152 lines
5.1 KiB
Plaintext
152 lines
5.1 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Domain Model Index
|
|
description: |-
|
|
Reference documentation for Boundary's domain model.
|
|
---
|
|
|
|
# Overview
|
|
|
|
Boundary has a rich domain model
|
|
consisting of resources that represent
|
|
[IAM][] principals,
|
|
infrastructure,
|
|
and the means to tie them together.
|
|
This section contains information about the various resources within the domain
|
|
and how they relate to each other.
|
|
|
|
|
|
|
|
## Resources
|
|
|
|
A resource is any element in Boundary
|
|
to which principals may be granted [permissions][].
|
|
All resources have an ID which is unique within Boundary.
|
|
|
|
### Summary of Resources
|
|
|
|
- **[Account][]** :
|
|
An account is a resource
|
|
that represents a unique set of credentials
|
|
issued from a configured [authentication method][]
|
|
which can be used to establish the identity of a [user][].
|
|
|
|
- **[Credential][]** :
|
|
A credential is a data structure containing one or more secrets
|
|
that binds an identity to a set of permissions or capabilities
|
|
on a [host][] for a [session][].
|
|
|
|
- **[Credential Library][]** :
|
|
A credential library is a resource
|
|
that provides [credentials][]
|
|
of the same type and same access level
|
|
from a single [credential store][].
|
|
|
|
- **[Credential Store][]** :
|
|
A credential store is a resource
|
|
that can retrieve, store, and potentially generate [credentials][]
|
|
of differing types and differing access levels.
|
|
It may also contain [credential libraries][].
|
|
|
|
- **[Authentication Method][]** :
|
|
An authentication method is a resource
|
|
that provides a mechanism
|
|
for [users][] to authenticate to Boundary.
|
|
|
|
- **[Group][]** :
|
|
A group is a resource
|
|
that represents a collection of [users][]
|
|
which can be treated equally
|
|
for the purposes of access control.
|
|
|
|
- **[Host][]** :
|
|
A host is a resource
|
|
that represents a computing element with a network address
|
|
reachable from Boundary.
|
|
|
|
- **[Host Catalog][]** :
|
|
A host catalog is a resource
|
|
that contains [hosts][] and [host sets][].
|
|
|
|
- **[Host Set][]** :
|
|
A host set is a resource
|
|
that represents a collection of [hosts][]
|
|
which are considered equivalent
|
|
for the purposes of access control.
|
|
|
|
- **[Managed Group][]** :
|
|
A managed group is a resource that groups [accounts][] based on criteria
|
|
established by a third-party service backing the [authentication method][]. It
|
|
can be used as a principal in [roles][].
|
|
|
|
- **[Role][]** :
|
|
A role is a resource
|
|
that contains a collection of [permissions][]
|
|
which are granted to any principal assigned to the role.
|
|
|
|
- **[Session][]** :
|
|
A session is a set of related connections between a [user][] and a [host][].
|
|
A session may include a set of [credentials][]
|
|
which define the permissions granted to the [user][] on the [host][] for the duration
|
|
of the session.
|
|
|
|
- **[Scope][]** :
|
|
A scope is a [permission][] boundary modeled as a container.
|
|
|
|
- **[Target][]** :
|
|
A target is a resource
|
|
that represents a networked service
|
|
with an associated set of permissions
|
|
a [user][] can connect to
|
|
and interact with
|
|
through Boundary
|
|
by way of a [session][].
|
|
|
|
- **[User][]** :
|
|
A user is a resource
|
|
that represents an individual person or entity
|
|
for the purposes of access control.
|
|
|
|
## Next Steps
|
|
|
|
When getting started with Boundary,
|
|
the first resource to look at should probably be [Scopes][].
|
|
Every other resources is either contained within a scope,
|
|
or contained within another resource
|
|
that is itself contained within a scope.
|
|
That page can help you understand the structure of resources within Boundary.
|
|
|
|
[iam]: https://en.wikipedia.org/wiki/Identity_management
|
|
[account]: /docs/concepts/domain-model/accounts
|
|
[accounts]: /docs/concepts/domain-model/accounts
|
|
[authentication method]: /docs/concepts/domain-model/auth-methods
|
|
[authentication methods]: /docs/concepts/domain-model/auth-methods
|
|
[credential library]: /docs/concepts/domain-model/credential-libraries
|
|
[credential libraries]: /docs/concepts/domain-model/credential-libraries
|
|
[credential store]: /docs/concepts/domain-model/credential-stores
|
|
[credential stores]: /docs/concepts/domain-model/credential-stores
|
|
[credential]: /docs/concepts/domain-model/credentials
|
|
[credentials]: /docs/concepts/domain-model/credentials
|
|
[group]: /docs/concepts/domain-model/groups
|
|
[groups]: /docs/concepts/domain-model/groups
|
|
[host catalog]: /docs/concepts/domain-model/host-catalogs
|
|
[host catalogs]: /docs/concepts/domain-model/host-catalogs
|
|
[host set]: /docs/concepts/domain-model/host-sets
|
|
[host sets]: /docs/concepts/domain-model/host-sets
|
|
[host]: /docs/concepts/domain-model/hosts
|
|
[hosts]: /docs/concepts/domain-model/hosts
|
|
[managed group]: /docs/concepts/domain-model/managed-groups
|
|
[role]: /docs/concepts/domain-model/roles
|
|
[roles]: /docs/concepts/domain-model/roles
|
|
[scope]: /docs/concepts/domain-model/scopes
|
|
[scopes]: /docs/concepts/domain-model/scopes
|
|
[project]: /docs/concepts/domain-model/scopes#projects
|
|
[session]: /docs/concepts/domain-model/sessions
|
|
[sessions]: /docs/concepts/domain-model/sessions
|
|
[target]: /docs/concepts/domain-model/targets
|
|
[targets]: /docs/concepts/domain-model/targets
|
|
[user]: /docs/concepts/domain-model/users
|
|
[users]: /docs/concepts/domain-model/users
|
|
[permission]: /docs/concepts/security/permissions
|
|
[permissions]: /docs/concepts/security/permissions
|