token translators

An aggregate term for both token processors and token generators.

A web-based application, accessed using a web browser, that often aggregates content from multiple providers, serves as a central point of entry, or both.

An HTTP method used to request that the service or server accept the entity enclosed in the request as an addition to the resource identified in the URI.

In public key cryptography, a private key is the secret part of an asymmetric key pair that is typically used to digitally sign or decrypt data. The private key is kept secret by its owner, similar to a password.

Information, typically accessed through a web URL, that is protected by an access management system.

The rules, syntax, semantics, and synchronization of transactions between entities.

A persistent name identifier assigned to a user and shared among entities, usually with the user's permission, to enable SSO and SLO. Pseudonyms are often used with the SAML account linking protocol to enable SSO while preventing the discovery of the user's identity or activities.

In public key cryptography, a public key is the part of an asymmetric key pair that the owner shares with others to allow them to decrypt digital signatures or encrypted data.

A long-lived token used by OAuth clients to obtain a new access token without having to obtain fresh authorization from the resource owner.

An application programming interface (API) that conforms to the design principles of the representational state transfer (REST) architectural style.

In OAuth, a server that hosts protected resources and can accept and respond to resource requests from clients presenting a valid access token.

A security domain that issues SAML assertions.

Rules that describe how to embed SAML assertions into and extract them out of other protocols in order to enable SSO or SLO. Profiles describe SAML request and response flows that fulfill specific use cases.

A SAML binding that conveys a request or response by sending the user's browser to another location. For instance, an authentication request can be sent from an SP through a browser to an IdP.

In OAuth, a parameter on an access request and resulting, issued access token that specifies a limitation or limitations on access to the protected resource or resources.

An application or group of applications that trust a common security token used for authentication, authorization, or session management. The token is issued to a user after the user has authenticated to the security domain.

A collection of information used to establish acceptable identity for security purposes. Tokens can be in binary or XML format. A SAML assertion is one kind of security token.

A loosely coupled application architecture in which all functions or services are accessible using standard protocols. Interfaces are platform and programming-language independent.

A mechanism for identifying a user or browser for subsequent requests to a server, needed because the HTTP protocol is stateless. This information is used to look up state information for the user. (For example, items in a shopping cart.)

A client session is persisted by directing the client to the same backend server or host for the duration of the session.

The SAML implementation endpoint URL that returns logout requests.

The SAML implementation endpoint URL that receives logout requests for processing

A service that implements SSO. In SAML, this is an endpoint that receives and processes authentication requests.

A 20-byte sequence used to determine an identity provider's (IdP) identity.

In SAML, an identity-federation transaction in which the initial action for single logout (SLO) occurs at a the service provider (SP) site.

In SAML, an identity-federation transaction in which the initial action for single sign-on (SSO) occurs at a the service provider (SP) site.

A person, computer system, or application. In the SAML context, assertions make statements about subjects.

In SAML, the destination on a service provider (SP) to receive single sign-on (SSO) events.

A temporary ID used to preserve user anonymity while facilitating account linking.

A mechanism for evaluating attribute criteria available during a transaction to determine whether a user is authorized to access resources. A token in this instance can mean any type of security token, such as SSO, session cookie, or OAuth token.

The process by which a security token is exchanged for another security token.