Authentication & Authorization | Learn IT Fundamentals with Teacher Pochi

Key points

Authentication confirms "who are you?"
Authorization decides "what are you allowed to do?"
The two terms sound alike but serve different roles, and authentication normally happens before authorization.

What is authentication (identity verification)?

Authentication is the mechanism that confirms whether the person trying to use a system is "really who they claim to be." In most cases this is done by checking whether an ID and password combination is correct.

Once authentication succeeds, the system reaches a state where it can trust that "this person is the owner of this account."

🔑 A familiar exampleThink of showing your membership card at a members-only store. By presenting the card, the store can confirm "this person really is the member." That's authentication.

What is authorization (deciding permissions)?

Authorization is the mechanism that decides, for someone whose identity has already been confirmed, "what they're allowed to do and how far." Even within the same service, the range of operations a user is permitted differs from person to person.

For example, a general member might only be able to view their own information, while an administrator can also edit other users' information — this kind of distinction is controlled by authorization.

🔑 A familiar exampleThink of how service changes depending on your membership card's tier. With the same authenticated card, a gold member might be allowed into a special lounge while a general member is not — that difference is authorization.

From authentication to authorization

In an actual system, authentication and authorization are processed in the following order.

Log in
enter ID & password

Authentication

Identity check
OK

Authorization

Permission check
OK

Access the
resource

If authentication fails, the process stops there because "who this is" is unknown. If authorization denies the request, access is refused as "this is the right person, but they lack permission."

Common authentication methods

There are several types of authentication, and combining them increases security.

Password authenticationThe most common method, but easily defeated through reuse or guessing.

Multi-factor authentication (MFA)Combines a password with something like an SMS code or an authenticator app.

Biometric authenticationConfirms identity using something unique to the person, like a fingerprint or face.

Rather than relying on passwords alone, combining multiple factors through multi-factor authentication is becoming standard practice on the job.

Common authorization models

A frequently used approach for authorization design is "role-based access control (RBAC)." Users are classified into "roles," and the operations allowed are decided based on that role.

👑 Administrator View all data Change settings

🙂 General user View & edit own information

👤 Guest View public information only

Common mix-ups and things to watch for

Because the terms sound alike, authentication and authorization are often confused, but "being who you say you are" and "what you're allowed to do" are separate questions. Passing authentication doesn't mean every operation is permitted.

Also, reusing a password across multiple services raises the risk that a leak from one service leads to unauthorized logins (an authentication breach) on others. Managing authentication credentials responsibly is something users themselves need to take seriously too.

Summary

Authentication is "confirming who someone is," and authorization is "deciding what to permit." Working together, these two let a system safely manage each user's permissions.