MojoAuth GlossaryIdentity and security, in plain words
Plain definitions of identity, authentication and security terms: passkeys, OIDC, SAML, MFA, zero trust and more, with examples and related terms.
Start with a theme
JWT18
Claims and parts of a JSON Web Token.
Audience (aud) Claim ExplainedContent type (cty)Critical (crit) Claim Explainedexp Claimiat ClaimIssuer (iss)JOSEJWKSJWT ID (jti)Key ID (kid)+8
OpenID Connect16
Sign-in on top of OAuth: endpoints, claims, flows.
Access TokenAuthorization Endpoint ExplainedClaimsDiscovery Endpoint (.well-known) ExplainedEndpointsImplicit FlowJWKS Endpoint (JSON Web Key Set)OpenID Provider (OP) ExplainedRedirect URLRP+6
OAuth 2.011
Delegated authorization: scopes, tokens, grants.
Access Token LifetimeClient ID in OAuth and OIDCClient SecretDelegated Authorization with OAuth ExplainedScopesRefresh Token in SSOToken AuthenticationToken AuthenticationToken ExpirationToken Introspection+1
SAML15
Enterprise single sign-on with XML assertions.
ACS in SSOIdentity AssertionACS URLAssertionAttributeAudience Restriction ExplainedEndpointEntity IDIdentity Provider (IdP) ExplainedMetadata+5
SSO and federation9
One sign-in across apps and domains.
Cross-Domain SSODomain FederationFederation TrustIdentity Provider SLAsIdP DiscoveryIdentity Provider (IdP) ExplainedSSO CookieSSO PortalWeb SSO
All terms, A to Z
A
- Acceptable Use Agreement (AUA)An acceptable use agreement (AUA) is a document that users sign or accept before they get access to an organization's computers, networks, accounts or data. It states what they may and may
- Access Control List (ACL)An access control list (ACL) is a list attached to a resource, such as a file, folder, network interface or API object, that names which users, groups or systems may access it and which…
- Access Management (AM)Access management (AM) is a set of tools and processes used to control and manage access to an organization's resources, such as data, applications, and other assets. AM is typically part
- Access Token LifetimeAccess token lifetime is how long an OAuth 2.0 or OpenID Connect access token stays valid after the authorization server issues it. The server reports it in the token response as expiresin,
- ACS in SSOIn SSO, the Assertion Consumer Service (ACS) is the endpoint on a SAML service provider (SP) that receives the identity provider's (IdP's) authentication response, validates the signed…
- AgentAn agent in cybersecurity is a small program installed on a device, such as a laptop, server, phone or container host, that runs continuously in the background to collect security data and…
- AnonymityAnonymity is the state in which an observer cannot identify a person within a group of other people, called the anonymity set. RFC 6973, the IETF's privacy guidance for protocol designers,
- API Access ManagementAPI access management is the practice of controlling and managing access to application programming interfaces (APIs). APIs are sets of routines, protocols, and tools for building software
- Application LayerThe application layer is layer 7, the top layer of the OSI reference model, where network protocols that applications use directly live: HTTP, DNS, SMTP, SSH, FTP and SFTP. It defines the
- Attribute Mapping in SSOAttribute mapping is the configuration that tells an application which field in an identity provider's login response fills which field in its own user record. When a user signs in through
- Audit Trail in SSOAn audit trail is a chronological, tamper-evident record of security-relevant events that shows who did what, when, from where, and with what result. In single sign-on (SSO) and identity
B
- Breach DetectionBreach detection is the practice of discovering that an attacker has already gotten past your defenses and is inside a network, account or application, so you can contain them before data…
- Browser ExploitA browser exploit is code that abuses a vulnerability in a web browser, its rendering or JavaScript engine, or an extension, to do something the browser should block: run code on the…
C
- Client ID in OAuth and OIDCA client ID is the public identifier an authorization server assigns to an application when it is registered for OAuth 2.0 or OpenID Connect (OIDC). The application sends it as the clientid
- Client SecretA client secret is a confidential string that an OAuth 2.0 or OpenID Connect (OIDC) authorization server issues to a registered application, together with its public client ID. The
