What the hack is authentication and authorization

Today, I experienced an interesting scenario that perfectly illustrates the concepts of authentication and authorization. As I walked up to the office gate, the security guard asked for my ID card. I realized I had forgotten it. Despite my assurance that I wouldn’t forget it next time, the guard was firm — I couldn’t enter without my ID.

Determined, I rummaged through my bag and found an old ID card. However, it had expired last year and was from our old office. The guard, adhering to protocol, still didn’t let me in. So, I returned to my flat, got my current ID card, and finally gained entry.

Upon entering, I used my ID to validate access to my floor, which worked without a hitch. However, when I attempted to enter the server room, my ID was rejected — I wasn’t authorized to access that area.

This incident was a practical demonstration of authentication and authorization at work.

Understanding Authentication and Authorization

Authentication: “Who are you?” Authentication is the process that verifies a user’s identity, ensuring that only authorized users can access a system. This is akin to the security guard checking my ID before allowing me into the office. Authentication methods commonly include username-password combinations, Multi-Factor Authentication (MFA), One-Time Passwords (OTP), Single Sign-On (SSO), and token-based systems.

Three Categories of Authentication Factors:

1. Something the user knows: Such as credentials, security questions, or a PIN.
2. Something the user has: Such as a card, OTP on a phone, or a Google Authenticator app.
3. Something the user is: Biometrics, including fingerprints, retina scans, voice recognition, or signatures.

Authentication is widespread, from logging into your phone and laptop to accessing your email, social media, and even LinkedIn. It’s present in various forms, whether through MFA, OTP, SSO, or simple username-password combinations.

Authorization: “What are you allowed to do?” Once authentication confirms your identity, authorization determines what actions you are allowed to perform. It’s about the permissions granted to you based on your role. For instance, my ID card allowed me access to my floor but not the server room. An IT Head’s access would include permissions to enter more restricted areas.

Conclusion Today’s experience underscored the importance of authentication and authorization in everyday scenarios. Authentication verifies your identity, while authorization dictates your permissions.

Stay tuned for my next post! I’ll delve deeper into how authentication and authorization work, explore different types of authentication, explain OAuth1 and OAuth2, and discuss various authentication providers.