Authentication and Authorization

Authentication and authorization answer different security questions.

Authentication asks, “What identity is making this request, and how much confidence do you have in that claim?”
Authorization asks, “May this identity perform this action on this resource under these conditions?”

You need both questions because a verified identity does not receive universal access. A payroll employee can be authenticated and still be forbidden from reading another department's records. A public visitor can be unauthenticated and still be authorized to read a public page.

Use one mental model throughout this course:

claim → authenticate → session or assertion → authorize → enforce → record
            ↑                                  ↑
      identity evidence                 policy and context

Authentication produces evidence about a subject. Authorization evaluates that subject against policy for a specific request. Enforcement makes the decision effective. Logging preserves enough context to explain what happened.

Start with subjects and identities

A subject is the person, workload, device, or process that requests access. An identity is the representation a system uses for that subject within a defined context.

Identity is contextual. The same person can have a workforce identity, a customer identity, and a pseudonymous account. Those records need not expose one global identity.

Do not confuse identification with proof. A username identifies the account being claimed. It does not prove that the claimant controls that account.

Identity proofing goes further. It establishes confidence that a digital identity corresponds to a claimed real-world subject. Some services need it. Others only need a stable pseudonymous account. Select the required assurance from the harm caused by an error.

Workloads also authenticate. A service may prove possession of a private key or another credential bound to its workload identity. Device identity can add useful context. Neither replaces the end-user identity when a service acts for a user.

Authentication verifies a claim

An authenticator is something a claimant controls and uses in an authentication protocol. Passwords, one-time passcode devices, and cryptographic keys are different authenticator types.

Authentication factors describe the property being demonstrated:

Factor	Meaning	Examples
Something you know	Knowledge of a secret	Password or activation secret
Something you have	Control of a physical authenticator	Security key or one-time passcode device
Something you are	A biometric characteristic	Fingerprint or face used by an authenticator

Two steps using the same factor do not create multi-factor authentication. A password followed by another memorized secret still demonstrates knowledge twice.

Authentication and Authorization

Start with subjects and identities

Authentication verifies a claim

Relevant careers