RFC-PAM-0001                                                  Appendix A
Category: Standards Track                                      Glossary

Appendix A: Glossary

← Previous: Evolution | Index | Next: Appendix B →

A.1 Term Definitions

Access Management Terms

Access Broker A system that mediates access between users and target resources. In this architecture, Teleport serves as the access broker for all privileged infrastructure access.

Access Request A formal request for elevated or temporary access. Access requests include requester identity, requested permissions, duration, and justification.

Authorization Ceiling The principle that downstream systems cannot grant permissions exceeding those available from upstream systems. Azure AD group memberships define the ceiling; Keycloak and Teleport can only grant subsets.

Certificate-Based Authentication Authentication using cryptographically signed certificates instead of passwords or static keys. Certificates contain identity claims and have limited validity periods.

Dynamic Credentials Credentials generated on-demand with limited lifetime. Vault generates dynamic credentials for database access, eliminating standing passwords.

Ephemeral Credentials Short-lived credentials that automatically expire. Used interchangeably with dynamic credentials in this RFC.

Just-in-Time (JIT) Access Access granted only when needed, for a limited duration, typically requiring explicit approval. Contrasts with standing access.

Principal In SSH certificate context, the Unix usernames that a certificate holder is permitted to use. For example, a certificate with principals ubuntu and ec2-user allows login as either user.

Privileged Access Access to infrastructure resources that requires elevated permissions, such as SSH to servers, database connections, or Kubernetes exec.

Session Recording Capture of all activity during a privileged session for audit and compliance purposes. Includes terminal I/O, queries, and metadata.

Standing Access Permanent or long-lived access that exists regardless of current need. This architecture eliminates standing access in favor of JIT.

Zero Direct Access The principle that no direct connections are permitted from user workstations to target resources; all access must flow through the access broker.

Component Terms

Auth Service Teleport's control plane component responsible for authentication, certificate issuance, and RBAC enforcement.

Database Agent Teleport component that proxies database connections and enables query logging.

eBPF (extended Berkeley Packet Filter) Linux kernel technology used for low-latency session capture in containers without modifying applications.

External Secrets Operator (ESO) Kubernetes operator that synchronizes secrets from external stores (Vault) to Kubernetes Secrets.

Kubernetes Agent Teleport component that enables governed kubectl exec/attach/port-forward operations.

Proxy Service Teleport's data plane component responsible for routing connections to agents.

SSH Agent Teleport component running on target hosts that handles SSH connections and session recording.

SSH Certificate Authority (CA) The system that signs SSH certificates. In this architecture, Vault's SSH secrets engine acts as the CA.

Teleport The access broker platform providing unified access to SSH, databases, Kubernetes, and applications with session recording and access control.

Protocol Terms

mTLS (Mutual TLS) TLS where both client and server present certificates for mutual authentication. Used between Teleport components.

OIDC (OpenID Connect) Authentication protocol used for Teleport integration with Keycloak.

SSH Certificate A signed document asserting that a public key belongs to a specific identity with specific permissions (principals) for a limited time.

Workflow Terms

Approval Chain The sequence of approvers required for an access request. May require one approver (OR logic) or multiple approvers (AND logic).

Break-Glass Emergency access procedure that bypasses normal controls. Subject to enhanced audit and review.

TTL (Time To Live) The duration for which a credential or access grant remains valid.

A.2 Diagram Index

All diagrams included in this RFC:

A.3 Abbreviations

A.4 ADR Index

Architectural Decision Records documented in this RFC:

Document Navigation

End of Appendix A