RSA Authentication Manager Glossary

[#1]

Glossary

Term	Definition
administrative role	A collection of permissions and the scope within which those permissions apply.
administrator	Any user with one or more administrative roles that grant administrative permission to manage the system.
agent host	The machine on which an agent is installed.
appliance	The hardware or guest virtual machine running RSA Authentication Manager. The appliance can be set up as a primary instance or a replica instance.
approver	A Request Approver or an administrator with approver permissions.
assurance level	For risk-based authentication, the system categorizes each authentication attempt into an assurance level that is based on the user’s profile, device, and authentication history. If the authentication attempt meets the minimum assurance level that is required by the RBA policy, the user gains access to the RBA-protected resource. Otherwise, the user must provide identity confirmation to access the RBA-protected resource.
attribute	A characteristic that defines the state, appearance, value, or setting of something. In Authentication Manager, attributes are values associated with users and user groups. For example, each user group has three standard attributes called Name, Identity Source, and Security Domain.
attribute mapping	The process of relating a user or user group attribute, such as User ID or Last Name, to one or more identity sources linked to the system. No attribute mapping is required in a deployment where the internal database is the primary identity source.
audit information	Data found in the audit log representing a history of system events or activity including changes to policy or configuration, authentications, authorizations, and so on.
audit log	A system-generated file that is a record of system events or activity. The system includes four such files, called the Trace, Administrative, Runtime Audit, and System logs.
authentication	The process of reliably determining the identity of a user or process.
authentication agent	A software application installed on a device, such as a domain server, web server, or desktop computer, that enables authentication communication with Authentication Manager on the network server. See agent host.
authentication method	The type of procedure required for obtaining authentication, such as a one-step procedure, a multiple-option procedure (user name and password), or a chained procedure.
authentication protocol	The convention used to transfer the credentials of a user during authentication, for example, HTTP-BASIC/DIGEST, NTLM, Kerberos, and SPNEGO.
authentication server	A component made up of services that handle authentication requests, database operations, and connections to the Security Console.
authenticator	A device used to verify a user's identity to Authentication Manager. This can be a hardware token (for example, a key fob) or a software token.
authorization	The process of determining if a user is allowed to perform an operation on a resource.
backup	A file that contains a copy of your primary instance data. You can use the backup file to restore the primary instance in a disaster recovery situation. An RSA Authentication Manager backup file includes: the internal database, appliance-only data and configuration, keys and passwords used to access internal services, and internal database log files. It does not include all the appliance and operating system log files.
certificate	An asymmetric public key that corresponds with a private key. It is either self-signed or signed with the private key of another certificate.
certificate DN	The distinguished name of the certificate issued to the user for authentication.
command line utility (CLU)	A utility that provides a command line user interface.
core attributes	The fixed set of attributes commonly used by all RSA products to create a user. These attributes are always part of the primary user record, whether the deployment is in an LDAP or RDBMS environment. You cannot exclude core attributes from a view, but they are available for delegation.
Cryptographic Token-Key Initialization Protocol (CT-KIP)	A client-server protocol for the secure initialization and configuration of software tokens. The protocol requires neither private-key capabilities in the tokens, nor an established public-key infrastructure. Successful execution of the protocol results in the generation of the same shared secret on both the server as well as the token.
custom attributes	An attribute you create in Authentication Manager and map to a field in an LDAP directory. For example, you could create a custom attribute for a user’s department.
data store	A data source, such as a relational database (Oracle or DB2) or directory server (Microsoft Active Directory or Oracle Directory Server). Each type of data source manages and accesses data differently.
delegated administration	A scheme for defining the scope and responsibilities of a set of administrators. It permits administrators to delegate a portion of their responsibilities to another administrator.
delivery address	The email address or the mobile phone number where the on-demand tokencodes will be delivered.
deployment	An installation of Authentication Manager that consists of a primary instance and, optionally, one or more replica instances.
demilitarized zone	The area of a network configured between two network firewalls.
device history	For risk-based authentication, the system maintains a device history for each user. It includes the devices that were used to gain access to protected resources.
device registration	For risk-based authentication, the process of saving an authentication device to the user’s device history.
distribution file password	A password used to protect the distribution file when the distribution file is sent by email to the user.
distributor	A Token Distributor or an administrator with distributor permissions.
DMZ	See demilitarized zone.
dynamic seed provisioning	The automation of all the steps required to provide a token file to a device that hosts a software token, such as a web browser, using the Cryptographic Token-Key Initialization Protocol (CT-KIP).
email notifications	Contain status information about requests for user enrollment, tokens, and user group membership that is sent to users who initiated the request. For token requests, email notifications also contain information about how to download and activate tokens. Request Approvers and Token Distributors receive email notifications about requests that require their action. See email templates.
email templates	Templates that administrators can use to customize email notifications about user requests for user enrollment, tokens, user group membership, or the on-demand tokencode service. See email notifications.
