Glossary

155 terms from Identity and Access Management, in plain words, each with the chapter that teaches it.

Search the glossary

#

802.1X: The IEEE standard for port-based network access control. A switch port or Wi-Fi connection carries nothing but login traffic until the device proves who it is. It has three parts: a supplicant, an authenticator and an authentication server.

A

ABAC (attribute-based access control): An access control model where one policy combines attributes of the subject (such as department), the object (such as its label), the action (read or write) and the environment (network, device, time). It is the most precise model and the hardest to read and test. Cloud IAM policies and conditional access are ABAC.
access control list (ACL): A list attached to one file or folder that says who may do what to it. On Linux, ACLs let Priya name extra people beyond the owner, group and others, such as letting Sam read `refunds.csv`.
access control model: The rule for how access decisions are made. The quickest way to tell the models apart is to ask who or what decides: the owner, labels, the job role, rules, the clock or a set of attributes.
access review: A regular check where each system or team owner confirms, line by line, who has access to what, and removes whatever is no longer needed. At Kettle & Crane it runs every quarter, and monthly for admins and finance. The answers are kept as evidence.
access token: A short-lived OAuth token that lists the scopes a client was granted. The client sends it with each API call. Keycloak's access tokens in the lab last 300 seconds.
account: One identity's login on one system. Priya has one identity but several accounts: her laptop sign-in, her email, the order system and the shipping app.
account lockout: Slowing down or blocking sign-in after repeated failed attempts, so attackers can't guess passwords or short codes endlessly. Kettle & Crane locks an account for 15 minutes after ten failures.
agentless: A posture check that installs nothing on the device. Instead, the NAC system asks the device-management system whether the device is healthy.
anonymous bind: An LDAP bind (login) with no name or password. A default Ubuntu directory accepts these and answers searches, giving away every user name, email and group to anyone who can reach port 389.
assertion: A signed XML statement from the IdP saying who signed in, when, for which app, and for how long it is valid. The app must check its signature, issuer, audience and time window before trusting it.
audience: The app that a token or assertion is meant for. An app must refuse anything addressed to a different app, or a weak app could replay sign-ins into a stronger one.
authentication: Proving who you are, the first step of access control. It comes before authorization (what you may do) and accounting (what you did).
authentication factor: One kind of proof of identity. The three main categories are something you know, have and are, and somewhere you are and something you do add context.
authentication server: The part of 802.1X that checks the login and says yes or no, usually against the directory. It is almost always a RADIUS server such as FreeRADIUS.
authenticator: The switch or wireless access point in 802.1X. It decides nothing itself: it passes messages between the device and the RADIUS server and opens the port when told to.
AuthnRequest: The SAML message an app sends, through the browser's redirect, asking the IdP to sign the person in. It starts an SP-initiated sign-in.
authorization: Deciding what a person who is already known may do. An access control model sets the rules for how that decision is made.
authorization code: A short-lived, one-time code that the authorization server sends back to the app through the browser's redirect. The app then swaps it for tokens on the back channel. Codes work once and expire within about a minute.
authorization code flow: The OAuth flow almost every app should use. The browser carries a one-time code back to the app, and the app swaps it for tokens directly with the server, so tokens never pass through the browser. It should always be protected with state and PKCE.
authorization server: The OAuth role that signs people in and issues tokens. In the lab, Keycloak is the authorization server for the order dashboard.

B

back channel: The direct, server-to-server call in which an app swaps the authorization code for tokens, adding its client secret. The tokens never pass through the browser.
backup code: A one-time code issued at enrollment for signing in when your usual factor, such as your phone, is lost. Each code works once. The server stores only their hashes, and Kettle & Crane keeps printed codes in the office safe.
bearer token: A token that works for whoever holds it, like cash. Access tokens are bearer tokens, so they should be short-lived and sent only over HTTPS.
bind: The LDAP word for a login: an app asks the directory whether a password is right for a DN. A simple bind sends the password in clear text unless TLS is used.
biometric: A factor that measures part of you: a fingerprint, face, iris or voice. The reader compares each scan with a stored template and accepts anything close enough, which leads to false acceptances and false rejections.
breached password list: A list of passwords already seen in data breaches, which attackers try first. NIST says to reject any new password found on it; it catches weak passwords such as `correcthorsebatterystaple` that pass every length and word rule.
break-glass account: A powerful account kept sealed for emergencies, such as when the IdP or MFA is down. It doesn't depend on the usual sign-in, needs two people to open, alerts the owners whenever it is used, and is reset afterward.

