IVOA Recommendation: IVOA Single-Sign-On Profile: Authentication   Mechanisms Version 1.01
  Approved client-server authentication mechanisms are described for the IVOA single-sign-on profile: digital signatures (for SOAP services); TLS with passwords (for user sign-on points); TLS with client certificates (for everything else). Normative rules are given for the implementation of these mechanisms, mainly by reference to pre-existing standards. 
Guy Rixon, Matthew Graham, Grid and Web Services Working Group
astro-ph.IM