Difference between Authentication and Authorization. We’re all familiar with the process of logging into our social media accounts, online games, or email: we enter our username and password – gaining access to our personal page. In the Runet (Russian Internet) and localized systems, this is often called authorization, which is fundamentally incorrect from a technical standpoint: hitting Enter in the input form triggers two completely different processes – authentication and authorization. When errors occur, it’s crucial to clearly understand at which stage the failure is happening.
Definition
Authentication – passing the authenticity check.
Authorization – granting and verifying permissions for certain actions within a system.
Naturally, both authentication and authorization are used not only in gaining access to online accounts. Automated systems, EDI, data transmission, plastic bank cards – we go through these procedures automatically more than once a day.
In English-speaking systems, there’s no confusion with terminology: the user generally doesn’t even think about the difference between authentication and authorization since both processes are hidden from their view. The prompt given is to “log in, logging in.”
Comparison
How does the authentication process work? Let’s imagine a user intends to read new spam in their email inbox. They visit the email service’s website, read ads and news, but they’re not shown any emails yet – the system doesn’t know their identity or intentions. When they enter their “username/qwerty” into the login and password fields and submit this information, the authentication process begins. The system verifies whether a user with such a name exists and if the entered password matches their account. In many cases, the match of these identifiers is enough, but services that prioritize data security may request additional information: the presence of a certificate, a specific IP address, or an additional verification code.
Completed authentication means that the user is indeed who they claim to be. However, this alone is insufficient to grant access to data – the authorization process begins. In the case of email services, clients have equal rights: each of them can view, edit, and create new emails and documents. However, in social networks or forums, visitors belong to specific groups, and authorization helps the system determine what Jupiter is allowed to do that Bull is not. For example, you may not have the right to message a user who has added you to their block list; you cannot include video links in messages until you’ve made a certain number of posts; you can view photos of someone who added you as a “friend.” In local systems, a user account might not have access to certain programs, might be restricted from editing or copying documents.
During the authorization process, the presence of rights for specific actions by the account owner or user is checked. This occurs not only during login but also with any attempt to manipulate data. This is the difference between authentication and authorization: the former is a one-time procedure for the current session; the latter, the user undergoes continually before initiating any process.
An analogy that often helps in understanding the difference between authentication and authorization involves closed objects within industrial complexes. Upon entry, a visitor presents identification (enters a username and password), and the security guard checks in the database if they’re allowed in. If the document is authentic and the name is on the list – access to the facility is granted. To enter a laboratory, one pass is needed; to enter the press center – another; for trash removal – a third. The security service checks the right to access areas and allows or disallows specific actions by the staff. This is how authorization works.
The authentication process is initiated by the user when they log into the system: they provide identification data, whether it’s a pair of login/password, a fingerprint, an installed certificate, a card and its PIN code. Errors can occur on the client’s side. Authorization is initiated automatically by the server if authentication is successful, and the user’s actions do not influence this process.
