In this page you can find key terms and concepts used in Black Duck Portal.
| Term | Definition |
|---|---|
| Black Duck Portal | A centralized authentication and user management platform that provides unified access to Black Duck applications. |
| Black Duck Community | The main portal where customers can get licenses fulfillment, access the Black Duck Software, Inc. knowledge base, training courses, products documentation, submit and manage support cases and connect with other customers. |
| Black Duck® Continuous Dynamic™ (formerly WhiteHat Dynamic) | A production-safe dynamic application security testing (DAST) solution that rapidly detects vulnerabilities in running web applications. It uses a combination of continuous scanning, AI verification, and manual assessment by expert security engineers to deliver accurate and actionable results, with low false positives. For more information, see Black Duck® Continuous Dynamic™. |
| Application | Black Duck hosted products. In the Applications tab, the customer is able to see their active Black Duck applications. |
| Brute-Force Protection | Security method to detect and block repeated unauthorized login attempts. |
| Identity Provider (IdP) | An authentication and authorization system that manages user access to applications and services by verifying digital credentials. |
| Local user | Local users exist only in Black Duck Portal, and sign in with credentials managed in Black Duck Portal to then access your organization's applications. |
| Multi-Factor Authentication (MFA) | An additional security layer to authenticate an user through two or more forms of verification when signing in, such as authentication apps or security codes. |
| OpenID Connect (OIDC) | An authentication protocol supported by Black Duck Portal that allows users to sign in using credentials managed by their own organization's identity provider. |
| Organization administrator (Org admin) | Organization Admins can add, deactivate and delete local users, grant or revoke the Organization Admin role, trigger a password reset, reset their MFA enrollment, and clear brute-force protection blocks—all from the Black Duck Portal UI. The available management actions depend on whether a user is a local user or an SSO user. |
| Security Assertion Markup Language (SAML) 2.0 | An authentication protocol supported by Black Duck Portal that allows user to sign in using their corporate credentials without maintaining separate usernames and passwords. By default, SAML connections use service-provider-initiated (SP-initiated) authentication. After you enable single sign-on, users must access Black Duck Portal directly to start the authentication process. |
| Service account | A non-human identity that allows applications and services to authenticate with Black Duck Portal using the OIDC client credential flow. Unlike traditional service accounts that provide scoped API tokens, these service accounts use standard OAuth 2.0/OIDC protocols to obtain short-lived access tokens for machine-to-machine authentication. |
| Service Accounts access tokens | For Service Accounts, access tokens are bearer tokens that grant your application access to Black Duck Portal APIs. Tokens are valid for 24 hours (86400 seconds) from the time they are issued. Your application must include the access token in the authorization header of API requests. After a token expires, your application must request a new token using the service account credentials. |
| Service Accounts Audiences | An audience specifies the target API or service that the service account is authorized to access. When you create a service account, you can optionally select an audience to limit the scope of where the account's credentials can be used. The audience value is included in access tokens and verified by the target service to ensure tokens are used only for their intended purpose. |
| Service Accounts Authentication flow | Service accounts use the OIDC client credential grant flow for authentication. Your application presents the service account's credentials (Client ID and Secret) to the token endpoint, receives a short-lived access token, and uses that token to authenticate API requests. When the token expires, your application requests a new one using the same credentials. For more information, see Client Credentials Flow in the Auth0 documentation. |
| Service Accounts Client ID | The Client ID is a unique identifier for the service account. It is used together with the Client Secret to authenticate your application when requesting access tokens. The Client ID is not confidential and can be included in client-side code or configuration files. |
| Service Accounts Client Secret | The Client Secret is a confidential credential used to authenticate the service account. The secret is paired with the Client ID when requesting access tokens from the authentication endpoint. Unlike access tokens which expire after 24 hours, Client Secrets do not automatically expire and remain valid until manually rotated. Client Secrets must be kept secure and should never be exposed in client-side code, public repositories, or logs. We strongly recommend rotating secrets every 30-90 days to minimize the risk of unauthorized access if a secret is compromised. |
| Service Accounts Tenant ID | The Tenant ID identifies your organization within Black Duck Portal. It is required when requesting access tokens and ensures that service accounts can only authenticate within their designated organization scope. |
| Single Sign-On (SSO) | An authentication method to connect the customer's IdP to Black Duck Portal. |
| SSO user | SSO users are provisioned through the customer's identity provider (IdP), and use your IdP to sign in to Black Duck Portal. Because credentials for SSO users are managed externally, Black Duck Portal cannot reset their passwords, manage their MFA, or clear brute-force protection blocks. |
| System for Cross-domain Identity Management (SCIM) | SCIM provisioning automates user lifecycle management between your identity provider and Black Duck. While SSO handles authentication, SCIM provisioning handles provisioning—automatically creating, updating, and removing user accounts based on changes in your identity provider. |