privileged.id

Reference · 93 terms

Glossary

Short, exact definitions of the terms used across this site, each sourced from the standard that defines it and linked to the page that explains it in full.

Access token
A credential that represents an authorization to access protected resources, presented by the client to a resource server (RFC 6749 §1.4). Its format is up to the authorization server; RFC 9068 profiles a JWT format. More →
Assertion
A statement from an identity provider to a relying party about an authentication event, possibly with attributes (NIST SP 800-63-4). SAML assertions and OpenID Connect ID tokens are both assertions. More →
Assertion Consumer Service (ACS)
The SAML service provider endpoint that receives the identity provider's Response (SAML Profiles §4.1.3). Its URL must equal the Recipient and Destination in the response. More →
Attestation
Information describing an authenticator's characteristics, such as its make and model, conveyed to the relying party or CSP, usually when the authenticator is registered (NIST SP 800-63-4; W3C WebAuthn). More →
Audience
The intended recipient of a token or assertion: the aud claim in a JWT, AudienceRestriction in SAML. A recipient not named in the audience must reject it (RFC 7519 §4.1.3). More →
Authentication assurance level (AAL)
A category describing the strength of an authentication process (NIST SP 800-63-4). AAL1 gives basic confidence, AAL2 high confidence with two factors, AAL3 very high confidence with a phishing-resistant, non-exportable cryptographic key. More →
Authenticator
Something the subscriber possesses and controls, such as a cryptographic module or a password, that is used to authenticate a claimant's identity (NIST SP 800-63-4). More →
Authorization code
A short-lived, single-use value the authorization server returns to the client through the browser, which the client exchanges for tokens at the token endpoint (RFC 6749 §4.1). RFC 6749 recommends a lifetime of at most 10 minutes. More →
Authorization server
The OAuth role that authenticates the resource owner, obtains authorization, and issues access tokens to clients (RFC 6749 §1.1). More →
Bearer token
A token that any party in possession of it can use, without proving possession of a key (RFC 6750). Sent as Authorization: Bearer; it must be protected from disclosure in storage and transport. More →
Blocklist (password)
A list of commonly used, expected or compromised passwords that a CSP checks new passwords against. NIST SP 800-63B-4 requires such a check and requires the CSP to tell the subscriber why a password was rejected. More →
Break-glass account
An emergency account kept for use when normal administrative access is unavailable, for example when the identity provider or MFA service is down. It is tightly controlled, monitored, and tested. NIST SP 800-53 Rev. 5 AC-2 discusses emergency accounts. More →
Channel binding
A phishing-resistance method in which the authenticator output is cryptographically bound to an identifier of the authenticated protected channel (for example the TLS connection), so it cannot be relayed over a different channel. NIST SP 800-63B-4 §3.2.5 considers it more secure than verifier name binding. More →
Claim
A piece of information asserted about a subject, represented as a name/value pair in a JWT (RFC 7519), such as iss, sub or exp. More →
Client credentials grant
The OAuth grant in which a client obtains an access token using only its own credentials, for machine-to-machine access (RFC 6749 §4.4). It MUST only be used by confidential clients, and a refresh token SHOULD NOT be issued. More →
Client (OAuth)
The application that requests access to protected resources on behalf of the resource owner, or for itself (RFC 6749 §1.1). The term says nothing about where it runs. More →
Code challenge
The value sent in the authorization request under PKCE: the verifier's SHA-256 hash, base64url-encoded, when code_challenge_method=S256 (RFC 7636 §4.2). More →
Code verifier
The PKCE secret: a high-entropy random string of 43 to 128 unreserved characters, created per authorization request (RFC 7636 §4.1). Its S256 challenge is BASE64URL(SHA256(ASCII(code_verifier))). More →
Confidential client
An OAuth client that can keep its credentials confidential, typically because it runs on a server the user cannot access (RFC 6749 §2.1). More →
CTAP (Client to Authenticator Protocol)
The FIDO Alliance protocol a browser or operating system uses to talk to an external authenticator, such as a hardware security key over USB, NFC or Bluetooth. More →
Device code
In the device authorization grant (RFC 8628), the high-entropy secret the device uses to poll the token endpoint, as opposed to the short user_code the user types on a second device. More →
Discovery (metadata)
Publishing a provider's endpoints, keys and capabilities as JSON at a well-known URL: /.well-known/openid-configuration for OpenID Connect, /.well-known/oauth-authorization-server for OAuth (RFC 8414). The returned issuer must match the URL used. More →
DPoP
Demonstrating Proof of Possession (RFC 9449): the client signs a per-request proof JWT (typ dpop+jwt) covering the HTTP method, URL and, at APIs, a hash of the access token, and tokens are bound to its public key via cnf.jkt. More →
