Authentication & Authorization Basics
Authentication and authorization are fundamental concepts in security. Authentication verifies a user's identity, ensuring they are who they claim to be, typically through passwords, biometrics, or tokens. Authorization, on the other hand, determines what resources or actions an authenticated user is permitted to access or perform. Together, they protect systems by first confirming identity and then enforcing access controls based on user roles or permissions.
Authentication & Authorization Basics
Authentication and authorization are fundamental concepts in security. Authentication verifies a user's identity, ensuring they are who they claim to be, typically through passwords, biometrics, or tokens. Authorization, on the other hand, determines what resources or actions an authenticated user is permitted to access or perform. Together, they protect systems by first confirming identity and then enforcing access controls based on user roles or permissions.
💡 Key Takeaways
- Differentiate between authentication (verifying who you are) and authorization (granting what you can do).
- Identify common authentication factors (passwords, biometrics, tokens) and the role of multi-factor authentication.
- Explain how authorization controls access using models like RBAC, ABAC, and ACLs, emphasizing the principle of least privilege.
- Learn how tokens and sessions (e.g., OAuth 2.0 / OpenID Connect) enable secure, scalable access to resources.
❓ Frequently Asked Questions
What is authentication?
Authentication verifies a user's claimed identity, typically using passwords, biometrics, or tokens.
What is authorization?
Authorization determines what resources or actions an authenticated user is allowed to access or perform.
What are authentication factors?
Factors are evidence categories: something you know (password), something you have (token), and something you are (biometrics).
What is multi-factor authentication and why use it?
Multi-factor authentication requires two or more independent factors, increasing security by reducing the risk of credential compromise.
What are common authorization models?
Common models include RBAC (roles-based access control) and ABAC (attributes-based access control).