A subject is the entity referred to by an account, policy, or access decision. It may be the principal making a request, but it can also be another entity represented or managed by that principal. section 3.1
Acting on someone else’s behalf
When a parent accesses a system for their child, the parent is the principal making the request and the child is the subject being referred to. Distinguishing these roles prevents authorization discussions from treating the requester and the affected entity as automatically identical. section 3.1
Keep the surrounding identity and authorization terms separate:
- An account stores attributes, credentials, roles, and other context about an entity. section 3.1
- An identifier uniquely identifies an account within a system namespace. section 3.1
- A principal makes the request; a subject is the entity referred to by the account, policy, or decision. section 3.1
- Some authorization systems use subject as an older or alternate term for principal, while others avoid it because it can also suggest a resource. section 4.3.2
In XACML, the principal is represented as a subject through request attributes such as username, department, and clearance. Policies evaluate those attributes alongside action, resource, and environmental context rather than using a first-class principal object. section 8.1.2
Figure 3.1 Relationships among key identity concepts used in authentication and authorization. A principal (an actor such as a user or service) controls an identifier that uniquely identifies an account. The account stores attributes about a subject, which might be the principal itself or another entity the principal manages.
Use the relationship diagram to distinguish the principal controlling an identifier, the account storing attributes, and the subject represented by that account. section 3.1