- Cross-Domain SSOCross-domain SSO (cross-domain single sign-on) lets a user sign in once and stay signed in across websites on different registrable domains, such as shop-example.com and…
- Custom Claims in TokensCustom claims are application-specific name/value pairs that an identity provider adds to a token alongside the standard claims. In a JSON Web Token (JWT), RFC 7519 allows two kinds: public
- Cybersecurity for ExecutivesExecutive cybersecurity is the part of cybersecurity that senior leaders own: deciding how much cyber risk the organization accepts, funding and staffing the program, overseeing incident…
D
- Data Privacy PolicyA data privacy policy is a public statement in which an organization explains what personal data it collects, why, how it uses and shares it, how long it keeps it, and what rights people…
- Deep Packet Inspection (DPI) ExplainedDeep packet inspection (DPI) is a network security technique that examines the payload of each packet, not just its headers, to identify the application, protocol and content in the…
- DEK (Data Encryption Key)A data encryption key (DEK) is the symmetric key that actually encrypts and decrypts your data, such as a file, a database column or a disk volume. DEK stands for "data encryption key." It
- Delegated Authorization with OAuth ExplainedDelegated authorization is letting one application act on a user's behalf with limited, revocable permission, without ever receiving the user's password. OAuth 2.0 (RFC 6749) is the
- Device AuthenticationDevice authentication is the process of proving the identity of a device, such as a laptop, phone, server or IoT sensor, before it may connect to a network or call a service. Strong device
- Domain FederationDomain federation is a trust arrangement in which an application or identity service hands authentication for every user of an email domain, such as example.com, to that organization's own…
I
- Identity AssertionAn identity assertion is a signed statement from an identity provider (IdP) telling an application who a user is and how they authenticated. It carries an issuer, a subject identifier, an
- Identity BrokeringIdentity brokering is a federation pattern in which one service, the identity broker, sits between an application and several external identity providers. The application trusts only the
- Identity Data in SSOIdentity data is the set of attributes that identify a person or system account and describe how it may sign in: identifiers such as a user ID, email or phone number, profile attributes…
- Identity Data Privacy in SSO SystemsIdentity data privacy is the protection of the personal information that identity systems collect, store and share: names, email addresses, phone numbers, user identifiers, attributes and…
- Identity Management Performance MetricsIdentity management performance metrics are measurements that show how well an identity system signs users in, keeps accounts secure and manages access over time. The core set covers
- Identity Management Policies and ProceduresIdentity management policies and procedures are the documented rules and step-by-step processes an organization uses to create, verify, change and remove user identities and their access.
- Identity Management Solution Performance MetricsIdentity management solution performance metrics are the measurements used to judge how well an identity product, such as a Single Sign-On (SSO) identity provider, does its job. They cover
- Identity OperationsIdentity operations (IdentityOps) is the day-to-day work of running an identity system after it is deployed: creating and removing accounts, granting and reviewing access, handling logins,…
- Identity Provider SLAsAn identity provider service level agreement (IdP SLA) is the contract that states how available, fast and supported an identity provider must be, and what the customer gets if it falls…
- Identity ProvisioningIdentity provisioning automation is the practice of creating, updating and removing user accounts in connected applications automatically, driven by events in a source of truth such as an…
- Identity RepositoryAn identity repository is the central store that holds user identity records: usernames, identifiers, profile attributes, group memberships and credential data such as password hashes.
- IdP DiscoveryIdentity provider discovery (IdP discovery) is the step in federated sign-in where an application works out which identity provider should authenticate a user before redirecting them there.
