7. Glossary

Identity Provider (IDP)

Instance that provides information to authenticate and authorize identities. In case of ID Broker scenarios typically an SAML or OpenID Connect IDP hosted by a school authority.

Provisioning API

REST API of the ID Broker which is used by school authorities to send pseudonyms and a limited set of meta information on users and groups to the ID Broker.

School Authority

In context of this document school authority subsumes the various institutions which serve one or several schools with IT infrastructure. That includes that the school authority holds the identity store for all learners and teachers of an environment. This can be a single School, a school authority with several schools, or an environment hosting services for a federal state. Typically these are environments hosting a UCS@school domain.

Self-disclosure API

REST API of the ID Broker which allows retrieval of meta information of an authorized user (focus is role of the user and the assigned learning groups). The API is derived from an API introduced by Bettermarks and sometimes referred to as Bettermarks API.

Self-disclosure database (SDDB)

Redis database of the ID Broker that holds the user, group, and service provider mappings which the Self-disclosure API reads. It is filled from the ID Broker IDM by the Self-disclosure database builder. Although its content is derived from LDAP, the SDDB also carries the builder’s event queue and statistics, and it is repopulated only per object on the first miss, so it cannot be discarded without loss.

Service Provider (SP)

Instance that provides a service that is configured for a single sign-on with the ID Broker, typically content providers or applications for pupils and teachers.

SSO Broker

The main job of the SSO Broker component is to handle multiple-tenant authentication, using pseudonyms. This involves the student (or her browser) doing the login and passing authentication tokens/tickets back and forth.