Glossary

Terms are in alphabetical order. A standard is named with its number where the specification or the code cites it.

AAL (authenticator assurance level). A number from 1 to 3 for how strongly a sign-in proved identity, following NIST SP 800-63B; step-up raises it.

Access token. A signed token an application presents to an API; identity issues it as an at+jwt (RFC 9068) for one audience.

Authentication. Proving who a person is.

Authorization. Deciding what an already identified person may do; see Authorization.

Authorization code. A single-use value, valid for 60 seconds, that an application exchanges at the token endpoint for tokens.

Binding. An assignment of a role to a person in an organization, which can expire.

Client. An application or service registered with identity so that it may sign people in or call APIs; the OAuth term for what this book also calls an application.

Client credentials. The grant a service uses to get a token as itself, with no person present (RFC 6749).

Connection. A single sign-on link between an organization and its own identity provider, over SAML or OpenID Connect, that lets its members sign in with their company account. Behind the flag tenant_connections, OFF by default.

Consent. A person's approval of the scopes a third-party application asks for.

DPoP (Demonstrating Proof of Possession). A way to bind a token to a key the application holds, so a stolen token is useless without the key (RFC 9449).

First party / third party. A first-party client is one TDACorp ships; every other client is third party and shows a consent screen.

Grant. A single permission given to a person in an organization, which can expire.

ID token. A signed token that tells an application who signed in and how (OpenID Connect).

Issuer. The address that identifies identity in tokens and in its discovery document.

JWT. JSON Web Token, the signed format of the ID token and the access token.

Membership. The link between a person and an organization; it is active, suspended or removed.

OAuth 2.0. The framework applications use to be authorized by identity (RFC 6749).

OpenID Connect (OIDC). The sign-in layer on top of OAuth 2.0 that identity implements; see the OIDC reference.

Organization. The boundary a person belongs to; the code calls it a tenant. See Organizations.

Pairwise identifier. A sub that is different for each application sector, so two applications cannot match the same person by it. An application registered for it sees one in the ID token and the userinfo response; an access token always carries the real sub.

PAR (Pushed Authorization Request). A way for an application to send the sign-in request directly to identity and get a short reference back, instead of putting the details in the browser (RFC 9126). Required here.

Passkey. A sign-in credential stored on a device or in a password manager that you unlock with your device lock instead of typing a secret; it follows WebAuthn. See Passkeys.

PDP and PEP. The policy decision point is identity's authorization API, which decides; the policy enforcement point is the code in a product that asks and enforces the answer.

Permission. One action a product defines, named <namespace>.<action>.

PKCE (Proof Key for Code Exchange). A check that the application exchanging a code is the one that started the sign-in; identity accepts only the S256 method (RFC 7636).

Principal. Anything that can sign in: a person, a service account, a workload or an agent.

Recovery code. A single-use code, issued in a batch, that is a backup for an authenticator app.

Refresh token. A token that lets an application obtain a new access token without another sign-in; identity rotates it on each use.

Relying party. An application that relies on identity to sign people in; in WebAuthn, the site a passkey belongs to, identified by its relying party id.

Role. A named, versioned bundle of permissions.

Scope. A word in a request that names what an application asks for; see Scopes and consent.

Session. Identity's server-side record that a browser is signed in; see Sessions and tokens.

Step-up. Asking a signed-in person to prove themselves again to raise the assurance level for a limited time.

Tenant. The code's word for an organization.

Token. A signed value an application receives after sign-in: an ID token, an access token or a refresh token.

TOTP (authenticator app code). A six-digit code from an authenticator app, used as a second step.

WebAuthn. The W3C standard behind passkeys.