| Term | Definition |
|---|---|
| access token | In the OAuth 2.0 specification, an access token is an opaque key that allows a Relying Party (RP) client to access things on a resource server.In Digital Identity Management, access tokens are JSON Web Tokens (JWTs) that enable access to the Digital Identity Management’s OIDC-based /userinfo endpoint and, depending on the scopes granted, potentially to other Digital Identity Management APIs as well. They also represent the fact that a user has logged in to your application. |
| authorization code | In the Authorization Code Grant flow, this is a one-time code that can be redeemed at Digital Identity Management’s token endpoint for OAuth 2.0 or OIDC tokens (for example, access token, refresh token , ID token). |
| authorization endpoint | The HTTP endpoint used to initiate OAuth2.0 or OIDC grant flows. For Digital Identity Management, this is /oidc/authorize. |
| authorization server | OAuth 2.0 name for the entity that grants tokens to clients on behalf of a resource owner. Digital Identity Management is an authorization server when a registered RP client uses it to obtain tokens.Equivalent to an issuer in OIDC terminology. |
| claim | A piece of information about a user such as their email address. An RP client requests a set number of user claims from Digital Identity Management by specifying the corresponding scopes in its initial request. |
| client | OAuth 2.0 name for the part of your application which will request and use OAuth 2.0 tokens. Equivalent to Relying Party (RP) in OIDC terminology. |
| grant flow | A particular sequence of interactions, initiated by an RP client, that ultimately ends with the granting of tokens. OAuth 2.0, OIDC, and their extension specifications, collectively define several different possible grant flows. This guide presents detailed explanations of the recommended grant flows according to your application type. |
| ID Token | In the OIDC standard, a JWT issued by the authorization server (or issuer) asserting certain information (claims) about an end user. |
| issuer | The entity that issues a JWT, such as Digital Identity Management in the case of an ID Token.Equivalent to an authorization server in the original OAuth 2.0 standard. |
| OAuth 2.0 | Authorization protocol built around access and refresh tokens that enable the transfer of resources between systems. |
| OpenID Connect (OIDC) | Authentication layer built on top of OAuth 2.0. OIDC extends the OAuth 2.0 protocol to standardize user authentication and access to user information between systems. |
| protected resource | In OAuth 2.0, any endpoint or resource that requires authorization (such as an access token) to access. |
| relying party | OIDC name for the OAuth 2.0 client. |
| resource owner | OAuth 2.0 name for the user, the entity (person) who owns the resource, where the resource in question is their ability to authorize access. |
| resource server | OAuth 2.0 name for any entity which will accept access tokens and grant access to resources or perform actions. Digital Identity Management is a resource server when you use access tokens to make requests on a user’s behalf. |
| refresh token | A token which can be used to obtain a fresh access token when the previous one has expired. |
| token endpoint | The HTTP endpoint at which the authorization server grants tokens. For Digital Identity Management, this is /oidc/token. |
| Parent topic:OAuth 2.0 and OpenID Connect |
OAuth 2.0 and OIDC Glossary
This topic collects and itemizes key terms that fall under OAuth 2.0 and OpenID Connect standards.