A unique identifier is a name that distinguishes an entity or account within a defined namespace. It lets a digital system recognize and remember a party without repeatedly describing it. An email address, username, social security number, database table name, or tenant_id can serve this role when uniqueness is guaranteed in its relevant context. section 2.4.1 section 13.3.1
Uniqueness is contextual rather than universal: the same value may be valid in one namespace and ambiguous in another. An identifier normally points to an account, while a principal makes a request and a subject is the entity referred to in an account or decision. section 2.4.1 section 3.1
Identifiers perform several related jobs:
- Anchor enrollment by connecting authentication credentials, attributes, and an ongoing relationship with a service. section 3.4.1
- Select the account being claimed during authentication, then work with passwords or other factors that prove control of it. section 3.6.3
- Define authorization scope when identifiers such as tenant_id establish separate namespaces and enforceable boundaries. section 13.3.1
Session cookie as an identifier
A website can return a random session identifier to a browser, which resends it with later requests so the service can maintain a relationship across stateless HTTP interactions. Because the identifier is treated as a shared secret, interception, guessing, or theft can enable impersonation; public identifiers such as email addresses are unsuitable for this purpose. section 3.6.1
Figure 3.1 Relationships among key identity concepts used in authentication and authorization. A principal (an actor such as a user or service) controls an identifier that uniquely identifies an account. The account stores attributes about a subject, which might be the principal itself or another entity the principal manages.
Trace how a principal controls an identifier, how that identifier selects an account, and how the account stores attributes about the subject. section 3.1
