Authentication verifies who you are (logging in with a password or fingerprint), while authorization determines what you can do (accessing specific files or admin pages). Authentication always happens first; once your identity is proven, authorization checks your permissions.

Types of Authentication

Authentication methods prove a user's or system's identity. They usually rely on combinations of things you know, have, or are.

Password-based: Using a secret text code or pin.

Multi-Factor (MFA): Combining two or more verification proofs, like a password plus an SMS text code.

Biometric: Using unique body traits like fingerprints or face scans.

Token-based: Using digital keys or secure tokens (like JSON web Tokens or hardware fobs).

Certificate-based: Using secure digital certificates to verify machines or users.

Single Sign-On (SSO): Logging in once to access multiple separate connected systems.

Types of Authorization

Authorization methods decide which parts of a system an approved user can touch.

Role-Based (RBAC): Giving access based on a job title or user group, like manager or guest.

Attribute-Based (ABAC): Giving access based on specific details or conditions, like department name or security clearance level.

Rule-Based (RuleBAC): Giving access based on system-wide rules, such as allowing entry only during work hours.

Discretionary (DAC): Letting the owner of a resource decide who can access it.

Mandatory (MAC): Using strict, centralized system rules that individual owners cannot change.

Types of authentication and authorization

Comments

Join Techsnap Creators