Terminology

A string which is used to identify that a user or service has been authenticated

The process of validating a user or services credentials

The process of checking if an authenticated (known) user or service has permission to access an action or resource

A method of authentication for third parties to prevent them having access to the ITC users password

A first or third party application, for example, compliance-auth can be considered to be a client. An application can have multiple clients

A type of grant, which allows for programtic authentication where we want to authenticate a service

A way to identify a specific client record

A type of password for a client. Secrets are never known by users. Each client has it's own secret so that Client A cant authenticate as Client B

A way of changing data so it can be transmitted to other systems

A way of changing data securely, so it remains private while in transport. Encrypted data can always be decrypted back into it's original format.

An authentication method. For example, authenticating a user would need a different authentication method compared to trying to authenticate a service. In this case, we need 2 different grant types, one for user authenticated and one for programatic authentication

A way of changing data securely only one way. Once data has been hashed, it cannot be changed back into it's original format.

A specific type of access token which allows details about who or what is authenticated to be embedded within the access token securely

A cryptographic way of signing and validating tokens

A standardised authentication approach

A string known only to the user to prove who they say they are

A type of grant, which allows users to authenticate

A way to create a new Access Token without requiring the user to re-enter their username and password

A way to expire a resource early (For example, if an access token becomes compromised, we want to prevent it being used so can revoke it)

A permission associated with an access token

A platform, service, or API that needs programmatic access to resources and actions

A way to verify that the access token cannot be altered after it's been generated.

A unique identifier to identify a short lived request

"Time to live" - A numeric value which details how long something (usually an access token or cache) is valid for

A way to be sure that the user is who they say they are by requiring another level of user validation

A person, someone who physically has to login to a service with a username and password

A way for a user to identify their account