Digital Library Project Assumptions
Each institution has its own certificate authority (CA). Thus, the "Issuer" field in the certificate is sufficient to identify the institution.
The institution must have a directory server which, given some information from the certificate, the publisher can query for user attributes and determine eligibility for the service.
The full authentication and authorization process is performed infrequently (e.g., once per "session") so that the transaction cost need not be minimized.