Explain the difference: Authentication vs. Authorization
In this tutorial, we will learn about authentication and authorization. We will understand how to use the Microsoft identity platform for authenticating and authorizing users in your web apps, web APIs, or apps that call protected web APIs.
Authentication
Authentication or AuthN refers to the process of proving that you are who you say you are. The Microsoft identity platform uses the OpenID Connect protocol for handling authentication.
Authorization
Authorization is the act of granting an authenticated party permission to do something. However, it specifies the data access and what you can do with that data. It sometimes shortened to AuthZ. The Microsoft identity platform uses the OAuth 2.0 protocol for handling authorization.
Authentication and authorization using the Microsoft identity platform
Creating apps that each maintain their own username and password information incurs a high administrative burden when adding or removing users across multiple apps.
Further, Azure Active Directory (Azure AD) is a centralized identity provider in the cloud. Delegating authentication and authorization to it enables scenarios such as:
- Firstly, conditional Access policies for needing a user to be in a specific location.
- Secondly, the use of multi-factor authentication or two-factor authentication or 2FA.
- Lastly, enabling a user to sign in once and then be automatically signed in to all of the web apps that share the same centralized directory. This capability is known as single sign-on (SSO).
However, the Microsoft identity platform simplifies authorization and authentication for application developers by providing identity as a service. It supports industry-standard protocols and open-source libraries for different platforms for helping you start coding quickly. Further, it allows developers for building applications that,
- Firstly, sign in all Microsoft identities
- Secondly, get tokens to call Microsoft Graph
- Thirdly, access Microsoft APIs
- Lastly, access other APIs that developers have built.
Comparisons of Protocol
Here’s a comparison of the protocols that the Microsoft identity platform uses:
- Firstly, OAuth versus OpenID Connect. The platform uses OAuth for authorization and OpenID Connect (OIDC) for authentication. However, OpenID Connect is built on top of OAuth 2.0, so the terminology and flow are similar between the two. You can even both authenticate a user (through OpenID Connect) and get authorization to access a protected resource that the user owns (through OAuth 2.0) in one request.
- Secondly, OAuth versus SAML. The platform uses OAuth 2.0 for authorization and SAML for authentication.
- Lastly, OpenID Connect versus SAML. The platform uses both OpenID Connect and SAML to authenticate a user and enable single sign-on. You can use SAML authentication with identity providers like Active Directory Federation Services (AD FS) federated to Azure AD. On the other hand, you can use OpenID Connect for apps that are purely in the cloud, like mobile apps, websites, and web APIs.
Reference: Microsoft Documentation