Understanding Authentication vs Authorization

1. Defining Authentication

Authentication (AuthN) verifies who a principal claims to be by validating credentials against a trusted identity store.

2. Defining Authorization

Authorization (AuthZ) determines what an authenticated principal can do based on policies, roles, or attributes.

3. Understanding Authentication Flow

Client → [Credentials] → Auth Service → Identity Store
                              ↓
                       Verify + Issue Token
                              ↓
Client ← [Session/Token] ← Auth Service
      

4. Understanding Authorization Flow

Request + Token → PEP (Policy Enforcement Point)
                       ↓
                 PDP (Policy Decision Point)
                  ↙        ↓        ↘
            PIP (info)  Policy   Context
                       ↓
                  Permit / Deny
      

5. Understanding Principal and Subject Concepts

6. Understanding Credentials and Claims

7. Understanding Trust Boundaries

A trust boundary is the perimeter at which data validation, authentication, and authorization decisions must occur. Crossing a boundary requires re-verification.

8. Combining Authentication and Authorization

// AuthN then AuthZ
app.get("/admin/users",
  authenticate,                        // verifies JWT, sets req.user
  authorize(["admin", "superadmin"]),  // checks roles
  (req, res) => res.json(users)
);

function authenticate(req, res, next) {
  const token = req.headers.authorization?.replace("Bearer ", "");
  try { req.user = jwt.verify(token, PUBLIC_KEY); next(); }
  catch { res.status(401).json({ error: "invalid_token" }); }
}

function authorize(roles) {
  return (req, res, next) => roles.includes(req.user.role)
    ? next() : res.status(403).json({ error: "forbidden" });
}

9. Understanding Defense in Depth

10. Understanding Zero Trust Model