Authentication vs Authorization

These two security concepts work together but serve different purposes.

Authentication (AuthN)

• Question: Who are you?
• Methods: Passwords, biometrics, tokens, certificates.
• Result: Verified identity (you are User123).
• Examples: Login, SSO, MFA.

Authorization (AuthZ)

• Question: What can you do?
• Methods: Roles, permissions, ACLs, policies.
• Result: Access decision (you can read but not write).
• Examples: RBAC, ABAC, OAuth scopes.

Flow

1. User requests access.
2. System authenticates user (login).
3. System checks authorization (permissions).
4. Grant or deny access.

Real-world analogy

• Authentication: Showing ID at airport security.
• Authorization: Boarding pass determines which gate/seat.

Common mistakes

• Confusing the two terms.
• Authorization without authentication.
• Hardcoding permissions (should be dynamic).
• Insufficient access controls.

Standards

• OAuth 2.0: Authorization framework.
• OpenID Connect: Authentication layer on OAuth.
• SAML: Enterprise SSO.
• JWT: Token-based auth/authz.