The Authentication OSID defines a means for native applications to acquire authentication credentials for transport to a remote endpoint and defines the means for server applications to validate and/or map received credentials into an Agent. The received credentials may be of any form, including data retrieved from within an HTTP session.

Applications

Hiding acquisition of credential data in native applications
Validating received credential data in server applications
Mapping received credentials into an Agent
Managing user accounts
Managing key rings

Objects

Agent

The Agent represents an identity determined by an authentication process. This generally maps to a user but may map to a more specific credential, or an anonymous user that has not been authenticated. Agents are used in authorization and any place that implies an action took place, such as a log entry.

Other services use Resource to identify a Person or as a reference to another object. The Resource OSID manages mappings to Agents. In some circumstances, a person may be known by multiple Agents. In simpler providers where distinction does not exist, the implementation of a Resource and an Agent may be one in the same.

Key

Agents may have a Key in providers that wish to offer key management. Key management provides a means to change passwords, or access public keys. An Agent may have exactly zero or one Keys. The Agent itself represents the authenticated entity which, in turn, is generally backed with a key. The purpose of separating the Agent from the Key is to define Key management as an optional compliance cluster that can be ignored by most Authentication providers.

Service Profile

acquisition of authentication credentials
validation of authentication credentials
lookup Agents
search Agents
manage Agents
notification of Agent changes
lookup Agent keys
search Agent keys
manage Agent keys
notification of key changes