{"id":1367,"date":"2024-02-19T20:21:36","date_gmt":"2024-02-19T16:21:36","guid":{"rendered":"https:\/\/155.212.171.134\/?p=1367"},"modified":"2024-02-22T17:56:39","modified_gmt":"2024-02-22T13:56:39","slug":"understanding-the-difference-authentication-vs-authorization","status":"publish","type":"post","link":"https:\/\/tareev.studio\/ru\/understanding-the-difference-authentication-vs-authorization\/","title":{"rendered":"\u041f\u043e\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u0440\u0430\u0437\u043d\u0438\u0446\u044b: \u0410\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u043f\u0440\u043e\u0442\u0438\u0432 \u0410\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f"},"content":{"rendered":"

Authentication<\/strong> and authorization<\/strong> are fundamentally different concepts.<\/p>

Authentication<\/strong> is the process of verifying that a user is who they claim to be.<\/p>

When we log into our account and input our username and password, that’s authentication<\/strong>. The entered data is authenticated by comparing it with what’s stored in the database.<\/p>

Authorization<\/strong>, on the other hand, is about access, determining which users can access specific resources within a network.<\/p>

Key Differences<\/strong><\/h2>

Authentication<\/strong><\/p>

  • Determines whether the user is who they claim to be.<\/li>\n\n
  • Requires users to verify their credentials using the established mechanism.<\/li><\/ul>

    Authorization<\/strong><\/p>

    • Based on predefined rules, determines whether users are allowed or denied access.<\/li>\n\n
    • Checks whether access is permitted according to policies and security rules.<\/li><\/ul>
      \"Authentication
      Authentication vs Authorization<\/figcaption><\/figure>

      Frequently Used Authentication Mechanisms<\/strong><\/h2>

      Single-factor Authentication (SFA)<\/strong> \u2013 a method where the application performs a simple check of the username and password. The application matches the user’s credentials with the password associated with that username.<\/p>

      \"Single-factor
      Single-factor Authentication (SFA)<\/figcaption><\/figure>

      Federated Identity Management (FIM)<\/strong> \u2013 an agreement that can be made between multiple companies allowing participants to use the same identification credentials to access all companies within the group. This approach is known as ‘federated authentication.’<\/p>

      Multi-factor Authentication (MFA)<\/strong> \u2013 requires users to provide multiple proofs to confirm their claimed identity. Users may complete the authentication process using a combination of any two or all of the following methods:<\/p>

      a) Authentication from their own device.<\/p>

      \"Authentication
      Authentication from their own device<\/figcaption><\/figure>

      b) Biometric methods such as fingerprint or iris scanning.<\/p>

      \"Biometric
      Biometric methods such as fingerprint or iris scanning<\/figcaption><\/figure>

      c) User credentials, commonly referred to as ‘creds.’<\/p>

      Now, let’s talk about Authorization<\/strong>.<\/h2>

      Authorization<\/strong> involves granting access to system resources based on a specific set of rules. At this stage, the user must already be identified and authenticated.<\/p>

      The authorization mechanism allows security system administrators to specify user access rights and privileges. Access rights determine what a user can access, usually depending on their role.<\/p>

      Roles are associated with a category or group of users performing the same set of business functions. One user may have multiple roles.<\/p>

      \"Access
      Access denied<\/figcaption><\/figure>

      Let’s address how an authorization error might occur. For example, we try to access our account, but the system denies access. It’s likely because we entered the wrong username or password. We failed authentication, and the authorization request was denied because the system didn’t recognize us.<\/p>

      While these concepts are different, they are interconnected. That’s all for today. What concepts do you struggle with or mix up? Share in the comments below!<\/p>","protected":false},"excerpt":{"rendered":"

      As QA engineers, it’s essential to understand the difference between authentication and authorization to ensure the security and functionality of applications.<\/p>","protected":false},"author":4,"featured_media":1368,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[73,27],"tags":[82,83,87,84,86],"class_list":["post-1367","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-quality-assurance","category-tech","tag-qa","tag-quality-assurance","tag-software","tag-testing","tag-testing-theory"],"acf":[],"_links":{"self":[{"href":"https:\/\/tareev.studio\/ru\/wp-json\/wp\/v2\/posts\/1367","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tareev.studio\/ru\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tareev.studio\/ru\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tareev.studio\/ru\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/tareev.studio\/ru\/wp-json\/wp\/v2\/comments?post=1367"}],"version-history":[{"count":3,"href":"https:\/\/tareev.studio\/ru\/wp-json\/wp\/v2\/posts\/1367\/revisions"}],"predecessor-version":[{"id":1377,"href":"https:\/\/tareev.studio\/ru\/wp-json\/wp\/v2\/posts\/1367\/revisions\/1377"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tareev.studio\/ru\/wp-json\/wp\/v2\/media\/1368"}],"wp:attachment":[{"href":"https:\/\/tareev.studio\/ru\/wp-json\/wp\/v2\/media?parent=1367"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tareev.studio\/ru\/wp-json\/wp\/v2\/categories?post=1367"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tareev.studio\/ru\/wp-json\/wp\/v2\/tags?post=1367"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}