- Intrusion Detection ToolsIntrusion detection tools are software or hardware that monitor network traffic or host activity for signs of attacks and policy violations, and raise alerts when they find them. An
- IT Security Controls Assessment ExplainedA security controls assessment is the testing or evaluation of an organization's security controls to determine whether they are implemented correctly, operating as intended, and producing…
J
- JWT Audience (aud) Claim ExplainedThe JWT audience (aud) claim identifies the recipients a JSON Web Token is intended for, such as an API's identifier https://api.example.com or an OAuth client ID. Defined in RFC 7519
- JWT Content type (cty)In the JSON Web Token (JWT) standard, the "cty" (content type) claim is a string that indicates the media type of the JWT. This can be used to provide some basic information about the
- JWT Critical (crit) Claim ExplainedThe JWT crit (critical) value is a header parameter, not a payload claim: an array listing extension header parameters that the recipient must understand and process, or else reject the…
- JWT exp ClaimThe JWT exp (expiration time) claim is the time after which a JSON Web Token must not be accepted. RFC 7519 §4.1.4 defines it as a NumericDate: the number of seconds since
- JWT iat ClaimThe JWT iat (issued at) claim is a registered claim, defined in RFC 7519 §4.1.6, that records the time the JSON Web Token was issued. Its value is a NumericDate: the number of seconds since
- JWT Issuer (iss)The JWT issuer (iss) claim is a registered claim, defined in RFC 7519 §4.1.1, that identifies the principal that issued the JSON Web Token. Its value is a case-sensitive string, usually the
- JWT JOSEJOSE (JavaScript Object Signing and Encryption) is a suite of standards and libraries for representing and processing JSON-based security tokens, such as JSON Web Tokens (JWTs) and JSON Web…
- JWT JWKSJWKS (JSON Web Key Set) is a JSON data structure that contains a set of public keys that are used to verify the digital signatures of JSON Web Tokens (JWTs). JWKS is used in the JOSE
- JWT JWT ID (jti)In the JSON Web Token (JWT) standard, the "jti" (JWT ID) claim is a unique identifier for the JWT. This can be used to prevent JWT token abuse, and to ensure the uniqueness of the JWT. The
- JWT Key ID (kid)In the JSON Web Token (JWT) standard, the "kid" (key ID) claim is a string that indicates the key that was used to digitally sign the JWT. This is used to verify the authenticity and
- JWT Message authentication code algorithm (alg)In the JSON Web Token (JWT) standard, the "alg" (message authentication code algorithm) claim is a string that indicates the algorithm that was used to digitally sign the JWT. This is used
- JWT Not Before (nbf)In the JSON Web Token (JWT) standard, the "nbf" (not before) claim is a timestamp that indicates the time before which the JWT must not be accepted for processing. This is the time before
- JWT PayloadIn the JSON Web Token (JWT) standard, the payload is the second part of the JWT, and contains the claims that are being represented by the JWT. The payload is a JSON object that contains
- JWT SignatureIn the JSON Web Token (JWT) standard, the signature is the third part of the JWT, and is used to verify the authenticity and integrity of the JWT. The signature is generated by digitally
- JWT Subject (sub)In the JSON Web Token (JWT) standard, the "sub" (subject) claim is a string that identifies the principal that is the subject of the JWT. This can be a human user, an organization, or a
- JWT Token type (typ)In the JSON Web Token (JWT) standard, the "typ" (token type) claim is a string that indicates the type of the JWT. This can be used to provide some basic information about the context in
- JWT x.509 Certificate Chain (x5c)In the JSON Web Token (JWT) standard, the "x5c" (x.509 certificate chain) claim is an array of strings that contains the x.509 certificate chain that was used to verify the digital…
- JWT x5u (X.509 Certificate Chain URL) ExplainedThe JWT x5u (X.509 URL) is an optional header parameter that holds an HTTPS URL pointing to the X.509 certificate, or certificate chain, for the public key that signed the token. It is
M