C

CA (certificate authority): An authority that issues and signs certificates. A real office uses its own CA for the directory server, while the lab uses a self-signed certificate instead.
captive portal: The web page a guest network shows before letting a device out to the internet: accept the terms, type a code or sign in. It gives control and records, not secrecy. Kettle & Crane's KC-Guest network uses one with a daily code.
CER (crossover error rate): The setting at which a biometric reader's false acceptance and false rejection rates are equal. A lower CER means a more accurate reader.
claims: The fields in a JWT's payload, such as `iss`, `sub`, `aud`, `exp`, `iat`, `name` and `email`. An app must check the token's signature before trusting any claim.
classification label: A sensitivity level that an administrator gives a file in mandatory access control, such as public, internal, confidential or restricted. A person may read the file only if their clearance reaches its label.
clearance: The level of labeled information a person is allowed to read under mandatory access control. Sam has only internal clearance, so MAC refuses him the confidential refunds file.
client: The OAuth role for the app that wants access on someone's behalf, such as the order dashboard reading Priya's orders.
client credentials: An OAuth grant for programs with no user. The program signs in as itself with its client ID and secret and gets an access token, with no refresh token. The UPS label sync uses it.
client ID: The public name an OAuth client is registered under at the authorization server, such as `orders` or `ups-sync`.
client secret: A password belonging to an OAuth client that it sends when swapping a code or using client credentials. Phone apps can't keep one safe, and a program's secret needs the same care as a service account's password.
code verifier: A secret random value the app makes for PKCE and reveals only when it swaps the code for tokens. Someone who steals the code can't use it without the verifier.
compromised credential: A credential that someone else has, or may have: a phished password, a password in a breach, a stolen token or a leaked API key. The response is to reset it, revoke sessions and tokens, check MFA methods and persistence, read the sign-in log and fix the cause.
conditional access: An IdP feature that allows or blocks sign-in based on attributes such as device, location and risk. It is a form of ABAC.
consent screen: The page where a person approves the scopes an OAuth client asks for. Unrecognized app consents are a sign of persistence after a compromise.
credential: Whatever proves an account is yours: a password, an SSH key, a one-time code, or a token an app keeps.

D

DAC (discretionary access control): An access control model where the owner of a file decides who else may use it, as when Priya shares her refunds file with Sam. Linux permissions and NTFS permissions are DAC. Its weakness is that owners, or malware running as them, can overshare.
delegation: Letting an app do one limited thing on your behalf without giving it your password. This is what OAuth does: Priya lets the order dashboard read her orders using a scoped token.
deprovisioning: Removing a leaver's access. At Kettle & Crane every account and credential is disabled the moment the person leaves, and deleted later (after 30 days) once their files have new owners.
device-bound passkey: A passkey sealed in one device, such as a security key, that can't be copied. If the device is lost, so is the passkey. It suits admin accounts and anything critical.
directory: A central database of people and groups, arranged as a tree, that apps ask about passwords and group memberships. Disabling Lena once in the directory locks her out of every app that uses it.
dissolvable agent: A small posture-check program that a visitor runs once. It checks the device, reports the result and removes itself.
DN (distinguished name): The full name of a directory entry, built from its place in the tree, such as `uid=priya,ou=people,dc=kettleandcrane,dc=com`.
dynamic VLAN assignment: RADIUS choosing a port's VLAN from who logs in rather than from which socket is used. Priya's Access-Accept tells the switch to put her in VLAN 20.