excluded words dictionary	A dictionary containing a record of words that users cannot use as passwords. It prevents users from using common, easily guessed words as passwords.
fixed passcode	Similar to a password that users can enter to gain access in place of a PIN and tokencode. The format for fixed passcodes is defined in the token policy assigned to a security domain. An administrator creates a fixed passcode in a users authentication settings page. Fixed passcodes are alphanumeric and cannot contain special characters.
Global Catalog	A read-only, replicated repository of a subset of the attributes of all entries in an Active Directory forest.
Global Catalog identity source	An identity source that is associated with an Active Directory Global Catalog. This identity source is used for finding and authenticating users, and resolving group membership within the forest.
identity attribute	Customer-defined attributes that are mapped to an existing customer-defined schema element. They are always stored in the same physical repository as the user’s or user group’s core attribute data. You can search, query, and report on these attributes. Each identity attribute definition must map to an existing attribute in an LDAP directory or RDBMS.
identity confirmation method	For risk-based authentication, an authentication method that can be used to confirm a user’s identity.
identity source	A data store containing user and user group data. The data store can be the internal database or an external directory server, such as Microsoft Active Directory.
instance	An installation of RSA Authentication Manager that can be set up as a primary instance or a replica instance. An instance also includes a RADIUS server.
internal database	The Authentication Manager proprietary data source.
keystore	The facility for storing keys and certificates.
load balancer	A deployment component used to distribute authentication requests across multiple computers to achieve optimal resource utilization. The load balancer is usually dedicated hardware or software that can provide redundancy, increase reliability, and minimize response time. See Round Robin DNS.
lower-level security domain	In a security domain hierarchy, a security domain that is nested within another security domain.
minimum assurance level	See assurance level.
node secret	A long-lived symmetric key that the agent uses to encrypt the data in the authentication request. The node secret is known only to Authentication Manager and the agent.
on-demand tokencode	Tokencodes delivered by SMS or SMTP. These tokencodes require the user to enter a PIN to achieve two-factor authentication. On-demand tokencodes are user-initiated, as Authentication Manager only sends a tokencode to the user when it receives a user request. An on-demand tokencode can be used only once. The administrator configures the lifetime of an on-demand tokencode. See on-demand tokencode service.
on-demand tokencode service	A service that allows enabled users to receive tokencodes by text message or email, instead of by tokens. You configure the on-demand tokencode service and enable users on the Security Console.
Operations Console	An administrative user interface through which the user configures and sets up Authentication Manager, for example, adding and managing identity sources, adding and managing instances, and disaster recovery.
permissions	Specifies which tasks an administrator is allowed to perform.
preferred instance	The Authentication Manager instance that the risk-based authentication service in the web tier communicates with first. Also, the instance that provides updates to the web tier. Any instance can be the preferred instance. For example, you can configure a replica instance as the preferred instance.
primary instance	The installed deployment where authentication and all administrative actions are performed.
promotion, for disaster recovery	The process of configuring a replica instance to become the new primary instance. During promotion, the original primary instance is detached from the deployment. All configuration data referring to the original primary instance is removed from the new primary instance.
promotion, for maintenance	The process of configuring a replica instance to become the new primary instance when all instances are healthy. During promotion, a replica instance is configured as a primary instance. The original primary instance is demoted and configured as a replica instance.
provisioning	See token provisioning.
provisioning data	The provisioning server-defined data. This is a container of information necessary to complete the provisioning of a token device.
RADIUS	See Remote Authentication Dial-In User Service.
RBA	See risk-based authentication.
RBA integration script	A script that redirects the user from the default logon page of a web-based application to a customized logon page. This allows Authentication Manager to authenticate the user with risk-based authentication. To generate an integration script, you must have an integration script template.
realm	A realm is an organizational unit that includes all of the objects managed within a single deployment, such as users and user groups, tokens, password policies, and agents. Each deployment has only one realm.
Remote Authentication Dial-In User Service (RADIUS)	A protocol for administering and securing remote access to a network. A RADIUS server receives remote user access requests from RADIUS clients, for example, a VPN.
replica instance	The installed deployment where authentication occurs and at which an administrator can view the administrative data. No administrative actions are performed on the replica instance.
replica package	A file that contains configuration data that enables the replica appliance to connect to the primary appliance. You must generate a replica package before you set up a replica appliance.
requests	Allows users to enroll, as well as request tokens, the on-demand tokencode service, and user group membership.
Request Approver	A predefined administrative role that grants permission to approve requests from users for user enrollment, tokens, or user group membership.
risk-based authentication (RBA)	An authentication method that analyzes the user’s profile, authentication history, and authentication device before granting access to a protected resource.
risk engine	In Authentication Manager, the risk engine intelligently assesses the authentication risk for each user. It accumulates knowledge about each user’s device and behavior over time. When the user attempts to authenticate, the risk engine refers to its collected data to evaluate the risk. The risk engine then assigns an assurance level, such as high, medium, or low, to the user’s authentication attempt.
