A collection of all CA certificates from the CA issuing a client certificate through the root CA that serves as the first point of trust

A list of revoked certificates

The IIJ ID Service uses CRL to revoke client certificates when using external CA device restrictions.

A simple identity layer on top of the OAuth 2.0 protocol This service supports OpenID Connect Core 1.0.

SAML (Security Assertion Markup Language)

XML-based standard for exchanging user authentication information between different domains. This service supports SAML 2.0.

One of public keys issued to clients

Client certificates are used to authenticate clients. Clients send their client certificate and a signed message to a server during the authentication process.

Groups are the unit by which users are managed in this service. Users are more easily managed by creating groups with a name and email address and assigning users to the group.

Jobs are created for specific operations such as creating, editing, and deleting users and groups. Viewing jobs provides information on specific processes, run times, and success or failure of a process. Refer to "Viewing Jobs" for more information.

Notifications on the progress of CSV import process and user operations are sent. Refer to "Notifications" for more information.

Provisioning is the synchronization of ID information in ID management systems with external services. IDs can be centrally managed using an ID management system by utilizing provisioning.

The IIJ ID Service supports user and group provisioning to external services. The IIJ ID Service can also be provisioned with Azure AD user and group information.

Authentication method that uses Active Directory accounts

Clients that have joined the domain can log into IIJ ID Service and linked services without having to go through authentication again.In addition, this service supports form authentication, making it possible to authenticate clients that cannot join the domain with Active Directory IDs and passwords.

Single sign-on process executed by IdP first starting user authentication without receiving an authentication request from SP and then passing the SAML response to SP after the authentication is successful

An XML file that includes IdP information The IdP metadata provided by the IIJ ID Service can be used by SP for an SAML link if SP can configure such SAML link

SAML

(Security Assertion Markup Language)

XML-based standard for exchanging user authentication information between different domains The IIJ ID Service supports SAML 2.0.

SAML attribute statement

(SAML Attribute Statement)

Single sign-on process executed by IdP first starting the user authentication process after receiving an SAML authentication request from SP and then passing the SAML response to SP after the authentication is successful

An XML file that includes IdP information The IdP metadata provided by IIJ ID can be used by SP for an SAML link if SP can configure such SAML link.

This is one type of flow in which RP receives ID tokens from OP. OP appends the authorization code to the redirect URL specified in the authorization request and passes the URL to RP. RP retrieves the ID token by presenting the authorization code to OP.

This is one type of flow in which RP receives ID tokens from OP. OP appends the ID token to the redirect URL specified in the authorization request and passes the URL to RP.

A simple identity link protocol based on OAuth 2.0 The IIJ ID Service supports OpenID Connect Core 1.0.

An application that uses OpenID Connect to authenticate users and provide services to users

Client secret

(client_secret)

Redirect URL

(redirect_uri)

The process to import accounts from Azure AD will be aborted when the number of accounts that would be removed exceeds a configured value.

The account removal rate is calculated as follows.

(Number of accounts that would be removed by the import process / Number of accounts synchronized with an upstream user store) × 100