java - What is the meaning of Subject vs. User vs. Principal in a Security Context? -

in context of security frameworks, few terms commonly occur subject, user , principal, of have not been able find clear definition , difference between them.

so, these terms mean, , why these distinctions of subject , principal needed?

these hierarchical in way genus, species , individual hierarchical.

• subject - in security context, subject entity requests access object. these generic terms used denote thing requesting access , thing request made against. when log onto application subject , application object. when knocks on door visitor subject requesting access , home object access requested of.
• principal - subset of subject represented account, role or other unique identifier. when level of implementation details, principals unique keys use in access control lists. may represent human users, automation, applications, connections, etc.
• user - subset of principal referring human operator. distinction blurring on time because words "user" or "user id" commonly interchanged "account". however, when need make distinction between broad class of things principals , subset of these interactive operators driving transactions in non-deterministic fashion, "user" right word.

subject/object inherits same terms used in grammar. in sentence subject actor , object thing acted on. in sense use has been around since before computers invented. in security context, subject can make request. noted above, need not limited security , broad classification. interesting thing subject implies object. without object, there no subject.

principals subjects resolve to. when present credit card subject , account number principal. in other contexts user id or state-issued identification principal. principals can associated many types of subject not people. when applications make requests system-level functions principal may signer of signed executable code module in case user driving request still subject.

user more specific subject or principal in refers interactive operator. why have graphical user interface , not graphical principal interface. user instance of subject resolves principal. single user may resolve number of principals principal expected resolve single user (assuming people observe requirement not share ids). in example above, signer of executable code module not user, is valid principal. interactive operator trying module loaded user.

as noted in comments, authoritative sources not agree on these terms. searched nist, sans, ieee, mitre , several "quasi-authoritative" sources such security exam guides while preparing response. no single source found @ least quasi-authoritative covered 3 terms , differed in usage. take on how terms should used practical standpoint, when poring on manual in middle of night, definitions tend whatever vendor or writer are. though responses here provide enough insight navigate waters , parse security document using these terms.