Foundations track · 3 min

Who you are, and what you may do

Authentication and authorization sound alike and fail differently.

The idea

1Two different questions
Authentication asks who you are. Authorization asks what you may do. A system can get one right and the other wrong.
2Authentication produces an identity
A passkey or a code proves the person. The result is a session that says: this is Asha, signed in a moment ago.
3Authorization applies rules to that identity
Roles, groups or policies decide what Asha may open or change. AuthMantra has admin, IT admin, auditor and member roles.
4Least privilege keeps the second answer small
Give each person only the access the job needs, and take it away when the job changes.

Try it

Authentication or authorization?

Sort each statement. Feedback is instant.

This exercise needs JavaScript. Here is the answer key.

Checking a passkey signature: Authentication. It proves who is at the keyboard.
Deciding that an auditor can read the log but not change users: Authorization. It is a rule about what an identity may do.
Asking for an authenticator-app code: Authentication. A code is a proof of identity.
Hiding the Delete button from a member: Authorization. It limits actions after sign-in.
Re-asking for proof before a sensitive admin action: Authentication. It re-checks who is acting.
Granting the IT admin role to a new colleague: Authorization. It assigns what they may do.

1 of 3 A person signs in correctly, then opens a page they should not see. Which part failed?

2 of 3 Which statement is about authentication?

3 of 3 What does least privilege mean?

Answer key

A person signs in correctly, then opens a page they should not see. Which part failed? Authorization. The rule about what they may open was too loose.
Which statement is about authentication? The passkey signature checked out. It proves identity.
What does least privilege mean? Only the access the job needs, removed when it ends. Smaller access means smaller damage.

Field notes

Blueprints

Lexicon