FCP FortiAuthenticator 6.5 key terms

The process of verifying that a user or device is who it claims to be, typically by checking a password, certificate, or token before granting access to a resource.

The step that decides what an authenticated identity is permitted to do, such as which resources, applications, or network segments it may reach.

A system that creates, stores, and asserts identity information about users, issuing authentication statements that relying parties trust instead of checking credentials themselves.

An application or resource that relies on an identity provider to authenticate users and receives identity assertions before granting access to protected content.

A mechanism where one successful authentication grants access to multiple applications or services without prompting the user again, reducing password fatigue and repeated logins.

An XML-based federation standard for exchanging authentication and authorization data between an identity provider and service providers, commonly used for browser-based single sign-on.

A signed XML document issued by an identity provider that states a user's authentication status and attributes, which the service provider validates before allowing access.

An authorization framework that lets an application obtain limited access tokens to act on a user's behalf against an API, without sharing the user's actual credentials.

An identity layer built on OAuth 2.0 that adds authentication, providing an ID token with verified user claims so applications can confirm who the user is.

A widely used client-server protocol for centralized authentication, authorization, and accounting of network access, commonly applied to VPN, Wi-Fi, and switch logins.

A network device such as a firewall, wireless controller, or VPN gateway that forwards user credentials to a RADIUS server and enforces the returned accept or reject decision.

A pre-shared key configured on both a RADIUS client and server to authenticate and protect the integrity of their protocol messages; it must match exactly on both ends.

A directory access protocol used to query and bind against directory services such as Active Directory, allowing a server to validate user credentials and read group memberships.

Microsoft's directory service that stores users, computers, and groups; FortiAuthenticator can join or query it to authenticate domain accounts and map group membership.

The configuration that translates directory or remote group memberships into local groups on the authentication server so policies and portal access can be applied by group.

An account record on the authentication server that represents a user stored in an external directory or RADIUS source rather than created locally on the appliance.

An account created and stored directly on the FortiAuthenticator appliance, with its own password and attributes, independent of any external directory service.

A container of local and remote users used to apply consistent portal access, token policy, and authorization rules to many accounts at once.

Requiring two independent evidence types, such as a password plus a one-time code, so a stolen password alone cannot grant access.

A code valid for only a single login or short time window, usually generated by a token or app, which defeats replay of captured credentials.

Fortinet's hardware or mobile soft token that generates time-based one-time passwords for multifactor authentication against FortiAuthenticator and other Fortinet products.

A trusted entity that issues and signs digital certificates; on FortiAuthenticator it can be a local CA or an external CA whose certificates validate users and devices.

A signed list published by a certificate authority naming certificates that are no longer valid, which validators check to reject revoked user or device certificates.

Online Certificate Status Protocol, a method of querying a responder in real time to learn whether a specific certificate has been revoked, instead of downloading a full list.

A web page presented to unauthenticated users on a network that collects credentials or token codes before granting internet or resource access.

Fortinet Single Sign-On, a mechanism that shares Windows domain logon information with Fortinet devices so users are authenticated transparently without re-entering credentials.

An FSSO deployment where a collector agent on a domain server gathers logon events and forwards user-to-IP mappings to Fortinet devices for transparent authentication.

An agentless FSSO method where the Fortinet device or FortiAuthenticator queries domain controllers directly for logon sessions instead of relying on a collector agent.

A deployment of two or more appliances in a cluster that synchronize configuration and data so service continues if a node fails.

A group of FortiAuthenticator nodes operating together for redundancy and load sharing, with a primary node replicating configuration to secondary members.

An exported copy of the appliance's settings and data that can be restored to recover from failure or to replicate a known-good configuration.

The policy and storage settings that determine how long authentication, accounting, and event logs are kept locally or forwarded to a remote syslog server.

A standard protocol for sending event and authentication log messages from the appliance to a remote collector for centralized retention and correlation.

Simple Network Management Protocol, used to poll health and performance metrics from the appliance and to send traps when monitored conditions cross thresholds.

A Cisco-developed protocol for centralized authentication and per-command authorization of administrative access to network devices, separating authentication from authorization.

A credential issued after successful OAuth authorization that the client presents to an API to prove it may access specific protected resources for a limited time.

The part of RADIUS that records session start, interim updates, and stop records so administrators can track usage, duration, and disconnect causes for network access.