RFC-IAM-0001                                                 Appendix A
Category: Standards Track                                   Glossary

Appendix A: Glossary

← Previous: Evolution | Index | Next: Appendix B →

A.1 Term Definitions

Identity and Authentication Terms

Access Token A token issued by Keycloak that grants access to protected resources. Contains claims about the user's identity and permissions. Validated by applications to authorize requests.

Authentication The process of verifying a user's identity. In this architecture, authentication flows through Azure AD to Keycloak to applications.

Authentication Chain The sequence of authentication validations: Azure AD verifies user identity, Keycloak receives the assertion, applications validate Keycloak tokens. As used in this RFC, the chain represents the mandatory flow through which all authentication MUST pass.

Authorization The process of determining whether an authenticated user can perform a requested action. Derived from Keycloak token claims which are constrained by Azure AD group memberships.

Authorization Ceiling The principle that downstream systems cannot grant permissions exceeding those available from upstream systems. Azure AD group memberships define the ceiling; Keycloak and applications can only grant subsets.

Claim An assertion about a subject contained in a token. Examples include user identity, group memberships, and roles.

Federation The process of linking identity systems so that authentication in one system is recognized by another. Azure AD federates with Keycloak through OIDC.

Identity Provider (IdP) A system that authenticates users and issues identity assertions. Azure AD is the enterprise IdP; Keycloak is the platform IdP.

JWKS (JSON Web Key Set) A set of cryptographic keys used to verify token signatures. Applications retrieve JWKS from identity providers to validate tokens.

OIDC (OpenID Connect) An authentication protocol built on OAuth 2.0. Used for federation between Azure AD and Keycloak, and between Keycloak and applications.

Principal An entity (user or service) that can be authenticated and authorized. Users authenticate through OIDC; services authenticate through service accounts.

Realm A Keycloak concept representing an isolated namespace for identity management. Contains users, roles, clients, and configuration.

Refresh Token A token used to obtain new access tokens without re-authentication. Managed by Keycloak with configurable expiration policies.

Role A named set of permissions. Keycloak roles are mapped from Azure AD groups and included in tokens for application authorization.

Session A stateful authentication context maintained by Keycloak. Sessions have configurable lifetimes and can be terminated for security purposes.

Token A cryptographically signed data structure asserting claims about a subject. ID tokens assert identity; access tokens assert permissions.

Secrets Management Terms

Note: For comprehensive secrets management terminology, see RFC-SECOPS-0001 Appendix A. This section defines only terms specific to the identity-secrets intersection.

Dynamic Secret A secret generated on-demand with a limited lifetime. Vault can generate dynamic secrets for databases and cloud providers.

External Secrets Operator (ESO) A Kubernetes operator that synchronizes secrets from external secret stores (Vault) to Kubernetes Secrets.

Identity-Bound Secret A secret whose existence, validity, or access authorization is tied to an identity managed by the IAM system. As used in this RFC, identity-bound secrets include Keycloak client secrets, service-to-service tokens, and user-specific API tokens. Their lifecycle is coupled to the identity they are bound to.

ExternalSecret A Kubernetes custom resource defining a secret requirement. ESO watches ExternalSecrets and creates corresponding Kubernetes Secrets.

Secret Sensitive data that must be protected (credentials, API keys, certificates). As used in this RFC, secrets MUST be stored in Vault and distributed through ESO.

SecretStore A Kubernetes custom resource defining connection parameters to an external secret store (Vault).

Vault HashiCorp Vault, the secrets management system. Serves as the single authoritative source for all platform secrets.

Vault Policy A rule set defining which identities can access which secret paths with which capabilities.

Infrastructure and GitOps Terms

ArgoCD A GitOps continuous delivery tool that synchronizes Kubernetes cluster state with Git repository definitions.

Composition A Crossplane concept for bundling multiple managed resources into a single claimable unit.

Crossplane A Kubernetes-native infrastructure provisioning tool. Extends Kubernetes to manage external resources through declarative definitions.

GitOps An operational model where Git serves as the source of truth for infrastructure and application configuration. Changes are applied by reconciling cluster state with Git state.

Helm Chart A package of Kubernetes resource templates. Used to define application deployments and associated resources.

Managed Resource A Crossplane custom resource representing an external resource (registry project, database schema, etc.). Crossplane reconciles managed resources with target systems.

Provider A Crossplane component that implements resource management for a specific system (registry provider, Vault provider, etc.).

ProviderConfig A Crossplane resource specifying connection parameters for a provider, including credentials.

Reconciliation The process of comparing declared state (in Git/Kubernetes) with actual state (in target systems) and making corrections to achieve consistency.

Application Terms

Container Registry A service that stores and distributes container images, typically with features like vulnerability scanning and access control. Examples include Harbor and Docker Registry.

Developer Portal (Backstage) The developer portal platform. Architecture is defined in RFC-DEVELOPER-PLATFORM. This RFC covers only the identity integration (Keycloak authentication).

Package Registry A service that hosts software packages (npm, Maven, etc.) and proxies public registries. Examples include Verdaccio and Nexus.

Platform Application Any web-based developer tool that integrates with the platform identity system. Examples include container registries, package registries, developer portals, and monitoring dashboards.

Robot Account / Service Account An account in a registry or application for automated access (CI/CD pipelines). Uses token authentication rather than OIDC.

A.2 ADR Index

Architectural Decision Records documenting significant decisions in this RFC:

A.3 Diagram Index

All diagrams included in this RFC:

A.4 Abbreviations

Document Navigation

End of Appendix A