What is an "identity" in IAM, and why is an identifier only meaningful within a namespace?

An identity describes properties of a subject and represents it unambiguously within a namespace; it consists of an identifier (a unique key) usually together with a set of further attributes.

Three components make up an identity:

• Identifier: a unique key such as alice, a matriculation number or an e-mail address.
• Attributes: further properties (name, date of birth, e-mail, student status, ...).
• Namespace: the scope within which the identifier is unique.

The namespace clause is what makes multiple identities per person possible without confusion: alice at HSLU and alice at a web shop are two identities of possibly two different people, because the identifiers live in different namespaces. Globally unique identifiers (e-mail addresses, DIDs) are simply identifiers whose namespace is the whole world.

Go deeper:

• Namespace (Wikipedia) — why a name is only unique within a scope, the idea behind identifiers per context.