Authentication and Authorization

Authentication verifies that a user, device or process is genuinely the identity it claims to be. Authorization determines which resources and operations that authenticated identity is permitted to access. In simple terms, authentication asks “Who are you?”, while authorization asks “What may you do?”

How authentication works

A user first claims an identity, commonly through a username or digital identifier, and then proves that claim using one or more credentials.

• Authentication factors include something the user knows, such as a password; something the user possesses, such as a security token; and something the user is, such as a biometric characteristic.
• Multi-factor authentication uses factors from at least two different categories, reducing dependence on a single compromised credential.
• Successful authentication may create a session or issue a token that identifies the verified user to other system components.

How authorization works

After identity is established, the system applies access-control policies to decide whether a requested action should be allowed. An authenticated user can therefore still be denied access to a particular file, service or administrative function.

• Role-based access control assigns permissions through roles, such as administrator, auditor or ordinary user.
• Attribute-based access control evaluates attributes of the user, resource, requested action and operating environment.
• The principle of least privilege limits each identity to the minimum permissions necessary for its legitimate tasks.

Why the distinction matters

Separating the two functions supports layered security: authentication prevents impersonation, while authorization restricts what a verified identity can do. Authorization should be checked whenever protected resources are requested, because login alone must not provide unrestricted access.

• Compromised credentials may defeat authentication, but narrowly scoped permissions can limit the resulting damage.
• Weak authorization can expose data or functions even when the authentication mechanism itself is strong.
• Permissions should be reviewed and withdrawn when duties change or access is no longer required.

How UPSC asks this