E

EAP (Extensible Authentication Protocol): The framework that carries 802.1X login messages, with several methods inside it. Between laptop and switch it travels as EAPOL, and the switch wraps it in RADIUS.
EAP-TLS: The strongest EAP method: both the laptop and the server prove themselves with certificates, so no passwords are used. It needs a certificate on every device.
EAP-TTLS: An EAP method like PEAP: the server shows a certificate, and the user's password or another method travels inside a TLS tunnel. It is more flexible than PEAP.

F

FAR (false acceptance rate): How often a biometric reader lets in the wrong person, which is a security failure. Making the reader stricter lowers FAR.
federation: Trust between separate organizations, so that one side accepts the other's sign-ins. The importer's portal trusts Kettle & Crane's IdP, so Jo signs in with her own work account. It is set up by exchanging metadata.
FIDO2: The set of standards behind passkeys: WebAuthn in the browser and CTAP for security keys.
FRR (false rejection rate): How often a biometric reader refuses the right person. It is an annoyance rather than a security failure, and it rises as the reader gets stricter.

G

gMSA (group Managed Service Account): An Active Directory service account whose password the domain controllers create (240 random bytes) and change every 30 days. Only the listed computers may fetch the password, and no person ever sees it.
group: A named set of accounts that can be given access all at once, on Linux or in a directory. When each group stands for a job role, adding a person to `shipping` gives them exactly the shipping access, and removing them takes it away.

H

hard token: A dedicated device that makes or holds a second factor, such as a key fob showing codes or a security key like a YubiKey. The secret is sealed inside and can't be copied, but the device costs money and can be lost.
HMAC (hash-based message authentication code): A hash worked out over a message together with a secret key. Without the key, nobody can produce the same HMAC. HOTP and TOTP codes come from an HMAC-SHA1 of a counter.
HOTP (HMAC-based one-time password): A one-time code worked out from a shared secret and a counter that goes up by one each time it is used (RFC 4226).

I

ID token: A signed JWT from OpenID Connect that says who signed in, meant for the client app itself. Its audience is the app (`orders`), so an API must refuse it.
identity: One real person or one program as your systems know them, such as Priya Shah in customer service. One identity usually has several accounts.
identity lifecycle: The whole journey of an identity: proofing, provisioning, changes and deprovisioning. These match the joiner, mover and leaver stages. Skip a stage and attackers get in, access piles up, or former staff can still sign in.
identity proofing: Checking that a person is who they claim to be before giving them an identity, or before resetting their password or MFA. Kettle & Crane's help desk calls back on the number in the HR record, and never resets on an incoming call alone.
IdP (identity provider): The trusted service that checks who you are (password, MFA, passkey) and then vouches for you to apps. Microsoft Entra ID, Okta, Google Workspace and Keycloak are IdPs. It concentrates risk: if it is down nobody works, and if it is taken over every app is exposed.
issuer: The party that vouches for a sign-in by issuing the assertion or token. An app must check that it is the IdP it trusts.

J

JIT (just-in-time access): Granting admin rights for a stated reason and for a short time, then removing them automatically, instead of keeping standing privilege. Alex's `grant-admin.sh` does this with sudo's `NOTAFTER`.
JWT (JSON Web Token): A signed token made of three Base64url parts joined by dots: a header, a payload of claims and a signature. Anyone can read one, so it must never hold secrets, and an app must check its signature before trusting it.

K

k-anonymity: Checking whether a password is breached by sending only the first 5 characters of its SHA-1 hash. The service returns all matching suffixes and you look for yours locally, so the service can't tell which password you checked.
Keycloak: A free, open-source identity provider that speaks SAML and OpenID Connect. The labs run it in development mode on port 8080 as Kettle & Crane's IdP and authorization server.

L

LDAP (Lightweight Directory Access Protocol): The protocol apps use to ask a directory two questions: is this password right (a bind), and which groups is this person in (a search). It uses port 389.
LDAPS: LDAP wrapped in TLS from the first byte, on its own port, 636.
least privilege: The principle of giving each person or program only the access it needs, and ideally only for as long as it needs it. Asking for the smallest OAuth scopes, giving service accounts limited rights and granting just-in-time admin rights that expire are all ways to apply it.

