Principals and accounts
What a principal is, how a person's account differs from a service or agent, and what an account holds.
On this page
A principal is anything that can be authenticated by TDACorp Identity. Every sign-in, every token and every permission decision is about one principal. The word is deliberately wider than "user", because people are not the only things that sign in.
The kinds of principal#
| Kind | What it is | Signs in with |
|---|---|---|
| Person | A human with a TDACorp account. | A passkey, a password, an emailed link or a linked account, plus any second step. |
| Service | A non-human account that belongs to an organization, for a backend job or integration. | Client credentials, and tokens issued from them. |
| Workload | A deployed program identified by where it runs. | In development: the kind exists, and signing in as one is not available yet. |
| Agent | A non-human actor that works for a person and has its own limits. | In development. Tokens that name the person it acts for. The owner can list and revoke their agents from the account. See Delegation and token exchange. |
The rest of this page is about the first kind, because it is the one a person meets. How services authenticate is covered in Service to service.
What a principal is called#
Each principal has one identifier, called the subject in OpenID Connect and carried in tokens as sub. It is opaque: it is not an email address and it does not change when the address does. The platform publishes two subject types, public and pairwise. Most applications get public, so the same person has the same subject in each of them. A third-party application registered as pairwise instead sees a different random subject for each sector identifier it was registered with, in its ID token, userinfo response and back-channel logout token. Two applications with the same sector share the value, and different sectors never do. First-party applications are always public.
An application should store sub, not the email address, to recognise a returning person. See Log users in.
What a person's account holds#
An account is the principal plus everything attached to it. You manage each of these in your account area; see Your account.
- A profile. A display name, and optionally a username, a picture, a language and a time zone. An application only sees these when you allow the
profilescope. See Scopes and consent. A saved language that identity supports also sets the language of its pages and emails; see Languages. - Email addresses. One is your primary address. An address that has been verified can belong to only one account, so a verified address always leads to a single person.
- Sign-in methods. A password (every person's account has one, except an account an organization manages), and optionally passkeys, an authenticator app, recovery codes and linked accounts. See Authentication methods.
- Memberships. The organizations you belong to. See Memberships and invitations.
- Sessions and devices. Where you are signed in and which browsers the account has seen. See Sessions and Trusted devices.
- Agents. Agents you own are listed under Agents acting for you, with the organization each works in and whether it may pass on its authority. Revoke agent stops one at once. See Delegation and token exchange.
- Consents. The applications you have allowed, and what each may see. See Consent.
Account status#
A principal is always in one of four states.
| Status | Meaning |
|---|---|
| Active | Can sign in and use tokens. |
| Suspended | Cannot sign in. Suspending an account ends its sessions and its refresh tokens, and revokes its personal access tokens. |
| Deactivated | Closed. Every session and token is revoked and the account cannot sign in again. |
| Erased | The personal data has been removed. |
Closing an account does not erase its data at once. The page Export and delete your data says what is kept, for how long, and how to ask for it back as a file.
Note
Suspension and closure take effect on the next request, not at the next sign-in. A session that was open when the status changed stops working, and applications that registered for back-channel logout are told. See Sessions.
Account, organization and application are different things#
- Your account is yours. It does not belong to an organization.
- An organization is a group your account can join. It can set rules for how its members sign in. See Organizations.
- An application is software that asks identity to sign you in. It receives tokens, never your password or your passkey.
An organization can also manage an account, for example one created through its single sign-on or directory sync. The account area then says so in a banner, and the organization's administrators, not you, control its sign-in methods, access tokens and membership. Pages that would change those answer Your organization manages this account, so this is not available here. Ask your organization’s administrator. See Single sign-on and managed accounts.
Keeping these apart is what lets one account work across many products and many organizations.