Glossary Item Box

Government Gateway 2.2.0 (MR-01) ISV Developer Help (Doc Version 06/03/08) | Send comments on this topic.

# Glossary

Term | Description
--- | ---
Activation PIN | A unique alphanumeric string sent by Royal Mail to the user at a contact address obtained directly from the service, related to the identifier provided by the person enrolling. This is used to enable (activate) the enrolled service.
Admin user | Manage services (for service owners) through the SOAP Admin and KnowFactUpload Interfaces. Admin users are created for a services using the Spoke Admin tool.
Agent | A third party, such as an accounting firm, who acts on behalf of a principal (an Individual or an Organisation). This is in contrast to a principal who accesses services on their own behalf. The Agent category can have multiple users and each user can have assistants. An agent is therefore often referred to as an agent organisation or agent group.
Agent Code | A code that uniquely identifies an agent organisation (also known as agent group). Generated by the Gateway at registration. Used by a principal (citizen or organisation) to allocate an enrolment to an agent. Note that the Agent Code is not available (to principals) programmatically through the Gateway; it must be obtained from the agent in some other way.
Agent Enrolment | An enrolment made by an agent organisation in a service. The agent organisation can then accept principal enrolments for that service and act on them on behalf of principals. See Assign Agent Enrolment and Assign Client Allocation.
Agent Friendly Name | A brief description of the agent organisation (max 64 chars) supplied (by the agent organisation) at registration. This is visible to principals. Note for a principal to allocate an enrolment it requires the Agent Code.
Agent group | See Agent.
Agent ID | The name of the agent organisation (max 12 chars) supplied (by the agent organisation) at registration. This is visible to principals. Note for a principal to allocate an enrolment it requires the Agent Code
Agent organisation | See Agent.
Agent Service | A service in which agents can enrol is said to offer an agent service. Note a service may offer a principal service but may or may not offer an associated agent service. Only if it offers an agent service are agents able to work on behalf of principals.
Allocate Agent | A principal (the client) allocates a principal enrolment to an agent organisation so the agent organisation can act on the enrolment in the service on behalf of the principal.
Application | See ISV Application
Assign Agent Enrolment | An agent user assigns an agent enrolment to themselves, their assistants, or other users in the agent organisation (so they can accept principal enrolments). If there is only one user in the agent organisation the assignment is done automatically.
Assign Client Allocation | An agent user assigns a principal enrolment (allocated to the agent organisation by a principal) to themselves, their assistants or users in the agent organisation. If there is only one user in the agent organisation the assignment is done automatically.
Assign Principal Enrolment | An organisation user assigns a principal enrolment to themselves, their assistants, or other users in the organisation (so they can use the service). If the principal is an Individual or they are the only user in an Organisation the assignment is done automatically.
Assistant | Person created by and is permitted to act on behalf of a user within an organisation (Organisation or Agent). A user is responsible for all assistants that they create. An assistant has a subset of a user’s capability and they cannot create or delete other assistants or users.
Authentication | The process of validating the credential information (digital certificate or User ID/password).
Authentication Level | Specified for each service (based on HMG Authentication Levels, but Gateway adds a level 1.5): Level 0:To enrol in service and access service transactions/forms: Type 0: A credential is not required Type 1: A valid User ID or valid certificate (though not necessarily known to Gateway) is required Type 2: A valid certificate (though not necessarily known to Gateway) is required Level 1: At least a User ID/Password is required to enrol in service and to access service transactions/forms Level 1.5: At least a User ID/Password with security phrase is required to enrol in service (to access service transactions/forms requires a certificate) Level 2 and 3: A certificate is required to enrol in service
Authentication Type | The method used to authenticate a user. The options currently are: User ID/password User ID/password with security phrase Certificate/Certificate-based smart card
Auto-Activation | Allows a user to immediately access a service following a successful enrolment – an Activation PIN is not required. This is specified when a service is set up.
