What do you call the entity seeking to be authenticated?

In IEEE 802.1X terminology that would be the supplicant:

   Authenticator
         An Authenticator is an entity that requires authentication from
         the Supplicant.  The Authenticator may be connected to the
         Supplicant at the other end of a point-to-point LAN segment or
         802.11 wireless link.

   Supplicant
         A Supplicant is an entity that is being authenticated by an
         Authenticator.  The Supplicant may be connected to the
         Authenticator at one end of a point-to-point LAN segment or
         802.11 wireless link.

(Source)

In other contexts the entity being authenticated is often simply referred to as a client or user as that's in most cases unambiguous.


While Arminius covered the domain of 802.1X, I'd like to add my answer from the perspective of authorization standards/frameworks.

OAuth 2.0

Several key terms are defined in section 1.1 of RFC 6749:

  resource owner
      An entity capable of granting access to a protected resource.
      When the resource owner is a person, it is referred to as an end-user.

  resource server
      The server hosting the protected resources, capable of accepting
      and responding to protected resource requests using access tokens.

  client
      An application making protected resource requests on behalf of the
      resource owner and with its authorization.  The term "client" does
      not imply any particular implementation characteristics (e.g.,
      whether the application executes on a server, a desktop, or other devices).

Here the specification differentiates between the client (application requesting authentication) and the end-user, or more generically, resource owner.

SAML 2.0

Relevant terms are defined in the SAML 2.0 glossary:

End User A natural person who makes use of resources for application purposes (as opposed to system management purposes; see Administrator, User).

Principal A system entity whose identity can be authenticated.

Requester, SAML Requester A system entity that utilizes the SAML protocol to request services from another system entity (a SAML authority, a responder). The term “client” for this notion is not used because many system entities simultaneously or serially act as both clients and servers. In cases where the SOAP binding for SAML is being used, the SAML requester is architecturally distinct from the initial SOAP sender.

User A natural person who makes use of a system and its resources for any purpose


Various words can be used depending on the context. Here are some I've come across -

  1. Human user logging into a machine or service (either CLI or web-based) = User or End User
  2. Machine user account needing to be authenticated - Client (in a client server model) or Peer (in a peer to peer model)
  3. As stated by Arminius, this can further be abstracted to Requester or Customer, depending on where it is being used.

From your question, it appears that this is for code. In such a case, I would suggest keeping things simple - pick a name based on one of the above contexts and comment your code to make it clear on what the variable represents :-)