Glossary
Last updated
Last updated
This glossary defines key terms and concepts used throughout the OXU IDP Integration Guide.
Access Token A short-lived token that grants access to protected resources. Typically expires in 15-60 minutes and is used in API calls to authenticate requests.
API (Application Programming Interface) A set of protocols and tools for building software applications. In the context of SSO, APIs are used to exchange tokens and retrieve user information.
Authentication The process of verifying who a user is. This typically involves checking credentials like username and password.
Authorization The process of determining what a user is allowed to do. This happens after authentication and involves checking permissions and roles.
Authorization Code A temporary code issued by the IDP after successful authentication. This code is exchanged for tokens and typically expires in 10 minutes.
Authorization Server The server that issues access tokens after successfully authenticating the user and obtaining authorization. In our case, this is OXU IDP.
Client An application that requests access to protected resources on behalf of a user. Can be confidential (server-side) or public (client-side).
Client ID A public identifier for your application, issued by OXU when you register your app. Safe to include in client-side code.
Client Secret A private key for your application, used to authenticate your app to the authorization server. Must be kept secure and only used in server-side code.
CORS (Cross-Origin Resource Sharing) A mechanism that allows web pages to make requests to a different domain than the one serving the page. Important for SPA implementations.
CSRF (Cross-Site Request Forgery) A type of attack where unauthorized commands are transmitted from a user that the web application trusts. Prevented using the state parameter.
Federated Identity A system where user identities are shared across multiple organizations or systems through trust relationships.
Flow The sequence of steps in an OAuth 2.0 authentication process. Common flows include Authorization Code Flow and Implicit Flow.
ID Token A JWT token that contains information about the authenticated user. Used in OpenID Connect to provide identity information to the application.
IDP (Identity Provider) A service that manages user identities and provides authentication services. OXU IDP is our identity provider.
Implicit Flow An OAuth 2.0 flow where tokens are returned directly in the URL fragment. Less secure than Authorization Code Flow and generally deprecated.
JWT (JSON Web Token) A compact, URL-safe token format that contains claims about a user. Used for ID tokens and sometimes access tokens.
JWKS (JSON Web Key Set) A set of public keys used to verify JWT signatures. OXU publishes its JWKS at a well-known endpoint.
OAuth 2.0 An authorization framework that enables applications to obtain limited access to user accounts. The foundation for modern SSO implementations.
OIDC (OpenID Connect) An identity layer built on top of OAuth 2.0 that provides authentication and user information through ID tokens.
Public Client An OAuth 2.0 client that cannot securely store credentials. Examples include single-page applications and mobile apps.
Redirect URI The URL where users are sent after authentication. Must be registered with OXU and match exactly in OAuth requests.
Refresh Token A long-lived token used to obtain new access tokens when they expire. Helps maintain user sessions without requiring re-authentication.
Resource Server A server that hosts protected resources and accepts access tokens. Your application's API endpoints act as resource servers.
Scope Defines the level of access that an application is requesting. Common scopes include 'openid', 'profile', and 'email'.
SPA (Single Page Application) A web application that loads a single HTML page and dynamically updates content. Examples include React, Vue, and Angular applications.
SSO (Single Sign-On) An authentication method that allows users to log in once and access multiple applications without re-entering credentials.
State Parameter A random value used to prevent CSRF attacks in OAuth flows. Generated by the client and validated when the user returns.
Token A string that represents authorization to access resources. Types include access tokens, refresh tokens, and ID tokens.
Token Endpoint The OXU endpoint where authorization codes are exchanged for tokens. Used in the server-to-server communication.
Two-Factor Authentication (2FA) An additional security layer that requires users to provide a second form of identification beyond their password.
User Agent The client application that acts on behalf of the user, typically a web browser or mobile app.
UserInfo Endpoint An OAuth 2.0 endpoint that returns claims about the authenticated user when presented with a valid access token.
Workspace A logical grouping within OXU that represents an organization, project, or environment. Users can belong to multiple workspaces.
RFC 6749: OAuth 2.0 Authorization Framework
RFC 7636: Proof Key for Code Exchange (PKCE)
RFC 7519: JSON Web Token (JWT)
RFC 7517: JSON Web Key (JWK)
OpenID Connect Core 1.0: Identity layer specification
PKCE (Proof Key for Code Exchange) A security extension to OAuth 2.0 that prevents authorization code interception attacks. Required for public clients like SPAs and mobile apps. See the for complete implementation details.
Need clarification on any term? Contact our for additional help
API
Application Programming Interface
Set of protocols for building software
CORS
Cross-Origin Resource Sharing
Browser security feature
CSRF
Cross-Site Request Forgery
Type of security attack
IDP
Identity Provider
Authentication service
JWT
JSON Web Token
Token format
JWKS
JSON Web Key Set
Public key collection
OAuth
Open Authorization
Authorization framework
OIDC
OpenID Connect
Identity layer on OAuth
PKCE
Proof Key for Code Exchange
Security extension
SPA
Single Page Application
Type of web application
SSO
Single Sign-On
Authentication method
2FA
Two-Factor Authentication
Additional security layer