Base64 Encoding | Encodes binary values into characters. Each 6-bit value (i.e. 0-63 in decimal) is converted into a character set comprising of a 64-character alphabet. This alphabet consisting of alphabet characters (A–Z, a–z), numerals (0–9), and the "+" and "/" symbols.
CAP (Common Authentication Page) | Allows users to login once to Gateway and then access any other (participating) Web Portal (within the same browser session) without the need to login again.
Certificate | See Digital Certificate.
Certification Authority | Issues digital certificates to users. Digital certificates for use with the Gateway are available from BT Trust Services (not supported by Inland Revenue services), Equifax and Chamber SimplySign.
Correlation ID | A unique identifier assigned by the Gateway. For example a correlation ID is returned in response to a document (form) submission. This can be used (in DSP) to poll for the response.
Credential | A registered user of the Gateway; an individual (citizen), or User/Assistant in a principal or agent organisation.
Credential Group | Refers to the set of credentials within organisation or agent organisation.
Credential Identifier | A unique string assigned to a given user that does not change over time or after credential upgrades.
Credential Role | Can be either User or Assistant.
Credential Type | Services normally require a user to be authenticated before they can use service transactions. At registration the user selects either a digital certificate or a User ID/password credential type.
DAT (Departmental Activation Token) | A one-time activation PIN (under the control of the service owner) that enables the service owner to mailshot potential users with an invitation to use an online service. Having enrolled and provided the correct known facts for the service, the user can then input their supplied DAT to activate the enrolment and immediately use the service, rather than wait 2-10 days for a letter with an the Activation PIN – the usual enrolment process.
De-enrolment | The process of removing the linkage between a credential group and identifiers with a specific service. In the case of an organisation or agency the enrolment is not just unavailable to the user that requests the de-enrolment but the entire organisation or agency organisation.
DIS (Departmental Interface Server) | Provides the interface between the service owner (i.e. Department) and the central Gateway. Communication with the Gateway uses SOAP reliable messaging and XML GovTalk standards.
Digital Certificate | An X.509 digital certificate contains identifying information and a public key. The owner of the certificate possesses the corresponding private key, which proves the certificate (and therefore the information on it) belongs to them. Any attempt to change information on the certificate will be detected. The certificate/private key is also used to sign transactions. A certificate is obtained from a certification authority.
Direct Enrolment | See Principal Enrolment and Agent Enrolment.
Distributed Known Facts | See Known Facts
DRM (Delegated Rights Management) User | A DRM User can improve operational efficiency by allowing an organisation/agent (registered with the Gateway) to use their existing user (employee) accounts to act on direct enrolments (and client allocations for an agent organisation), rather than create/managing a (parallel) hierarchy of Gateway User and Assistant accounts to control who can use particular enrolments. A DRM User (created by a existing User in the organisation/agent) uses the GsoDelegateRights method to temporarily associate internal organisation/agent user (employee) accounts with Gateway enrolments that they can then act on. Additionally a DRM User's authentication credential (i.e. User ID/password or certificate) can be used in (i.e. to authorise) DSP submissions.
End User | See User.
Enrolment | Enrolment is the process of linking an individual or organisation (credential group) to identifiers for a specific service. See Principal Enrolment and Agent Enrolment.
Gateway token (or GatewayToken) | A WS-Security custom token used to authenticate methods called on the SOAP Portal or Public Interfaces by the Gateway. There are 3 variants: “Standard” is valid for 4 hours “Non-Repudiation” is valid for a single call (required by some methods) “Expired Password” used by the GsoSetExpiredPassword method when a user's password has expired
Gov-Individual | Same as the Individual registration category but configured with stricter password rules, such as password expiry. Also, this registration category uses GsoResetPassword rather than GsoResetAndReturnPasword to reset their password online.
Gov-Organisation | Same as Government registration category but configured with stricter password rules, such as password expiry. Also, this registration category uses GsoResetPassword rather than GsoResetAndReturnPasword to reset their password online.
GSI (Government Secure Intranet) | Physically secure Intranet linking service owners.