Federation
A process that allows the conveyance of identity and authentication information across a set of networked systems (NIST SP 800-63-4), for example an IdP asserting a login to many applications via SAML or OpenID Connect. More →
Federation assurance level (FAL)
A category describing the process used in a federation transaction to communicate authentication events and attributes to a relying party (NIST SP 800-63-4). SP 800-63C-4 defines FAL1 to FAL3; FAL2 and above require RP-initiated transactions and single-RP audience restriction. More →
FIDO2
The FIDO Alliance's umbrella for passwordless, phishing-resistant authentication: the W3C WebAuthn API used by websites, plus the FIDO Client to Authenticator Protocol (CTAP) used between the platform and external authenticators. More →
HOTP
HMAC-based One-Time Password (RFC 4226): a code computed as a truncated HMAC-SHA-1 of a shared secret and a counter. Implementations MUST produce at least 6 digits. More →
Identity assurance level (IAL)
A category conveying the degree of confidence that a subject's claimed identity is their real identity, established through identity proofing (NIST SP 800-63-4). More →
Identity governance and administration (IGA)
The processes and tools for managing the identity lifecycle (joiner, mover, leaver), role and entitlement management, and periodic access reviews and certifications. More →
Identity provider (IdP)
The party in a federation transaction that creates an assertion for the subscriber and sends it to the relying party (NIST SP 800-63-4). In OpenID Connect it is called the OpenID Provider. More →
ID token
The OpenID Connect JWT that tells the client who authenticated, at which issuer, when and how. Its audience is the client's client_id; it is not an access token and must not be sent to APIs. More →
Implicit grant
The OAuth 2.0 grant that returns an access token directly in the redirect URI fragment (RFC 6749 §4.2). RFC 9700 says clients SHOULD NOT use it; the OAuth 2.1 draft omits it. More →
Issuer
The party that created a token or assertion: the iss claim in a JWT, the Issuer element in SAML. Validators must check it exactly matches the expected issuer and that the signing key belongs to it. More →
Just enough administration (JEA)
Limiting an administrative session to the specific commands or tasks required, rather than full administrator rights. The term is also the name of an operating-system-level feature for constrained administrative endpoints on Windows. More →
Just-in-time (JIT) access
Granting privileged access only when it is needed, for a limited time, usually after a request and approval, and removing it automatically afterwards. It reduces standing privilege; NIST SP 800-53 Rev. 5 AC-2(6) (dynamic privilege management) describes related controls. More →
JWE (JSON Web Encryption)
The format for encrypted content (RFC 7516). Its compact form has five parts: header, encrypted key, initialization vector, ciphertext and authentication tag. More →
JWK (JSON Web Key)
A JSON representation of a cryptographic key (RFC 7517). A JWK Set is an object with a keys array, which issuers publish at their jwks_uri. More →
JWKS (JWK Set)
A JSON document listing an issuer's public keys (RFC 7517 §5), fetched from the jwks_uri in its metadata and used to verify token signatures by kid. More →
JWS (JSON Web Signature)
The format for content protected by a digital signature or MAC (RFC 7515). It provides integrity, not confidentiality: anyone can read the payload. More →
JWT (JSON Web Token)
A compact, URL-safe representation of claims as a JSON object, protected as a JWS or JWE (RFC 7519). A signed JWT is three base64url parts: header, payload, signature. More →
Least privilege
The principle that each user, process or component is granted only the access needed to perform its function, and no more. NIST SP 800-53 Rev. 5 control AC-6 requires organizations to employ it. More →
Mix-up attack
An attack on clients that use several authorization servers, in which the client is tricked into sending a code or token from one server to another, attacker-controlled one. Countered by the iss response parameter of RFC 9207 (RFC 9700 §4.4). More →
Multi-factor authentication (MFA)
Authentication that requires more than one distinct type of factor (something you know, have, or are), either from one multi-factor authenticator or a combination of authenticators (NIST SP 800-63-4). More →
Mutual TLS (mTLS) for OAuth
TLS in which the client also presents a certificate. RFC 8705 uses it for OAuth client authentication and to bind access tokens to the certificate's SHA-256 thumbprint (cnf x5t#S256). More →
NameID
The SAML element identifying the subject of an assertion. A persistent NameID is an opaque, stable identifier for the user at one service provider. More →
nonce (OpenID Connect)
A value the client sends in an OpenID Connect authentication request that the provider copies into the ID token, letting the client detect replayed or injected ID tokens (OIDC Core §2). Not to be confused with a DPoP server nonce. More →
Non-person entity (NPE)