M

MAB (MAC authentication bypass): Letting devices with no supplicant, such as printers and card readers, onto the network by checking their hardware (MAC) address against a list. MAC addresses are easy to copy, so these devices go into a limited VLAN.
MAC (mandatory access control): An access control model where the system decides, using classification labels and clearances that only administrators set. Owners can't override it, so Priya can't share a confidential file with someone cleared only for internal.
magic link: A one-time sign-in link or code the site emails you. It is passwordless, but only as strong as the email account, because whoever controls the mailbox controls the account.
metadata: A small XML file with a party's entity ID, its addresses and the IdP's signing certificate. Exchanging metadata sets up federation, and the certificate in it is what the app trusts.
MFA (multifactor authentication): Sign-in that needs proofs from two or more different factor categories, such as Priya's password (know) plus a code from her phone (have). A password plus a security question is two steps but only one factor.

N

NAC (network access control): Checking every device and person before the network lets them in. It uses 802.1X for who you are, captive portals for guests and posture checks for device health.
NIST SP 800-63B: The US standard for digital identity whose password rules Kettle & Crane follows: at least 15 characters (8 with MFA), no composition rules, no scheduled changes, block breached and company words, and limit guessing.
number matching: A safeguard for push sign-ins: the sign-in screen shows a number that you must type into the app. Tired staff can then no longer approve prompts they didn't start.

O

OAuth: A standard for delegated authorization. A person lets an app do limited things on their behalf, and the app gets a scoped token instead of the password. It is not a sign-in system on its own.
OIDC (OpenID Connect): A thin layer on top of OAuth that adds sign-in. When the app asks for the `openid` scope it also gets an ID token. It is the modern JSON-based alternative to SAML.
OTP (one-time password): A code that works only once or for a few seconds, so a stolen one is soon worthless. It is the most common second factor, such as the six digits from an authenticator app.
OU (organizational unit): A branch of the directory tree that holds related entries. Kettle & Crane keeps people in `ou=people`, groups in `ou=groups` and program accounts in `ou=services`.

P

PAM (privileged access management): The set of controls around privileged accounts: separate admin accounts, a password vault, just-in-time rights, recorded sessions and the strongest MFA. It is not the same as Linux PAM.
passkey: A sign-in key pair made for one website under the FIDO2 standards. The device keeps the private key and signs a fresh challenge plus the site's origin. Because there is no shared secret and nothing to replay, it can't be phished.
passkey provider: A service that copies synced passkeys across your devices, such as Apple iCloud Keychain, Google Password Manager or a password manager.
password manager: An app that creates and stores a long random password for every site. Some can also hold OTP secrets or passkeys.
password spraying: An attack that tries a few common passwords against many user names. The user list an open directory gives away is exactly what it needs.
passwordless: Signing in without typing or sending any shared secret. Common forms are passkeys, Windows Hello for Business, smart cards and magic links. A PIN or face scan only unlocks a key on your own device.
PEAP (Protected EAP): An EAP method where the server proves itself with a certificate and the user's password (MSCHAPv2) travels inside a TLS tunnel. It is the most common method with Active Directory, and the laptop must check the server's certificate.
persistence: Ways an attacker keeps access after a password reset, such as mailbox forwarding rules, app consents, API keys or SSH keys. Checking for it is one step in responding to a compromised credential.
persistent agent: Posture software installed on company laptops that reports the device's health all the time.
phishing: Tricking people into typing credentials into a fake page or approving a fake request. Passwords, security questions and OTP codes can all be phished.
phishing resistance: The property that a fake site can't collect anything it can use. Passkeys have it because their signatures are bound to the real origin and contain no shared secret.
PKCE (Proof Key for Code Exchange): An extra check in the code flow. The app sends the hash of a secret code verifier at the start and must show the verifier when swapping the code, so a stolen code is useless. Always use it, and especially in phone apps, which can't keep a secret.
posture: A check on the device's health before or while it joins the network: updates installed, antivirus running, firewall on, disk encrypted. A device that fails goes to a quarantine VLAN.
privilege creep: The slow pile-up of rights as people change jobs without losing their old access. Priya kept `buying` and `sales` after moving to customer service. Comparing each person's groups with their role's list reveals it.
privileged account: An account that can change the system itself, such as root, full sudo, Domain Admins or the cloud global admin. Attackers hunt for these first.
provisioning: Creating a new person's accounts with the right access for their job, before day one. It starts from the HR record and the role, not from copying what the last person had.
pwquality: The Linux library that checks new passwords against rules such as minimum length, dictionary words and banned words. Ubuntu applies it to `passwd` once `libpam-pwquality` is installed.

