Terms and basic concepts of IDaaS-Identity as a Service(IDaaS)-阿里云帮助中心

Terms related to IDaaS

IDaaS

Alibaba Cloud Identity as a Service (IDaaS) is a cloud-based identity management service that lets enterprises centrally manage identities.

EIAM

Alibaba Cloud Enterprise Identity Access Management (EIAM) is a cloud-based identity management service that provides a unified identity authentication platform, an identity and access management (IAM) system, and an authentication, authorization, account, and audit (4A) platform. EIAM manages the identities of internal personnel and partners, including employees, interns, temporary staff, suppliers, and store staff.

CIAM

Alibaba Cloud Customer Identity Access Management (CIAM) is a cloud-based identity management service for external users, such as consumers, members, and citizens.

Internationalization

Internationalization is the provision of multilingual services, user interfaces, images, documentation, operations, and support. IDaaS supports Chinese and English.

Security Authentication

Alibaba Cloud Security Authentication is an identity authentication service that provides password-free logon methods — including phone number verification, authentication based on International Internet Finance Authentication Alliance (IIFAA), WebAuthn, text message verification, and one-time passwords (OTPs) — along with SDKs for each method.

Zero trust

Zero trust is an emerging network security architecture that is widely used in the industry. The zero-trust architecture requires trusted identities and authorization for access to all services, improving the security and ease of use of the overall network architecture. It is well suited to modern workplace scenarios such as telecommuting, multi-cloud deployment, and bring your own device (BYOD).

IDaaS Public Cloud and IDaaS private deployment

Alibaba Cloud IDaaS Public Cloud is a ready-to-use cloud service with flexible billing. Administrators activate the service using their Alibaba Cloud accounts.

IDaaS private deployment is a deployment of Alibaba Cloud IDaaS to a specified environment, such as an Alibaba Cloud virtual private cloud (VPC), an Amazon Web Services (AWS) environment, or a data center.

Terms related to identity providers

IdP

In Security Assertion Markup Language (SAML), an identity provider (IdP) verifies and authenticates the user and returns the SAML response to a service provider (SP). More broadly, IdP refers to a unified identity management platform. In IDaaS, IDaaS itself is the IdP.

In SAML, a service provider (SP) receives the response returned by an IdP. More broadly, SP refers to any application connected to an IdP. In IDaaS, an SP is an application.

Active Directory (AD)

Active Directory (AD) is a directory service developed by Microsoft for managing organizations, accounts, and permissions in enterprise environments. AD can be deployed independently, and many modern applications support the AD account system. Enterprises usually look for other identity management solutions, such as IDaaS, because AD has compatibility issues that affect user experience.

LDAP

Lightweight Directory Access Protocol (LDAP) is a protocol for accessing and maintaining distributed directory information. LDAP is commonly used with AD and OpenLDAP but also works with other systems such as Apache Directory.

OpenLDAP

OpenLDAP is an open source implementation of LDAP.

Active Directory Federation Services (ADFS)

Active Directory Federation Services (ADFS) is a default component of Windows Server that extends AD access to external applications. However, ADFS is difficult to use and requires O&M.

*See also:* IdP, AD

DingTalk Contacts

DingTalk Contacts can be connected to IDaaS, letting you synchronize identities between DingTalk and other account systems.

Terms related to accounts

Organizational structure

An organizational structure is a tree-shaped hierarchy of an enterprise. Each department is a node in the tree.

Organization

An organization — also called an organizational unit (OU) or department — is a node in an organizational structure. In most enterprise contexts, an organization maps to a department.

Root organization node

Each IDaaS instance has exactly one root node, which represents the enterprise itself. You can rename the root node in IDaaS.

Account

In theory, each user has one IDaaS account. Users log on to the IDaaS application portal using their account and, after single sign-on (SSO) is configured, can access authorized applications.

Account lifecycle management

Account lifecycle management covers the full lifecycle of an account from creation (employee onboarding) to termination (employee offboarding), including operations such as disabling, locking, moving, and modifying the account.

Group

A group is a collection of accounts used to assign permissions and define the scope for synchronization.

Synchronization

In IDaaS, synchronization is the transfer of accounts and organizational data between systems. IDaaS supports incremental and full-data synchronization, instant and scheduled synchronization, and bidirectional synchronization between IDaaS and external systems.

*See also:* SCIM

SCIM

System for Cross-domain Identity Management (SCIM) is an international specification for synchronizing accounts and organizational data across systems. Many applications support SCIM to enable identity interoperability.

*See also:* Synchronization

Terms related to applications

SSO

Single sign-on (SSO) lets users access all connected applications after a single logon. In the IDaaS context, SSO refers specifically to federated identity management based on standard protocols such as SAML and OpenID Connect (OIDC).

SSO, SAML, OIDC, and OAuth 2.0 are complementary rather than mutually exclusive. SAML is typically used for enterprise web SSO; OIDC handles authentication and identity federation in modern apps; OAuth 2.0 handles delegated authorization. Most enterprise identity deployments use a combination of these protocols depending on the application type.

*See also:* IdP-initiated SSO, SP-initiated SSO, SAML, OIDC, OAuth 2.0

IdP-initiated SSO

IdP-initiated SSO is triggered when a user launches an application from the IDaaS application portal. The authentication request originates from IDaaS (the IdP).