- Malware DistributionMalware distribution is the set of methods attackers use to deliver malicious software, such as ransomware, trojans, spyware and infostealers, onto a victim's device or network. Phishing is
- Malware SignaturesA malware signature is a pattern that identifies a specific known piece of malware, such as a file hash, a unique byte sequence, a set of strings, or a network traffic pattern. Antivirus
- Multipass Authentication ExplainedMultipass authentication is a single sign-on pattern in which your website, after signing a user in, builds an encrypted and signed token containing the user's details and redirects the…
O
- OAuth 2.0 Implicit Flow ExplainedThe OAuth 2.0 implicit flow (implicit grant) is an authorization flow in which the authorization server returns the access token directly in the browser redirect, in the URL fragment, with…
- OAuth Client Credentials Flow ExplainedThe client credentials flow is the OAuth 2.0 grant in which an application gets an access token using only its own credentials, with no user involved. The client sends its client ID and
- OAuth Resource Owner Password Credentials (ROPC)The OAuth 2.0 Resource Owner Password Credentials (ROPC) grant is a flow in which the user (the resource owner) types their username and password into the client application, and the client…
- OAuth ScopesOAuth scopes are named permissions that limit what an OAuth 2.0 access token may do. A client asks for them in the scope parameter as a space-separated, case-sensitive list, such as
- OIDC Access TokenAn OIDC access token is the OAuth 2.0 access token that an OpenID Provider issues alongside the ID token at the end of an OpenID Connect login. The client application sends it as a bearer
- OIDC Authorization Endpoint ExplainedThe OIDC authorization endpoint is the URL on an OpenID Provider where OpenID Connect authentication starts. Your application (the relying party) redirects the user's browser there with
- OIDC ClaimsAn OIDC claim is a name/value pair that states a piece of information about an authenticated user or about the authentication event, such as "sub": "248289761001" or "email":…
- OIDC Discovery Endpoint (.well-known) ExplainedThe OIDC discovery endpoint is a public URL, {issuer}/.well-known/openid-configuration, where an OpenID Connect provider publishes a JSON document describing itself. The document lists the
- OIDC EndpointsOIDC endpoints are the URLs an OpenID Provider exposes so that client applications can log users in, get tokens and read identity data. The core set is the authorization endpoint (where the
- OIDC Implicit FlowThe OIDC implicit flow is an OpenID Connect sign-in flow in which the OpenID Provider returns the ID token, and optionally an access token, directly from the authorization endpoint in the…
- OIDC JWKS Endpoint (JSON Web Key Set)The OIDC JWKS endpoint is the URL where an OpenID Connect provider publishes its public signing keys as a JSON Web Key Set (JWKS). Clients fetch it to verify the signature on ID tokens and
- OIDC OpenID Provider (OP) ExplainedAn OpenID Provider (OP) is the server in OpenID Connect (OIDC) that authenticates the user and tells an application who they are. OIDC is an identity layer on top of OAuth 2.0; the OP is
- OIDC Redirect URLThe OIDC redirect URL (also called the callback URL or redirecturi) is the endpoint in your application where the OpenID Provider sends the user's browser after sign-in. In the
- OIDC RPAn OIDC relying party (RP) is the application that relies on an OpenID Provider to sign users in. In OpenID Connect terms, the RP is the OAuth 2.0 client: it redirects the user to the
- OIDC ScopeAn OIDC scope is a value in the scope parameter of an OpenID Connect authorization request that tells the OpenID Provider which set of user claims the client wants. The openid scope is
- OIDC Token EndpointThe OIDC token endpoint is the OpenID Provider URL where a client exchanges an authorization code for tokens. The client sends a back-channel HTTPS POST with granttype=authorizationcode,
- OIDC UserInfo Endpoint ExplainedThe OIDC UserInfo endpoint is an OAuth 2.0 protected resource on the OpenID Provider that returns claims about the signed-in user. The client (relying party) calls it with the access token