Q

quarantine VLAN: A limited network for devices that fail a posture check. It reaches only the update servers, and the device is let in once it is fixed and checked again.

R

RADIUS (Remote Authentication Dial-In User Service): The protocol and server that check network logins, usually against the directory, and answer yes or no. It uses UDP port 1812 (1813 for accounting) and encrypts only the password.
RBAC (role-based access control): An access control model where permissions belong to job roles and people are put into roles, usually as directory groups. When Mateo joins shipping, Alex just adds him to the shipping group. Watch out: rule-based access control shares the same letters.
realm: Keycloak's word for one organization's separate set of users and apps, such as the `kettleandcrane` realm.
redirect URI: The address the authorization server sends the browser back to with the code. It must match one registered for the client exactly, including `https` and the path.
refresh token: A longer-lived token an app uses to get new access tokens without asking the person again. Revoking it ends the app's access, which is a key step after a compromise.
resource owner: The OAuth role for the person whose data it is, such as Priya for her orders.
resource server: The OAuth role for the API that holds the data and accepts access tokens, such as the shop's order API.
role explosion: RBAC's classic failure, where a new role is created for every exception until the roles are unmanageable.
rubber-stamping: Owners approving every line of an access review without thinking. Showing only mismatches and removing unanswered lines counters it.
rule-based access control: An access control model where administrator-set rules apply to every request, whoever makes it, such as "no payroll from outside the office". A firewall rule list is an example. Rules look at the request, while roles look at the person's job.

