Authorization with multiple Virtual Organizations

In the grid world, users expect to be able to log into a grid-enabled machine without the need of having a personal account on the machine itself. To this end, users have organized themselves into Virtual Organizations (VOs) and access to the machines is (excepting differences in local policy, like for example the banning of a specific user) generally granted on the bases of VO membership. Up to now, users who are members of more than a Virtual Organization (VO) (or different subgroups of a single VO) have had no way to specify this while logging into the grid. This paper describes a possible solution to this problem.