- One Time Password (OTP)A one-time password (OTP), also called a one-time passcode, is a code that is valid for a single login or transaction and then expires. It is usually 6 to 8 digits, generated by an
- OpenIDOpenID is a decentralized sign-in standard that lets a user log in to many websites with one identity hosted by an OpenID provider of their choice, instead of creating a password at each…
- OpenID Connect (OIDC)OpenID Connect (OIDC) is an identity layer on top of OAuth 2.0 that lets an application verify who a user is by delegating login to an OpenID Provider. After the user signs in there, the
- OTP LoginOTP login is a sign-in method where the user proves who they are by entering a one-time password (OTP): a short random code, usually 6 digits, that the service sends to their phone by SMS…
P
- PasskeysA passkey is a passwordless sign-in credential based on the FIDO2 and W3C WebAuthn standards: a public/private key pair created for one website or app, where the private key stays on the…
- Password Spray AttackA password spray attack is a brute-force technique in which an attacker tries one or a few common passwords, such as Winter2025! or 123456, against many different usernames instead of many…
- Password VaultA password vault is an encrypted store for passwords and other secrets, such as API keys, recovery codes and passkeys, that is unlocked with one master credential. Personal vaults, usually
- Passwordless AuthenticationPasswordless authentication works by replacing the password check with a proof the user can give without a memorized secret: signing a server challenge with a device key (passkeys),…
- Passwordless AuthenticationPasswordless authentication is any sign-in method that verifies a user without a password or other memorized secret. The user instead proves possession of something, such as an email inbox,
- Penetration Testing Framework and MethodologyA penetration testing framework is a documented methodology that defines how an authorized security test is scoped, run and reported, so results are repeatable and comparable. The most
- PhishingPhishing is a social-engineering attack in which an attacker impersonates a trusted sender, such as a bank, employer or delivery service, to trick someone into revealing credentials,…
- Phishing Incident ResponsePhishing incident response is the set of steps an organization takes after a phishing email, text or site reaches its people: confirm the report, find every recipient, remove the message,…
- Privileged Access Management (PAM)Privileged access management (PAM) is the set of controls that protects accounts with elevated rights, such as server administrators, database superusers, cloud root accounts and service…
- Provisioning in Identity ManagementProvisioning, in identity and access management, is the process of creating a user's account in an application and giving it the right attributes, roles and permissions; deprovisioning is…
- Public-Key CryptographyPublic-key cryptography, also called asymmetric cryptography, uses a mathematically linked key pair: a public key that anyone may have and a private key that only its owner holds. Data
- Push Notification MFAPush notification MFA (push authentication) is a multi-factor authentication method in which the service sends a notification to an app on the user's registered phone, and the user approves…
R
- Refresh Token in SSOA refresh token is a long-lived credential that an OAuth 2.0 or OpenID Connect client uses to get a new access token from the authorization server's token endpoint when the current access…
- RFC 7636RFC 7636 is the IETF standard that defines Proof Key for Code Exchange (PKCE, pronounced "pixy"), an extension to the OAuth 2.0 authorization code flow that is also used with OpenID Connect…
S
- SAML ACS URLThe SAML Assertion Consumer Service (ACS) is the endpoint on a service provider (SP) that receives the identity provider's SAML response after login. The ACS URL, such as
- SAML AssertionA SAML assertion is a signed XML statement in which an identity provider (IdP) tells a service provider (SP) that a user has authenticated, who that user is, and what attributes they have.
