Security Terms Glossary

Terms related to SCHEMABOUND’s identity federation, authentication/authorization mechanisms, cryptographic protocols, and host hardening configurations. These terms are relevant when configuring mTLS, JWT rotation, LDAP sync, RBAC mapping, or SCIM provisioning.

API Key Registry

A persistent store of per-client API keys used for service-to-service authentication outside the OIDC/JWT flow. Each key carries a scoped set of permissions and can be rotated without affecting other clients. Keys are stored hashed (never plaintext) and rotated via the SCHEMABOUND_API_KEY_ROTATION schedule.

Casbin ABAC Integration

Integration with the Casbin library for Attribute-Based Access Control (ABAC). SCHEMABOUND’s RBAC roles are mapped to Casbin subject-object-action triples, enabling fine-grained policies that combine role membership with runtime attributes (organization ID, table name prefixes, intent type). Casbin policies are loaded at startup and hot-reloaded on change.

See also: RBAC Role Mapping, Policy Evaluation

Host Hardening: SSSD and PAM

Linux system hardening configuration using System Security Services Daemon (SSSD) for identity integration with LDAP/AD directories, combined with Pluggable Authentication Modules (PAM) for enforcing authentication policies. SCHEMABOUND deployment nodes are hardened following these settings to prevent credential theft, lateral movement, and privilege escalation attacks against the runtime itself.

See also: LDAP Sync, SCIM Provisioning

JWT Secret Rotation

The process of rotating JSON Web Token signing keys without downtime. SCHEMABOUND supports rolling key rotation via SCHEMABOUND_JWT_SECRETS (comma-separated list): new tokens are signed with the last entry; old entries remain valid until explicitly removed. This enables zero-downtime key rotation for HS256, RS256, and ES256 algorithms.

See also: OIDC Token Validation, API Key Registry

LDAP Group-to-RBAC Role Mapping

The mechanism that maps LDAP directory groups to SCHEMABOUND RBAC roles. When a user authenticates via LDAP, their group memberships are evaluated against the mapping rules defined in SCHEMABOUND_LDAP_GROUP_MAP; matched groups grant corresponding RBAC roles (e.g., cn=auditors,dc=example → role:audit_viewer). Groups not matching any rule receive no SCHEMABOUND permissions.

See also: LDAP Sync, RBAC Role Mapping

LDAP Sync

The periodic synchronization of user and group objects from an external LDAP or Active Directory directory into SCHEMABOUND’s identity layer. SCHEMABOUND uses SSSD for bind authentication and pulls group membership via LDAP filters; synced entities are used exclusively for RBAC role assignment, never as primary credentials.

mTLS Setup

Mutual Transport Layer Security configuration for service-to-service authentication. SCHEMABOUND uses schemabound-certgen to generate Certificate Authorities, server keys, and client bundles; clients present certificates during gRPC handshake and the server validates them against the CA before accepting any request. Development mode is available via SCHEMABOUND_MTLS_DEV_MODE.

OIDC Token Validation

The process of validating OpenID Connect tokens presented by clients for authentication. SCHEMABOUND validates JWTs against the configured issuer’s JWKS endpoint, checks expiration (exp), issued-at (iat), and audience (aud) claims, and extracts identity context (user ID, organization) into QueryRuntimeContext. BYOI-compatible providers include Entra ID, Okta, Keycloak, and any standard OIDC endpoint.

RBAC Role Mapping

The mechanism that assigns role memberships to authenticated users based on identity attributes (groups, claims, custom policies). SCHEMABOUND’s RBAC model supports hierarchical roles (admin > writer > reader), role inheritance, and deny-overrides. Roles are evaluated through the Casbin ABAC engine for fine-grained control over table access, intent permissions, and administrative operations.

SCIM Provisioning

System for Cross-domain Identity Management (SCIM v2) server implementation within SCHEMABOUND. Enables automated user lifecycle management: when a user is created, updated, or deactivated in the external IdP, SCIM events trigger corresponding RBAC role assignments or revocations in SCHEMABOUND without manual intervention.

See also: LDAP Sync, Host Hardening: SSSD and PAM

Session Management

The lifecycle management of authenticated user sessions within SCHEMABOUND. Includes session creation on first successful authentication, token refresh on expiry, revocation on logout or security event, and audit logging via SessionActivityHandler. Sessions are scoped to organization boundaries; cross-organization session reuse is blocked by policy evaluation.

Keyboard shortcuts

SCHEMABOUND Framework Documentation