While often grouped together under Identity and Access Management (IAM), Authentication (AuthN) and Authorization (AuthZ) represent two completely distinct security operations. Conflating the two is a primary cause of broken access control vulnerabilities in enterprise environments.
Core Definitions
- Authentication (AuthN) — "Who are you?": The process of verifying the claimed identity of a user, service account, or device. Authentication proves that you are who you claim to be.
- Authorization (AuthZ) — "What are you allowed to do?": The process of determining the specific access rights, permissions, and privileges granted to an already authenticated identity.
| Comparison Factor | Authentication (AuthN) | Authorization (AuthZ) |
|---|---|---|
| Primary Question | "Who are you? Prove your identity." | "What resources are you permitted to touch?" |
| Execution Order | Must occur first | Occurs second (after identity is proven) |
| Data Exchanged | Usernames, passwords, MFA tokens, biometrics | Access control lists (ACLs), role assignments, scopes |
| Enterprise Protocols | Kerberos, NTLM, OpenID Connect (OIDC), SAML 2.0 | OAuth 2.0 (scopes), LDAP groups, NTFS ACLs, AWS IAM policies |
| Failure Result | 401 Unauthorized (Identity verification failed) | 403 Forbidden (Identity verified, but access denied) |
The Enterprise AAA Framework
Enterprise identity management expands AuthN and AuthZ into the industry-standard AAA Framework:
- Authentication: Verifying credentials via Active Directory Kerberos, cloud identity providers, or RADIUS.
- Authorization: Checking group memberships (e.g., verifying if the user belongs to the
Finance-Read-Onlysecurity group). - Accounting (Auditing): Tracking what the user actually did, logging timestamps, source IP addresses, file access events, and privilege escalation attempts for compliance.
The Three Classic Authentication Factors
Authentication mechanisms rely on one or more verifiable factors:
- Something You Know: Passwords, PINs, passphrases (vulnerable to phishing and credential stuffing).
- Something You Have: Hardware security keys (YubiKey), smartphone authenticator apps (TOTP), smart cards.
- Something You Are: Biometrics such as fingerprint scans, facial recognition (Windows Hello), or retina scans.
Common Authorization Models
Once identity is established, systems evaluate authorization policies using structured models:
- Role-Based Access Control (RBAC): The enterprise standard. Permissions are assigned to business roles (e.g., "Network Engineer" or "Help Desk"), and users are added to groups reflecting those roles.
- Attribute-Based Access Control (ABAC): Granular policies evaluated at runtime based on user attributes, resource classification, time of day, and device security compliance.
- Discretionary Access Control (DAC): The file owner dictates access rights (e.g., standard Unix file permissions managed by individual users).
A Real-World Enterprise Scenario
Consider an engineer logging onto their corporate laptop to access a payroll spreadsheet on an internal file share:
- Authentication: The engineer enters their username, password, and approves a push notification on their phone. Microsoft Entra ID verifies the credentials and issues an authentication ticket. (AuthN Complete)
- Authorization: The engineer attempts to open
\\fileserver\payroll\salaries.xlsx. The file server inspects the engineer's security token and checks the NTFS access control list on the file. Because the engineer is in the "IT Support" group and not the "HR Leadership" group, access is blocked with a Permission Denied prompt. (AuthZ Enforced)
Important: Broken Access Control represents the #1 web application security vulnerability according to OWASP. An application that successfully verifies identity but fails to rigorously evaluate authorization boundaries on every API request allows authenticated users to view or tamper with unauthorized customer records.
Summary
Authentication verifies identity; authorization enforces permissions. Designing secure enterprise systems requires treating both as independent checkpoints, ensuring that robust multi-factor authentication is paired with strict role-based authorization adhering to the Principle of Least Privilege.