- SAML AttributeA SAML attribute is a named piece of information about a user, such as an email address, display name, department or group membership, that an identity provider (IdP) sends to a service…
- SAML Audience Restriction ExplainedA SAML audience restriction is a condition inside a SAML assertion that names which service providers may accept it. The identity provider (IdP) places an AudienceRestriction element in the
- SAML EndpointA SAML endpoint is a URL where a SAML participant receives protocol messages during single sign-on (SSO) or logout. The identity provider (IdP) exposes a Single Sign-On Service endpoint
- SAML Entity IDA SAML entity ID is the globally unique name of a SAML participant: an identity provider (IdP) or a service provider (SP). It is a URI of up to 1,024 characters, set in the entityID
- SAML Identity Provider (IdP) ExplainedA SAML identity provider (IdP) is the system that authenticates a user and then issues a digitally signed SAML assertion telling a service provider (SP) who the user is. The SP trusts the
- SAML MetadataSAML metadata is an XML document that describes one SAML participant, an identity provider (IdP) or a service provider (SP), so the other side can trust it without manual setup. It contains
- SAML NameIDA SAML NameID (name identifier) is the element inside a SAML assertion's <Subject> that tells the service provider (SP) which user the identity provider (IdP) authenticated. It carries a
- SAML RelayStateSAML RelayState is an opaque value that travels alongside a SAML message, outside the XML, so the service provider (SP) knows where to send the user after single sign-on. The SP sends it
- SAML ResponseA SAML Response is the XML message an identity provider (IdP) sends to a service provider (SP) after a SAML 2.0 sign-in attempt. It carries a status code saying whether authentication
- SAML Service Provider (SP)A SAML (Security Assertion Markup Language) service provider (SP) is an entity that provides access to protected resources to users who have been authenticated by an identity provider…
- Secure Data HandlingSecure data handling is the set of practices that protect sensitive information, such as personal data, credentials and financial records, from unauthorized access, change or loss at every…
- Secure Data TransmissionSecure data transmission is sending data across a network so that it stays confidential, is not altered, and reaches the party it was meant for. In practice that means encrypting and
- Security Assertion Markup Language (SAML)Security Assertion Markup Language (SAML) is an XML-based standard for exchanging authentication and authorization data between parties. SAML is commonly used to enable single sign-on (SSO)
- Security Auditing for SSOSecurity auditing is a systematic review of an organization's security controls against a defined standard or policy, based on evidence such as configurations, logs and access records. For
- Security Operations ManagementSecurity operations management is the ongoing work of running an organization's day-to-day security defense: monitoring systems for threats, triaging alerts, responding to incidents, and…
- Security Testing FrameworkA security testing framework is a structured methodology that defines what to test in an application or system, how to test it, and how to record and rate the findings. Instead of ad hoc
- Server-to-Server Authentication ExplainedServer-to-server authentication is how one backend service proves its identity to another service or API without a human user present. Instead of a username and password typed at login, the
- Service AccountA service account is a non-human account that an application, script or workload uses to authenticate to other systems, instead of a person signing in. It has its own identity and
- Service provider (SP)In the context of authentication and authorization, a service provider (SP) is a system or application that provides services to users. The service provider typically requires users to
- Session CookieA session cookie is an HTTP cookie that has no Expires or Max-Age attribute, so the browser keeps it only in memory and discards it when the browsing session ends. Web apps use session
- Session Management in Web Apps and SSOSession management is how a web application creates, tracks and ends a user's authenticated state between requests. After login the server issues a session identifier, usually in a cookie,
- SFTPSFTP (SSH File Transfer Protocol, often called Secure File Transfer Protocol) is a network protocol for transferring and managing files over an encrypted Secure Shell (SSH) connection,…
- Single Sign-On (SSO)Single sign-on (SSO) is a method of authentication that allows users to access multiple applications and services with a single set of credentials, such as a username and password. The goal
- SSO ClaimsSSO claims are name-value statements about a user that an identity provider asserts after authentication, such as sub (a stable user ID), email, name or a group membership. In OpenID
- SSO CookieAn SSO cookie is the session cookie that a single sign-on identity provider sets in the browser after a user logs in. It records that the user has already authenticated, so when another