round robin DNS	An alternate method of load balancing that does not require dedicated software or hardware. When the Domain Name System (DNS) server is configured and enabled for round robin, the DNS server sends risk-based authentication (RBA) requests to the web-tier servers. See Load Balancer.
scope	In a deployment, the security domain or domains within which a role’s permissions apply.
Secure Sockets Layer (SSL)	A protocol that uses cryptography to enable secure communication over the Internet. SSL is widely supported by leading web browsers and web servers.
Security Console	An administrative user interface through which the user performs most of the day-to-day administrative activities.
security domain	A container that defines an area of administrative management responsibility, typically in terms of business units, departments, partners, and so on. Security domains establish ownership and namespaces for objects (users, roles, permissions, and so on) within the system. They are hierarchical.
security questions	A way of allowing users to authenticate without using their standard method. To use this service, a user must answer a number of security questions. To authenticate using this service, the user must correctly answer all or a subset of the original questions.
self-service	A component of Authentication Manager that allows the user to update user profiles, change passwords for the Self-Service Console, configure life questions, clear devices enabled for risk-based authentication, change email addresses or phone numbers for on-demand authentication, and manage on-demand authentication PINs. The user can also request, maintain, and troubleshoot tokens.
Self-Service Console	A user interface through which the user can update user profiles, change passwords for the Self-Service Console, configure life questions, clear devices enabled for risk-based authentication, change email addresses or phone numbers for on-demand authentication, and manage on-demand authentication PINs. Users can also request, maintain, and troubleshoot tokens on the Self-Service Console.
session	An encounter between a user and a software application that contains data pertaining to the user’s interaction with the application. A session begins when the user logs on to the software application and ends when the user logs off of the software application.
shipping address	An address used by distributors to distribute hardware tokens.
silent collection	For risk-based authentication, a period during which the system silently collects data about each user’s profile, authentication history, and authentication devices without requiring identity confirmation during logon.
SSL	See Secure Sockets Layer.
Super Admin	An administrator with permissions to perform all administrative tasks in the Security Console. A Super Admin: Can link identity sources to system Has full permissions within a deployment Can assign administrative roles within a deployment
system event	System-generated information related to nonfunctional system events, such as server startup and shutdown, failover events, and replication events.
System log	A persistable store for recording system events.
TCP	See Transmission Control Protocol.
time-out	The amount of time (in seconds) that the user’s desktop can be inactive before reauthentication is required.
token distributor	A predefined administrative role that grants permission to act upon requests from users for tokens. Distributors record how they plan to deliver tokens to users and close requests.
token provisioning	The automation of all the steps required to provide enrollment, user group membership, RSA SecurID tokens, and the on-demand tokencode service to users. See also self-service.
top-level security domain	The top-level security domain is the first security domain in the security domain hierarchy. The top-level security domain is unique in that it links to the identity source or sources and manages the password, locking, and authentication policy for the entire deployment.
Trace log	A persistable store for trace information.
Transmission Control Protocol (TCP)	A protocol that allows programs on networked computers and major Internet applications to communicate with one another by sending reliable, ordered, and error-checked units of information.
trusted realm	A trusted realm is a realm that has a trust relationship with another realm. RSA Authentication Manager can add the Cloud Authentication Service as a trusted realm and send RSA SecurID Authenticate Tokencodes directly to the Cloud Authentication Service. An Authentication Manager deployment can trust another Authentication Manager deployment. Users in an Authentication Manager trusted realm have permission to authenticate to another Authentication Manager realm and access resources on that realm. Two or more Authentication Manager realms can have a trust relationship that can be either one-way or two-way.
trust package	An XML file that contains configuration information about the deployment.
UDP	See User Datagram Protocol.
User Datagram Protocol (UDP)	A protocol that allows programs on networked computers to communicate with one another by sending short messages called datagrams.
User ID	A character string that the system uses to identify a user attempting to authenticate. Typically a User ID is the user’s first initial followed by the last name. For example, Jane Doe’s User ID might be jdoe.
virtual host	Physical computer on which a virtual machine is installed. A virtual host helps manage traffic between web-based applications, web-tier deployments, and the associated primary instance and replica instances.
virtual hostname	The publicly-accessible hostname. End users use this virtual hostname to authenticate through the web tier. The system also generates SSL information based on the virtual hostname. The virtual hostname must be same as the load balancer hostname.
web tier	A web tier is a platform for installing and deploying the Self-Service Console, Dynamic Seed Provisioning, and the risk-based authentication (RBA) service in the DMZ. The web tier prevents end users from accessing your private network by receiving and managing inbound internet traffic before it enters your private network.
workflow	The movement of information or tasks through a work or business process. A workflow can consist of one or two approval steps and a distribution step for different requests from users.
workflow participant	Either approvers or distributors. Approvers review, approve, or defer user requests. Distributors determine the distribution method for token requests and record the method for each request. See also workflow.

Previous Topic:Edit Session Lifetime Settings for Operating System Access

You are here

Table of Contents > RSA Authentication Manager Glossary