Authentication verifies that a user, application, or other identity is the principal it claims to be. It answers “Who are you?” and “Are you who you claim to be?” before access is granted. section 2.2 section 2.1
A principal authenticates against a resource, such as a web application, by presenting a credential such as a password or certificate. Successful authentication produces tokens that convey the result and support access to the resource. section 2.2
Authentication should be distinguished from related identity and access concerns:
- Authentication establishes who the principal is; authorization determines which resources and actions that principal may use. section 2.1
- Basic authentication stores and manages principal credentials at each resource, increasing the impact of credential compromise; modern authentication is preferred instead. section 2.2
- Multifactor authentication adds protection when a username and password are disclosed, helping prevent an attacker from authenticating as the user. section 2.2.1
Passport check at airport security
A traveler presents a passport or identity card at customs before boarding. The document is checked to confirm the traveler’s claimed identity; authentication applies the same principle to users and applications. section 2.2
Use the four-pillar diagram to relate authentication to authorization, administration, and auditing within identity and access management. section 2.1