- SSO PortalAn SSO portal is a single web page where a user signs in once and then opens many applications without logging in again. The portal shows a dashboard of app tiles; behind it, an identity
- SSO Session TimeoutA session timeout is the rule that ends an authenticated session after a set time, forcing the user to sign in again. There are two kinds: an inactivity (idle) timeout, which ends the
- System for Cross-domain Identity Management (SCIM)System for Cross-domain Identity Management (SCIM) is an open IETF standard for creating, updating and deleting user accounts and groups across systems through a REST API with JSON. An
T
- Third-Party AuthenticationThird-party authentication is a login method in which an application lets an outside identity provider verify the user instead of checking a password itself. The user clicks a button such
- Threat Intelligence ReportA threat intelligence report is a document that analyzes a cyber threat, such as a malware campaign, an attacker group or an exploited vulnerability, and tells defenders what it means for…
- Token AuthenticationToken authentication is a way of proving identity in which, after one successful login, the server issues an authentication token, a signed or random string, and the client sends that token…
- Token AuthenticationToken authentication is a way of proving identity on each request by presenting a token, a string the server issued after the user signed in, instead of sending the username and password…
- Token ExpirationToken expiration is the point in time after which a security token, such as an OAuth access token, ID token or session token, is no longer accepted. "Token expired" means the credential
- Token IntrospectionToken introspection is an OAuth 2.0 mechanism, defined in RFC 7662, that lets a protected resource ask the authorization server whether a token is currently active and what it represents.
- Token-Based AuthenticationToken-based authentication is a method where a user or client proves its identity once, receives a token from the server, and then sends that token with each request instead of the…
- TOTP (Time-Based One-Time Password)A time-based one-time password (TOTP) is a short numeric code, usually 6 digits, that an authenticator app computes from a shared secret key and the current time, and that changes every 30…
- Two-Factor Authentication (2FA)Two-factor authentication (2FA) is a sign-in method that requires two different types of proof before granting access: typically something you know, such as a password, plus something you…
U
- Universal 2nd Factor (U2F)Universal 2nd Factor (U2F) is an open standard for two-factor authentication (2FA) that uses a hardware security key to verify the user's identity. U2F is based on public-key cryptography,
- Universal Authentication Frameworks (UAF)Universal Authentication Framework (UAF) is a specification for enabling secure, biometric-based authentication on a wide range of devices and platforms. UAF defines a common set of
- User Account LockoutUser account lockout is a security control that disables sign-in for an account after a set number of consecutive failed login attempts, either for a fixed period or until the user or an…
- User Authentication FrameworksUser authentication frameworks are the standards and software components that define how an application verifies who a user is and passes that identity to other systems. The term covers
- User Authentication Lifecycle ExplainedThe user authentication lifecycle is the full sequence of events that govern how a person proves who they are to an application: registration, credential binding, sign-in, session and token…
- User DelegationUser delegation is when a user lets another party, such as an application, service or another person, act on their behalf with a limited subset of their access, without handing over their…
- User Profile in SSOA user profile in SSO is the set of attributes an identity provider stores about a person, such as a stable user ID, name, email address, locale and group memberships, and shares with each…
V
- Validating PoliciesValidating policies refer to the process of checking that a set of policies (rules or guidelines) are accurate and complete, and that they meet the requirements of the system or…
- Vulnerability AssessmentA vulnerability assessment is a systematic review of an information system to find, classify and prioritize its security weaknesses, such as unpatched software, misconfigurations and weak…
W
- Web SSOWeb SSO (web single sign-on) lets a user sign in once in the browser and then open several web applications without logging in again. One identity provider (IdP) authenticates the user and
- WebAuthnWebAuthn (Web Authentication) is a web standard for secure, passwordless authentication. WebAuthn is based on the FIDO (Fast IDentity Online) set of open standards, and defines a set of
- Wi-Fi Access ControlWi-Fi access control is the set of mechanisms that decide which users and devices may join a wireless network and what they can reach once connected. In practice it combines an