Any identity that is not a human: devices, services, workloads, software agents. NIST SP 800-207 discusses how automated agents that administer zero trust components authenticate as an open issue. More →
Number matching
An MFA push setting that requires the user to enter a number shown on the sign-in screen into the authenticator app before approving. CISA recommends it as an interim mitigation for push fatigue where phishing-resistant MFA is not yet possible. More →
OAuth 2.0
A framework for delegated authorization (RFC 6749): a client obtains an access token to call an HTTP API on a resource owner's behalf or its own, without handling the owner's password. It is not an authentication protocol. More →
One-time password (OTP)
A code valid for one authentication, generated by a device or app or sent to the user. OTPs resist replay but are not phishing-resistant, because the user can type them into an impostor site (NIST SP 800-63B-4). More →
OpenID Connect (OIDC)
An identity layer on OAuth 2.0 that lets clients verify who signed in, via an ID token, and obtain basic profile claims (OpenID Connect Core 1.0). More →
Passkey
In W3C WebAuthn Level 3, another name for a client-side discoverable credential: a WebAuthn public key credential usable without the relying party first identifying the user. Passkeys may be device-bound or synced between a user's devices. More →
Phishing resistance
The ability of an authentication protocol to prevent the disclosure of authentication secrets and valid authenticator outputs to an impostor verifier without relying on the vigilance of the claimant (NIST SP 800-63-4). NIST recognizes channel binding and verifier name binding as the two methods; OTPs and manually entered codes are not phishing-resistant. More →
PKCE (Proof Key for Code Exchange)
An extension (RFC 7636) in which the client sends a hash of a secret code_verifier with the authorization request and the verifier itself when redeeming the code, so a stolen or injected code cannot be redeemed. RFC 9700 requires it for public clients and recommends it for confidential clients. More →
Policy decision point (PDP)
In NIST SP 800-207's zero trust architecture, the component that decides whether a subject may access a resource. It consists of the policy engine, which makes the decision, and the policy administrator, which executes it. More →
Policy enforcement point (PEP)
In NIST SP 800-207, the component that enables, monitors and terminates connections between a subject and a resource, acting on the policy decision point's decisions. More →
private_key_jwt
A client authentication method in which the client signs a short-lived JWT with its private key and sends it as client_assertion (RFC 7523; OIDC Core §9). The server stores only the public key. More →
Privileged access management (PAM)
The processes and tools for controlling, monitoring and auditing privileged accounts and sessions: credential vaulting, just-in-time elevation, session recording and approval workflows. More →
Privileged account
An account with the authorizations of a privileged user: one trusted to perform security-relevant functions that ordinary users are not authorized to perform (NIST SP 800-53 Rev. 5 glossary). Administrator, root and domain admin accounts are examples. More →
Public client
An OAuth client that cannot keep credentials confidential, such as a native app or browser-based app (RFC 6749 §2.1). Public clients MUST use PKCE (RFC 9700). More →
Pushed authorization request (PAR)
Sending authorization request parameters directly to the authorization server and receiving a short-lived request_uri to use in the browser redirect (RFC 9126). More →
Push fatigue (push bombing)
An attack in which the attacker, already holding a password, sends repeated MFA push notifications until the user approves one (CISA). Number matching and phishing-resistant MFA are the countermeasures. More →
Redirect URI
The client endpoint to which the authorization server sends the user's browser with the authorization response (RFC 6749 §3.1.2). RFC 9700 requires authorization servers to compare it with registered values by exact string matching. More →
Refresh token
A credential the client presents to the authorization server to obtain new access tokens without user interaction (RFC 6749 §1.5). RFC 9700 requires refresh tokens for public clients to be rotated or sender-constrained. More →
Refresh token rotation
Issuing a new refresh token on every refresh and invalidating the old one, so that reuse of an old token reveals theft and lets the server revoke the grant (RFC 9700 §4.14.2). More →
RelayState
An opaque value of at most 80 bytes that a SAML binding carries alongside a message and returns unchanged, typically to remember where the user was going (SAML Bindings §3.4.3). It should be integrity-protected and never used as a raw redirect target. More →
Relying party (RP)
An entity that relies on another party's assertion or verification of a subscriber's identity, typically to grant access (NIST SP 800-63-4). In WebAuthn it is the web application that registers and authenticates users; in OpenID Connect it is the client. More →
Resource owner password credentials grant