HTTPS (HyperText Transfer Protocol Secure) | Employs the Secure Socket Layer (SSL) protocol to provide a secure HTTP communication channel over the Internet between the user’s computer (browser or application) and the Portal/Gateway, and between the Portal and the Gateway.
Identifiers (also referred to keys) | Uniquely identifies a user (credential) within a service. Identifiers for a service are typically a subset of the known facts.
Identifiers For Display | A successful enrolment returns the identifiers to the caller (normally a Portal).
Indirect Enrolment | A principal enrolment that has been allocated to an agent organisation for them to work on.
Individual | A principal registration category that can contain only a single user and no assistants; it is intended for personal use (a citizen). This is in contrast to the Organisation and the Agent registration categories that support multiple users and assistants.
Intermediary | See Agent.
ISV (Independent Software Vendors) Application | From the Gateway perspective this is an application (written by an ISV – e.g. Sage) that runs on a client (e.g. a PC) that can use, the facilities offered by the Gateway – in particular the document submission protocol (DSP) to submit transactions/forms to services hosted by government departments, Local authorities or other authorised organisations. For example, an accounting or tax self assessment application submitting appropriate business forms through the Gateway to HRMC. The user (i.e. individual, organisation user or agent) authentication credentials attached to the submitting form will be checked by the Gateway. An ISV application can authenticate a user (i.e. log them on to Gateway) but, because they run in the user environment, they have very limited R&E capabilities (they use the SOAP Public Interface methods). This is different to Portals – they can register users with the Gateway and provide the full set of enrolment functionality offered by the Gateway (SOAP Portal Interface methods).
Known Facts | Pieces of information required by a service from a user that only the user should know. During the service enrolment process (or when a user has forgotten their User ID/password/security phrase), the known fact values supplied by the user are checked against a reference set of known facts to verify who the user is to the service. The reference set of known facts can either be: Held on the Gateway (i.e. previously uploaded to the Gateway from the services) Held by each service (i.e. distributed known facts) which requires the Gateway to send the user supplied values to the appropriate service for checking. Distributed known facts (DKFs) where introduced in release 1.68 of the Gateway.
Known Fact Extract | The known facts/identifiers are uploaded from the service owners for each service. This gives the Gateway access to this information locally.
Organisation (with a uppercase "O") | A principal registration category for commercial businesses or non-commercial organisations that need multiple users and assistants to access services.
organisation (with a lowercase "o") | Refers to either a principal organisation or an agent organisation.
Name Space | In a XML schema, used to uniquely qualify element names – thereby avoiding potential name conflicts with elements of the same name in other XML schemas (vocabularies).
Password | An alphanumeric string used in conjunction with a User ID for authentication. The user chooses the password when their account is created.
Portal | A Portal typically refers to a web Portal (i.e. web site). Departments (i.e. a Government Departments, Local Authorities or other Government Agencies) provide online access to secure interactive services, as well as generally available information, through Portals. A Portal uses the Gateway to register users with the Gateway and enrol them in services. Users can then logon to the Portal (i.e. authenticate with the Gateway) and use these services securely to submit business forms - for example, file a Self Assessment tax return online from the HM Revenue & Customs Web site(http://www.hmrc.gov.uk).
Portal Identifier | Identifies a specific Portal. A service owner may have the same service accessible from a number of Portals.
Principal Enrolment | An enrolment made by an principal organisation in a service. The principal organisation use this service.
Principal Service | A service in which a principal can enrol is said to offer a principal service. If this service also supports agents (allows them to enrol) the service is said to offer an agent service.
Registration | Registration is the process of making a user known to the Gateway. This involves specifying their registration category and selecting their credential type. Once a user (typically referred to as a credential) has been registered, they can logon on the Gateway.
Registration Category | Specified at registration and can be a Principal (Individual, Organisation, Gov-Individual or Gov-Organisation) or an Agent.
SAML (Security Assertion Markup Language) Assertion token | Contains user identity and entitlement (i.e. enrolment) information. Within Gateway SAML Assertion tokens are used to provide: A single sign-on (SSO) facility across multiple (Department) Web Portals A secure and efficient way for a Portal to get a user’s details and enrolments.
