKS endpoints, and returns a standardized, flat list of verified claims. This offloads complex token validation from individual Resource Servers. The Clearinghouse can also perform claim aggregation, merging Visas from multiple issuers into a single, comprehensive authorization profile for the researcher, simplifying downstream policy evaluation.