Definition and Basics
Articles about definition and basics from the Skycloak team.
JWT sub Claim Explained: Unique Only Per Issuer
The JWT sub claim identifies a user only within one issuer. Why your key must be iss plus sub, why…
8 min readWhat Is a Bearer Token? How Bearer Authentication Works
A bearer token grants access to whoever holds it. How to send it in the Authorization header, opaque vs JWT…
16 min readWhat Is a JWT Token? Structure, Claims and Signatures
A JWT token is a signed Base64URL string with a header, payload and signature. What each part holds, which claims…
12 min readWhat Is Entitlement Management? Entitlements vs Roles Explained
Entitlement management controls who holds which specific permission in which system, and for how long. Entitlements vs roles, and where…
10 min readWhat Is a Nonce in Security? Nonce vs State vs PKCE
A nonce is a number used once, a unique value that stops replay. Learn how nonces are generated and how…
14 min readWhat Is Just-in-Time (JIT) Access? JIT vs Standing Privileges
Just-in-time access grants a permission for one task and a limited time, then removes it. How JIT differs from standing…
7 min readAccess Token vs Refresh Token: Key Differences
Access tokens authorize API calls briefly; refresh tokens only obtain new tokens. How they differ, and what Gitea 28.1.0 fixed…
8 min readWhat Is a SAML Assertion? Structure and Signatures
A SAML assertion is the identity provider's signed statement about a user. Learn its XML structure, how it differs from…
10 min readWhat Is ReBAC? Relationship-Based Access Control vs RBAC
ReBAC grants access from relationships like 'owner of' or 'member of'. How it differs from RBAC and ABAC, when it…
10 min readOAuth Scopes Explained: Standard Scopes, Design, and Scopes vs Claims
An OAuth scope is a named permission a client requests and a token carries. The standard OIDC scopes, scopes vs…
9 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.