*See also:* SP-initiated SSO

SP-initiated SSO

SP-initiated SSO is triggered when a user accesses an application directly. The application determines whether the user is authenticated and, if not, redirects the user to IDaaS for authentication before redirecting back to the application. The authentication request originates from the application (the SP).

*See also:* IdP-initiated SSO

Application user

An application user is the identity a logged-on IDaaS account assumes within an application during SSO. For example, a user with the IDaaS account zhangsan might have the administrator role in the Operations Platform application. IDaaS supports multiple ways to associate application users with IDaaS accounts. When an account can assume multiple identities in an application, the user selects the appropriate identity at login.

Signature generation and verification

Signatures based on asymmetric encryption algorithms protect tokens from forgery and tampering. During OIDC-based SSO, IDaaS signs the issued id_token using an RSA-256 private key. The application verifies the token using the corresponding public key.

*See also:* OIDC, Access token, ID token, and refresh token

Encryption and decryption

Encryption uses symmetric or asymmetric algorithms to protect data in transit. When IDaaS synchronizes application data, it encrypts the data using AES-256 before transmission. The application decrypts the data using a symmetric key, ensuring privacy and integrity in untrusted network environments.

Authorization

Authorization is the assignment of permissions on objects — such as applications or other resources — to subjects, such as organizations or accounts. In IDaaS, you manage all application permissions centrally: an organization can access an application only after you grant it access in IDaaS.

Authorization determines *what* a user can access. Authentication (handled by the IdP) determines *who* the user is. These two steps work together in every SSO flow.

*See also:* SSO, IdP

SAML

Security Assertion Markup Language (SAML) is a widely adopted XML-based standard for SSO and federated identity. SAML is more complex than OIDC and is most common in enterprise web application SSO scenarios. IDaaS supports SAML 2.0.

*See also:* SSO, OIDC

OIDC

OpenID Connect (OIDC) is an identity federation protocol built on OpenID and OAuth 2.0. Published in 2014, OIDC is widely used for SSO, authentication, and delegated authentication in modern applications. OIDC is generally simpler to implement than SAML.

*See also:* OAuth 2.0, JWT, SSO

JWT

JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact, URL-safe format for transmitting information between parties as a JSON object. Because the content can be signed and encrypted, JWT is commonly used to represent identity claims. In the context of China IAM deployments, JWT often represents a simplified SSO implementation partially based on the OIDC implicit flow.

*See also:* OIDC, Access token, ID token, and refresh token

CAS

Central Authentication Service (CAS) is a global SSO protocol for the web.

OAuth 2.0

OAuth 2.0 is an authorization framework (IETF RFC 6749) commonly used to implement SSO. Because OIDC is built on OAuth 2.0, most flows in OIDC and OAuth 2.0 are similar.

*See also:* OIDC, Authorization code flow, Client credentials flow, Device flow

Access token, ID token, and refresh token

An access_token is a credential used to call API operations provided by an IdP.

An id_token carries information about the authenticated account and is used to establish the user's identity in the application.

A refresh_token is used to get a new access token after the current access_token expires, without requiring the user to log on again.

*See also:* OIDC, OAuth 2.0, Signature generation and verification

Client credentials flow

In the client credentials flow, permissions are granted to the application service rather than to an individual user. IDaaS provides the application with a client_id and client_secret. The application exchanges these credentials for an access_token and uses it to call the API operations specified by IDaaS.

*See also:* OAuth 2.0, Access token, ID token, and refresh token

Authorization code flow

In the authorization code flow, the user is authorized through a redirect sequence. The application obtains the user's identity from the third-party system and logs the user in using that identity. DingTalk and WeChat both use the authorization code flow for logon.

*See also:* OAuth 2.0

Device flow

The device flow supports authentication on hardware devices that cannot display a browser-based logon page. The user opens the IDaaS logon page on a separate computer or mobile browser, completes authentication, and the verified identity is transmitted to the device.

*See also:* OAuth 2.0

Terms related to logon

Password complexity

Password complexity refers to the rules that account passwords must meet — for example, minimum length, required character types, and restrictions on reuse.

Lazy loading

Lazy loading, also called just-in-time provisioning, is a design pattern for identity federation. If IDaaS cannot find the identity of a user attempting to log on, it forwards the authentication request to the enterprise's original identity system. After the user is authenticated, IDaaS stores the account information locally. This pattern is typically used when passwords in the source system cannot be migrated to IDaaS directly.

MFA and 2FA

Multi-factor authentication (MFA) and two-factor authentication (2FA) require users to present multiple credentials before gaining access. MFA addresses the security risks of password-only logon by adding a second verification step. IDaaS supports text message verification codes, email verification codes, and OTPs as second factors.

*See also:* OTP

OTP

A one-time password (OTP) is a temporary credential valid for a single use. The most common type is the time-based one-time password (TOTP), which is generated using a shared seed and a time-synchronized algorithm and is valid for 30 seconds. Because OTPs expire quickly and cannot be reused, they reduce the risk of credential replay attacks. The server and client must align on the seed and keep their clocks synchronized for TOTP to work correctly.

*See also:* MFA and 2FA

Application portal

The IDaaS application portal is the page from which users initiate SSO to all connected applications. The portal appearance can be customized for an additional charge.