Authentication vs. Authorization

Authentication and authorization are two key processes that ensure only trustworthy and verified users can gain access to authorized system resources and data. They enable your organization’s information security — your ability to protect sensitive information against unauthorized access. Although these two processes are used interchangeably, they have several fundamental differences.

Let’s explore the two and discuss the different techniques and best practices for implementing robust authentication and authorization. 

What is authentication?

Authentication is the verification of the identity of an individual, device, or system before granting access to a specific resource or system. Also known as AuthN, this process ensures that the entity that accesses the resource or system is indeed the entity it claims to be.

The most basic form of authentication is the username and password combination. The authentication system checks the username and password of an entity against a pre-existing database. If they match, the authentication system identifies it as a valid entity, and grants access to the resources. 

Authentication has evolved into more secure mechanisms than username and password combinations. Examples of such methods include:

• Multi-factor authentication (MFA)
• One-time passcodes (OTP) via email or SMS
• Biometrics
• User authentication applications

Authentication is a critical step in all systems for preventing unauthorized access to sensitive information.

---

---

What is authorization?

Authorization means granting permission to access resources or data within a system. It typically occurs upon the completion of authentication. For example, suppose a user tries to gain access to a document in a system — the authorization mechanism first checks if the user is permitted to do so, and will deny access to that resource if they’re not. 

Authorization not only grants access to resources or data but also determines the specific actions that users are permitted to perform.

Suppose a particular user intends to modify or delete a file in a system. However, it is only possible if he has an admin role or higher-level privileges based on specific access control policies. Not all users are authorized to perform such actions against sensitive data. Therefore, authorization helps establish the necessary access control for systems.

Authentication vs. authorization: fundamental differences

The following table describes the fundamental differences between Authentication and Authorization. 

	Authentication	Authorization
Primary Purpose	Verify the identity of the entity attempting to access the system or resource.	Specify the resources and actions an authenticated entity is allowed to access and perform.
Sequence	Should occur before the authorization.	Follows successful authentication.
Focus	Evaluates user credentials such as username password combinations, biometrics, and passcodes to establish the identity of the user.	Evaluates the user permissions, privileges, or roles linked to an authenticated user to ascertain their authorized actions or access.
Outcome	Upon successful authentication, the entity is granted access to the resource system, while failed authentication results in denial of access.	Upon successful authorization, the entity is granted access to the resources or data. Failed authorization results in denial of access.
Example scenarios	Login to access the bank account of a particular user, send data to another integrated component, have remote access to a corporate system, and purchase items online.	Administrators view student enrollments, control access to networks or databases, and determine file permissions.

Authentication vs. authorization: methods

There are several ways of authenticating and authorizing users, as well as integrating software components. The following list describes the most popular authentication and authorization mechanisms used in modern software applications. 

Authentication Methods

User authentication mechanisms

Password-based authentication. Using a unique username and password combination to access a system or application. Here, the server compares the provided password with the stored password associated with the corresponding username.

Multi-factor authentication (MFA). Using two or more factors for authentication to provide an additional layer of security. For example, a username and password combination can be used along with a security pin entered through the user’s mobile device. 

Biometrics. Using biometrics such as fingerprint, face or voice to verify the unique identity of a person.

One-time passwords (OTP). A temporary password generated by a user application, device or token sent via email or SMS to the user. This password can be a number, a set of characters, or a combination with a specific expiration time. The user must enter the password before it expires, and it can be used only once. 

Social login. Leveraging existing social media account credentials of users, such as Facebook, Twitter, or Google accounts, for verifying the identity of a user. 

Single sign-on (SSO). Users can access multiple applications using a single set of credentials. Technologies like SAML and OAuth facilitate SSO. For example, the same email address and password combination can be used to access various applications in a corporate environment. These applications include office applications, monitoring apps, HR apps, etc.

API authentication mechanisms

In general, there are two types of API authentication mechanisms.

Authentication tokens. Using a unique token generated by the entity to verify the identity. For example, in system-to-system integration or REST API calls, a software token can be used to identify the system that accesses another system or the endpoint.

(Learn about endpoint monitoring.)

API Keys/shared secrets. API keys are often used to verify the system user that accesses a particular API. The API key can be either:

• A security token with an expiration time.
• A shared secret stored in integrating systems.

Every time the system accesses the API, the integrated system can verify the authenticity of the request using the API key or the shared secret.

Authorization methods

Role-based access controls (RBAC)

This is one of the most common authorization forms. RBAC determines the permissions of the user, or the system based on the role assigned to him. Suppose an IT company has established RBAC for accessing its cloud-based resources. Developers, testers, interns and other key roles in the company will have separate privileges.

For instance, only developers with DevOps roles will have the privilege to log in to production servers and execute commands.

Attribute-based access control (ABAC)

For example, only authorized employees in a banking system may be granted access to perform financial transactions. Additional attributes like transaction limits and the time of day can be used to further refine access control.

(Get more details on RBAC and ABAC.)

Policy-based access control (PBAC)

PABC allows administrators to create access control policies defining the system resources users can access. It also takes various types of user attributes, resources, and specific conditions to define the policies. This authorization mechanism allows organizations to enforce their security and data protection policies.

Network access control

This type of access control defines user access to network resources. For example, only network administrators can access networking devices like routers, switches, and servers. 

Database access control

Defines the database operations and resources that users are allowed to perform. For example, users who can modify and update existing data in pre-production environments may not be authorized to perform such operations in production environments, restricting access to critical data.

JSON Web Token (JWT)

An open standard that enables secure system-to-system data transmission as JSON objects. It has a header, a payload, and a signature. It can be signed using an algorithm like RSA or HMAC. 

OAuth 2.0

An open standard protocol for authorization and authentication widely adopted in modern applications. It provides a mechanism for securing access to protected resources without directly sharing their credentials with the service that requests access. 

---

---

Authentication vs. authorization: best practices

Authentication best practices

• Enforce strong password policies using complex password rules, such as combining uppercase and lowercase letters, numbers and special characters and using a specific length. 
• Implement MFA whenever possible to provide an extra layer of security.
• Secure the secrets/API keys when using them for API authentication.
• Lock user accounts after a certain number of failed logins attempts to prevent brute-force attacks.
• Use secure HTTP headers, like HTTPS, to ensure secure authentication and communication.

Authorization best practices

• Perform regular monitoring to track and analyze authorization failures or suspicious and unauthorized activities.
• Use secure authorization mechanisms like JSON Web Tokens (JWT) or OAuth 2.0 to control API access. 
• Use RBAC with ABAC whenever possible to grant permissions to resources. 
• Enforce the least privilege principle when using RBAC, providing the minimum required access rights and permissions to perform specific tasks.
• Regularly review access privileges to ensure that users still use their assigned privileges.

Summarizing authentication and authorization

Authentication and authorization serve as integral components of any system or web application. They help verify the identity of users and grant secure access to resources and data. These two processes basically differ in their primary purpose, focus, sequence, and outcomes. Furthermore, there are different ways to implement both processes, as discussed in this article. Additionally, there are some best practices you should follow when implementing authentication and authorization in your applications. 

What is Splunk?

This posting does not necessarily represent Splunk's position, strategies or opinion.