Plain definitions for the terms that come up while you are buying single sign-on.
Applying extra scrutiny when the circumstances of a sign-in look unusual — an unfamiliar network, an unexpected country, a burst of failures.
In Besecure Besecure restricts sign-in by IP address and geography, with rate limiting and lockout after repeated failures.
The chronological record of sign-ins and administrative changes. The thing that turns "who had access in March" from an argument into a query.
In Besecure One log across sign-ins, sign-outs and administrative changes, with configurable retention and exports to Excel or Word.
The system of record for who works at an organisation — the list of people, their groups and their departments. Microsoft Entra ID (formerly Azure AD) and LDAP are the common ones.
In Besecure Besecure syncs from Microsoft Entra ID or LDAP rather than asking you to rebuild your organisation in a second place.
The general arrangement where one system authenticates a person and another accepts that result. SAML, OIDC and OAuth are the protocols that carry it.
The system that authenticates a person and then vouches for them to other applications. The applications relying on it are service providers.
In Besecure Besecure acts as the identity provider for the applications you publish through it.
The three moments access has to change: someone starts, someone changes role, someone leaves. Most organisations handle the first well and the third badly.
In Besecure Covered by Besecure's user lifecycle management, where access is inherited from role and department rather than copied per person.
A simpler handoff where a signed JSON Web Token carries the identity to an application by redirect, used where a full federation setup is more than the application needs.
In Besecure Available as a redirect mode for custom applications.
The two ways of encrypting a connection to an LDAP directory. LDAPS uses a dedicated TLS port; StartTLS upgrades an ordinary connection in place.
In Besecure Both are selectable when you configure an LDAP directory.
Giving an account only the access its work requires, and no more. Its natural enemy is the standing administrator account created for one task years ago.
In Besecure Supported by granular administrator permissions and time-boxed support access.
Requiring more than a password: something you know plus something you have or are. It is the single most effective control against stolen credentials.
In Besecure Supported by authenticator app or one-time code, with enrolment you can require rather than suggest.
A standard for delegated authorisation — letting one application act on your behalf in another without handing over your password. Authorisation rather than authentication, which is why OIDC sits on top of it.
In Besecure Supported.
A modern identity layer built on top of OAuth 2.0, using JSON and REST rather than XML. Common in newer web and mobile applications.
In Besecure Supported.
Second factors that cannot be relayed by a convincing fake login page — passkeys, FIDO2 and hardware security keys. Authenticator codes and SMS are not phishing-resistant, because a person can be tricked into typing them into the wrong site.
In Besecure Not currently offered by Besecure. Relevant if you are being assessed at the higher Essential Eight maturity levels.
The discipline of controlling the accounts that can change things — administrators, service accounts, vendor support logins — usually with elevation that expires and a record of what was done.
In Besecure Besecure covers the access-layer part: granular admin roles, time-boxed support access, shared identities and an audit trail. It is not a credential vault for infrastructure.
Creating an account and its access when someone arrives, and removing them when they leave. The unglamorous half of identity, and where most access sprawl comes from.
Granting access according to someone's position rather than to them personally, so a new starter inherits the right access and a mover's access changes with their role.
In Besecure Besecure models departments, groups, roles and a granular permission matrix.
An XML-based standard for passing an authentication result from an identity provider to an application. The long-standing default for enterprise web applications.
In Besecure Supported. Each application gets its own certificate and configuration.
System for Cross-domain Identity Management — a standard API for pushing user accounts and group memberships into applications automatically.
In Besecure Not implemented in Besecure. Access is assigned by role, group and department, and users are read from your directory by sync rather than pushed to applications by SCIM.
Signing a person into an application that supports no federation protocol at all, by having a browser extension submit the credentials on their behalf. The industry treats it as a peer of SAML rather than a lesser option, because for these applications it is the only thing that works.
In Besecure How Besecure reaches non-federated applications — same launcher, same access rules, same audit trail.
An application that hands authentication off to an identity provider rather than keeping its own username and password. Also called the relying party.
Accounts and permissions still working long after the reason for them ended — the finished project, the departed contractor, the system nobody owns. It accumulates silently because nothing forces a review.
One sign-in that admits someone to many applications, instead of a separate password for each. The applications trust an identity provider to say who the person is.
In Besecure What Besecure is. Applications are published once and assigned by role, group or department.
One organisation's isolated space in a multi-tenant product — its own users, configuration and data, separate from every other customer's.
In Besecure Each Besecure customer is provisioned its own tenant.
Time-based one-time password — the six-digit code an authenticator app generates from a shared secret and the clock. Enrolled by scanning a QR code.
In Besecure The authenticator-app method Besecure uses.
An older federation protocol associated with the Microsoft stack, largely superseded by SAML and OIDC for new work.
In Besecure Not implemented in Besecure. If you have an application that speaks only WS-Federation, tell us and we will be straight with you about it.
The principle that being inside the network is not evidence of anything: every request is authenticated and authorised on its merits. Identity is the part of it most organisations start with.
Send us the paragraph from your security questionnaire or tender and we will tell you plainly whether Besecure answers it.