Service | Consists of a grouping of one or more transactions. A service represents the lowest level of granularity by which access is granted. A service specifies the minimum authentication level a credential must have to access (see/enrol) in the service. See Authentication level.
Service Owner | A government department, local authority or other organisation responsible for one or more services.
Single Sign-On Portal (SSOP) | See CAP.
SOAP (Simple Object Access Protocol) | Lightweight, XML-based protocol for exchanging information in a decentralised, distributed environment. Provides an open, non-platform specific, methodology for application-to-application communication known as Web services. The Gateway uses SOAP over the HTTPS protocol to achieve secure communication.
SOAP Admin Interface | Exposes administration functionality designed to be called by a service owner.
SOAP KnownFactUpload Interface | Allows service owners to bulk upload known fact to the Gateway.
SOAP Portal Interface | Exposes a full range of methods to be called from a Portal.
SOAP Public Interface | Exposes methods that can be called directly from an application. This is restricted to the 'read-only' methods offered by the SOAP Portal Interface.
SSL (Secure Sockets Layer) | Protocol uses Public Key Infrastructure (PKI) technology to provide encrypted communication over the Internet. It is used by the HTTPS access method.
STS (Secure Ticket Service) | The Government Gateway’s WS-Security ticketing service.
Target Credential Identifier | See Credential Identifier.
Target Resource | For a Portal it identifies Services accessible through the Portal For SAML Standard Gateway SAM 1.1 Assertion (version 1)created for Portal's implemented prior to release 2.2 of the Gateway, the Target Resource determined: Whether to include GsoGetUserDetails XML output document (as a string). The version of GsoGetUserDetails (either 1.6.5/6 or 1.6.7), and for 1.6.7 whether to include: The user's current authentication level All of the user's available authentication types/levels Whether to include a GsoGetAssignedEnrolments XML output document (as a string) Note: For Gateway 2.2 and above, a new version of the SAML Standard Gateway SAM 1.1 Assertion (version 2) is used - it does not include the GsoGetUserDetails and the GsoGetAssignedEnrolments XML strings.
TicketBook token | Security authentication token used on the Legacy Interface.
Transaction | A transaction is the smallest single element of work that a person can perform via the Gateway such as the submission of an electronic form. See Service.
Transaction Engine | Core component of the Gateway that and provides an interface to enable electronic forms and requests to be submitted to service owners
User | Can refer to a general user of the system. It is also used specifically to refer to a User in a principal or an agent organisation.
User ID | A unique alphanumeric string generated by the Gateway at registration (not selected by the user) that is used in conjunction with a password for authentication.
Username token (or UsernameToken) | A WS-Security token that encapsulates the user's User ID and password credential. Used to authenticate methods called on the SOAP Admin and KnownFactUpload Interfaces by the Gateway (a new UsernameToken is generated for each call). Also used to request GatewayTokens, SAML Assertions and TicketBook tokens from the STS.
User Type | Principal, Agent and Admin.
Web Services | An open standards approach that uses XML, SOAP, WSDL and UDDI standards to enable integration of web-based applications (independent of operating system platform or programming language) across the Internet. Note Gateway Web services are not published through UDDI.
Web Services Description Language (WSDL) | XML language used to describes a Web services capabilities - binding information and technical interface definitions.
X509Certificate | Base64 representation of a X.509 certificate.
X509Security token (or X509SecurityToken) | A WS-Security token that encapsulates the user's X.509 certificate credential. Used to authenticate methods called on the SOAP Admin and KnownFactUpload Interfaces by the Gateway. A new X509SecurityToken is generated for each call. Also used to request GatewayTokens, SAML Assertions and TicketBook tokens from the STS.
XML (Extensible Markup Language) | A specification designed especially for the definition, transmission, validation, and interpretation of data between organisations.
XML Schema | Describes a particular XML syntax. It defines the structure of the document in terms of elements and sub-elements, whether they are optional or not and the number of times they can be repeated. It also specifies any attributes associated with an element.

© Crown Copyright 2008. All rights reserved