> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/glossary.md). # Glossary Plain-English definitions of the terms and acronyms used across the OpenIAM documentation. Short definitions of the terms and acronyms you will meet across the OpenIAM documentation. * For a fuller explanation of how the core pieces fit together — users versus identities, provisioning, synchronization, reconciliation — see [the object model](/administration-guide/start/object-model.md). * For certification-specific vocabulary (campaigns, membership tags, risk factors, reviewer types), see the [the governance model](/administration-guide/governance/certification/certification-model.md). ## Terms ### birthright Access granted automatically based on who a person is — for example, every employee receiving email and SelfService access on their first day. ### certification The periodic review in which a manager or resource owner confirms that a user still needs the access they hold, and removes access that is no longer appropriate. {% hint style="info" %} You will see two different labels for this in the product: the Webconsole calls the configuration screen **Access Certification** (under **Access Control**), while the SelfService module where reviewers do the work is labeled **Access Review**. Both refer to certification. {% endhint %} ### Cedar The open-source authorization policy language OpenIAM evaluates policy-based access control with. Policies are written in Cedar; OpenIAM supplies the identities, resources and request circumstances it evaluates them against. ### connector The runtime component that carries out operations against a managed system — reading accounts, creating accounts, synchronizing passwords. See [the object model](/administration-guide/start/object-model.md) for how connectors fit into provisioning. ### end user A person who uses applications and the SelfService portal but does not administer OpenIAM. ### entitlement A specific grant of access — a role, a group membership, or a fine-grained permission a user holds on a managed system. See [the object model](/administration-guide/start/object-model.md#entitlements). ### Entra ID Microsoft's cloud directory service, formerly known as Azure Active Directory (Azure AD). ### identity provider (IdP) A service that authenticates users and asserts their identity to other applications, typically over SAML or OpenID Connect. OpenIAM can act as an IdP, or delegate to an external one. ### managed system A connected target system that OpenIAM administers through a connector — for example, an LDAP directory, a database, or a SaaS application. See [the object model](/administration-guide/start/object-model.md). ### OpenIAM The identity and access management platform this documentation describes. ### reconciliation Comparing the accounts and entitlements that exist on a managed system against OpenIAM's records, to detect and resolve differences. See [the object model](/administration-guide/start/object-model.md). ### SelfService The OpenIAM self-service portal, where end users request access, reset their password, and update their profile. ### synchronization Pulling identity data from a source of truth — such as an HR system — into OpenIAM. See [the object model](/administration-guide/start/object-model.md). ### Webconsole The OpenIAM administrative interface, where administrators configure managed systems, policies, and workflows. ## Terms that mean different things in different places A few words are used for more than one thing. When you meet them, check which is meant: ### attribute Can be a **user/profile attribute** (a field on the person), an **LDAP/source attribute** (a field in the connected system), or a **metadata attribute** (configuration). "Attribute mapping" is the correspondence between source attributes and OpenIAM attributes. ### group Usually an **OpenIAM group** (used to grant access), but it can also mean a **directory group** in LDAP or Active Directory, or a **conflict group** in a segregation-of-duties policy. ### policy Several distinct objects share the word: **password policy**, **authentication policy**, **IT policy**, **policy map**, and **SoD policy**. Two further uses are easy to confuse with each other. A **PBAC policy** is Cedar text evaluated per request, which grants nothing; a **business rule** — sometimes described as policy-based or rule-driven access — adds or removes an entitlement when identity data changes. Qualify which one you mean. ### resource An **RBAC resource** is an object that access is granted on — an application, a report, a menu (see [the object model](/administration-guide/start/object-model.md#entitlements)). A **system resource** means compute capacity — CPU, memory, disk. ## Acronyms | Acronym | Stands for | Notes | | --------- | ------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ABAC | Attribute-Based Access Control | Access decided from attributes rather than roles. | | API | Application Programming Interface | | | CA | Certificate Authority | Issues and signs certificates. | | CP | Content Provider | The OpenIAM object that fronts an application's URLs. | | CSV | Comma-Separated Values | Common import/export file format. | | DB | Database | | | DN | Distinguished Name | An entry's full path in an LDAP directory. | | ESB | Enterprise Service Bus | OpenIAM's messaging backbone for provisioning operations. | | FIDO | Fast Identity Online | Standard for passwordless and hardware-key authentication. | | HA | High Availability | | | IdP | Identity Provider | See the definition above. | | IGA | Identity Governance and Administration | | | JIT | Just-in-Time provisioning | Creating a user on first login rather than in advance. | | JML | Joiner, Mover, Leaver | The three stages of the employment lifecycle. | | JSON | JavaScript Object Notation | Text format used by REST APIs, configuration and connector payloads. | | JVM | Java Virtual Machine | The runtime OpenIAM services and the Java connectors run on. | | JWT | JSON Web Token | Signed token format used for authentication and claims. | | LDAP | Lightweight Directory Access Protocol | | | MFA | Multi-Factor Authentication | | | OAuth 2.0 | Open Authorization 2.0 | Authorization protocol. | | OIDC | OpenID Connect | Identity layer on top of OAuth 2.0. | | OTP | One-Time Password | | | OU | Organizational Unit | A container in an LDAP directory. | | PAM | Privileged Access Management | Controls and monitors access for privileged accounts. | | PBAC | Policy-Based Access Control | Access decided per request by evaluating a policy over the user, what is being reached and the circumstances, rather than by what the user holds. Distinct from a **business rule**, which grants or removes an entitlement. See [Deciding access at request time](https://github.com/openiam-platform/gitbook-docs/tree/main/solution-architecture/governance/request-time-policy.md). | | RaaS | Report as a Service | Workday's mechanism for publishing a custom report as a web service a connector can read. | | RBAC | Role-Based Access Control | Access granted through roles and groups. | | REST | Representational State Transfer | The HTTP API style most OpenIAM and connector endpoints use. | | RPM | RPM Package Manager | The package format, and the name of the deployment shape that installs OpenIAM on Enterprise Linux. | | SAML | Security Assertion Markup Language | Federation protocol used for SSO. | | SCIM | System for Cross-domain Identity Management | Standard REST API for provisioning users to SaaS apps. | | SOAP | Simple Object Access Protocol | XML web-service protocol, used by some connectors instead of or alongside REST. | | SoD | Segregation of Duties | Rules preventing one person from holding conflicting access. | | SP | Service Provider | The application that relies on an IdP for authentication. | | SSL | Secure Sockets Layer | Legacy transport encryption; prefer TLS. | | SSO | Single Sign-On | | | TLS | Transport Layer Security | Transport encryption for connections to OpenIAM and managed systems. | | TOTP | Time-based One-Time Password | The rotating code from an authenticator app. | | UAR | User Access Review | The former name for certification; still visible in some UI labels and audit records. | | UI | User Interface | | | URI | Uniform Resource Identifier | | | WSDL | Web Services Description Language | The XML contract describing a SOAP service - its operations, types and endpoint. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.openiam.com/glossary.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.