S

salted, stretched hash: A password hash mixed with a random value (salt) and deliberately slowed down (stretched), so stolen hashes are hard to crack. Servers should store only these, never passwords.
SAML (Security Assertion Markup Language): The older and still most common SSO standard for business apps. It sends signed XML assertions through the browser, and the app must check the signature, audience and time window.
SAMLResponse: The IdP's answer in SAML. It holds the signed assertion, and the browser POSTs it to the app's ACS address.
scope: A named permission an OAuth client asks for and the person approves, such as `orders.read` or `email`. Ask for the smallest scopes the app needs.
security key: A small hardware token you plug in or tap, such as a YubiKey. Its secret can't be copied off, and it can hold device-bound passkeys. Kettle & Crane requires one for admins.
self-signed certificate: A certificate signed by its own key rather than by a CA. It is fine for a lab, but clients must be told to trust it explicitly.
separate admin account: A second account used only for administration. Alex reads email as `alex` and administers as `alex-admin`, so a phishing link clicked in email runs without admin rights.
service account: An account used by a program, not a person, such as `kc-backup` or `review-bot`. Each needs one program per account, only the rights it requires, no interactive login, a named human owner and a rotating password or key.
session: The signed-in state an app keeps after you log in, so you don't sign in on every page. A stolen session survives a password change, so after a compromise you must end every session as well as resetting the password.
SIM swap: An attack where someone takes over a phone number by moving it to their own SIM card, and so receives the victim's SMS codes.
smart card: A card holding a certificate and its private key, unlocked with a PIN. It is a passwordless form of sign-in.
soft token: An app that holds a second factor on a device you already own, such as Microsoft Authenticator. It is free, but malware or a cloud backup can expose its secrets.
something you are: The inherence factor category: a fingerprint, face, iris or voice. It can't be forgotten, but it can't be changed if leaked either.
something you do: The behavior factor, such as typing rhythm or the way you walk or swipe. It adds context but is rarely enough alone.
something you have: The possession factor category: a phone with an authenticator app, a hardware key or a smart card. A thief must get the object, which is hard to do at scale.
something you know: The knowledge factor category: a password, PIN or security answer. It can be guessed, reused or phished from anywhere.
somewhere you are: The location factor, such as the office network, GPS position or the country of your IP address. Systems use it as an extra signal rather than on its own.
source of truth: The authoritative list that other systems build from. For identities it is the HR record, which IT compares with the accounts that exist.
SP (service provider): Any app that trusts the IdP's sign-in, such as the shipping app or the payroll site. It never sees the password.
SSH key: A key pair used to sign in over SSH. A locked password doesn't stop it, so a leaver's keys must be removed as well.
SSO (single sign-on): Signing in once at an identity provider and then using many apps without typing the password again. It gives Alex one place to enforce MFA and disable leavers, but it concentrates risk in the IdP.
stale account: An account with no sign-in for longer than the limit (90 days in the review), such as Dana's. It is flagged for a keep-or-remove decision.
stale credential: A credential that still works although nobody should be using it, such as a leaver's account, a forgotten test account or an old SSH key. Compare accounts and keys with the HR list to find them.
standing privilege: Admin rights that are always on, mostly unused but there for any attacker who steals the account. JIT access replaces them.
StartTLS: Connecting to LDAP on port 389 and then upgrading to TLS before anything secret is sent. `-ZZ` in the LDAP commands means "use StartTLS and stop if it fails".
state: A random value the app sends at the start of the OAuth flow and checks when the code comes back, so it accepts only answers to its own requests.
supplicant: In 802.1X, the software on the laptop or phone that asks to join the network. It must check the RADIUS server's certificate, or it may send its password to a fake access point.
synced passkey: A passkey that a passkey provider copies across your devices, so losing one phone doesn't lose it. It is only as safe as the syncing account, so that account needs MFA.

T

TACACS+ (Terminal Access Controller Access-Control System Plus): A login protocol for admins signing in to switches and routers. It uses TCP port 49 and encrypts the whole message, while RADIUS encrypts only the password.
time-based access control: An access control model where the clock decides, such as warehouse badges that work only from 6 a.m. to 8 p.m., or admin rights that end on a set date.
TLS (Transport Layer Security): The standard protocol that encrypts and authenticates network connections, using certificates to prove the server's identity. It is what makes web traffic HTTPS, protects LDAP logins through StartTLS or LDAPS, and protects the password exchange inside PEAP Wi-Fi sign-ins.
token: The thing that makes or holds your second factor: a hard token (device) or a soft token (app). The word also means a value an app holds as proof of access, such as an OAuth access token.
TOTP (time-based one-time password): A one-time code worked out from a shared secret and the current 30-second time step (RFC 6238). The phone and server each work out the same code, so their clocks must agree.
two-step sign-in: Any sign-in with two proofs. It counts as MFA only if the proofs come from different categories, so a password plus a security question is two steps but one factor.

V

vault: An encrypted store for shared admin passwords. People check a password out, and it is changed automatically after use. Scripts should fetch secrets from it rather than holding them.
VLAN: A separate virtual network on the same switches. Kettle & Crane puts staff in VLAN 20, devices in 30, guests in 40 and failed devices in quarantine VLAN 99.

W

WebAuthn: The FIDO2 standard that lets browsers create and use passkeys, including adding the site's origin to what gets signed.
Windows Hello for Business: Passwordless Windows sign-in where a PIN or face scan unlocks a key kept in the laptop's TPM chip.
WPA3 Enterprise: Wi-Fi security that uses 802.1X, so everyone signs in as themselves instead of sharing one password. Kettle & Crane's KC-Staff network uses it with PEAP.