The OAuth 2.0 grant in which the client collects the user's username and password and sends them to the token endpoint (RFC 6749 §4.3). RFC 9700 §2.4 says it MUST NOT be used. More →
Resource server
The OAuth role that hosts protected resources (an API) and accepts access tokens (RFC 6749 §1.1). It must check that each token was meant for it. More →
RP ID
In WebAuthn, the domain string that identifies the relying party. A credential can only be used with the RP ID it was registered for, which is what makes WebAuthn resistant to look-alike phishing domains. It defaults to the origin's effective domain and may be set to a registrable suffix of it. More →
SAML 2.0
The OASIS Security Assertion Markup Language, an XML standard (2005) in which an identity provider sends signed assertions to service providers, most often for browser single sign-on. More →
Scope
A space-delimited list of case-sensitive strings, defined by the authorization server, describing the access requested or granted (RFC 6749 §3.3). The server may grant less than requested and must then say so. More →
Secret
A value whose confidentiality is what makes it a credential: a password, API key, client secret, private key or token. Anyone who obtains it can use it, so it must be stored in a protected location, never in source code or logs. More →
Sender-constrained token
A token bound to key material held by the client, so that using it requires proof of possession of that key (RFC 9700 §2.2). DPoP and mutual-TLS certificate binding are the two standard methods. More →
Separation of duties
Dividing critical functions among different people so that no single individual can carry out a sensitive action alone, for example requesting and approving the same access. NIST SP 800-53 Rev. 5 control AC-5. More →
Service account
An account used by software (an application, workload, script or scheduled job) rather than by a person. Because no human signs in, its credentials are secrets that must be stored, rotated and scoped carefully. More →
Service provider (SP)
In SAML, the relying party: the application that requests and consumes assertions from an identity provider. More →
Single sign-on (SSO)
An authentication process in which one account and its authenticators are used to access multiple applications seamlessly, generally implemented with a federation protocol (NIST SP 800-63-4). More →
Standing privilege
Privileged access that is assigned permanently and is usable at any time, whether or not it is needed. Industry term; the alternative is access granted just in time and removed afterwards. More →
state parameter
An opaque value the client sends in the authorization request and receives back unchanged (RFC 6749 §4.1.1). Bound to the user's browser session, it protects the redirect endpoint against CSRF. More →
Syncable authenticator
A cryptographic authenticator whose keys can be cloned and exported to other storage so they can be synced to the user's other devices (NIST SP 800-63-4). NIST SP 800-63B-4 permits exportable keys at AAL1 and AAL2, subject to its Appendix B requirements, but says syncable authenticators SHALL NOT be used at AAL3, which requires non-exportable keys. More →
Token introspection
An authorization server endpoint (RFC 7662) that tells an authenticated resource server whether a token is active and returns its scope, subject, audience and expiry. More →
Token revocation
An authorization server endpoint (RFC 7009) where a client invalidates a refresh or access token it no longer needs. More →
TOTP
Time-based One-Time Password (RFC 6238): HOTP with the counter replaced by the number of time steps since an epoch. RFC 6238 recommends a default time step of 30 seconds. More →
UserInfo endpoint
An OpenID Connect protected resource that returns claims about the authenticated user when called with an access token (OIDC Core §5.3). Its sub must match the ID token's. More →
User presence (UP)
In WebAuthn, a simple test such as touching the authenticator that shows a human is present. It does not identify which human, so it is not user verification. More →
User verification (UV)
In WebAuthn, the authenticator locally confirming that the authorized user is present, using a PIN, password or biometric, before it signs. It distinguishes individual users, unlike a test of user presence. More →
Verifier impersonation
The term earlier versions of NIST SP 800-63B used for what SP 800-63B-4 now calls phishing: a fraudulent verifier or relying party tricking the claimant into presenting an authenticator to an impostor. More →
WebAuthn
The W3C Web Authentication API, by which web applications create and use public key credentials scoped to their domain (RP ID). Level 3 became a W3C Recommendation in August 2026; Level 2 has been a Recommendation since 2021. More →
XML Signature Wrapping (XSW)
An attack on XML signature validation in which the signed element is moved to a location the application does not read and an unsigned forged element is placed where it does, so the signature still verifies but the forged content is used. More →
Zero trust
A set of concepts for making least-privilege, per-request access decisions while treating the network as already compromised, so location on the network grants no implicit trust (NIST SP 800-207). More →