Definition and Basics
Articles about definition and basics from the Skycloak team.
JWT sub Claim Explained: Unique Only Per Issuer
The JWT sub claim identifies a user only within one issuer. Why your key must be iss plus sub, why…
8 min readWhat Is Entitlement Management? Entitlements vs Roles Explained
Entitlement management controls who holds which specific permission in which system, and for how long. Entitlements vs roles, and where…
10 min readWhat Is Just-in-Time (JIT) Access? JIT vs Standing Privileges
Just-in-time access grants a permission for one task and a limited time, then removes it. How JIT differs from standing…
7 min readAccess Token vs Refresh Token: Key Differences
Access tokens authorize API calls briefly; refresh tokens only obtain new tokens. How they differ, and what Gitea 28.1.0 fixed…
8 min readWhat Is a SAML Assertion? Structure and Signatures
A SAML assertion is the identity provider's signed statement about a user. Learn its XML structure, how it differs from…
10 min readWhat Is ReBAC? Relationship-Based Access Control vs RBAC
ReBAC grants access from relationships like 'owner of' or 'member of'. How it differs from RBAC and ABAC, when it…
10 min readOAuth Scopes Explained: Standard Scopes, Design, and Scopes vs Claims
An OAuth scope is a named permission a client requests and a token carries. The standard OIDC scopes, scopes vs…
9 min readID Token vs Access Token: Differences and How to Validate
An ID token tells your app who signed in; an access token tells an API what the caller may do.…
7 min readThe Joiner-Mover-Leaver (JML) Process for SaaS Teams
The joiner-mover-leaver (JML) process explained: what each stage means, why movers and leavers cause audit findings, and how SaaS teams…
8 min readWhat Is Identity Brokering? One Login Box for Social and Enterprise IdPs
Identity brokering lets one identity provider sign users in through Google, Okta or Entra and issue its own token. Learn…
7 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.