Day 16

What is the core difference between authentication and authorization?

Authentication is the process of proving who you are, while authorization is the process of deciding what you're allowed to do once your identity has already been confirmed.

How does the ATM card analogy illustrate authentication versus authorization?

Inserting the card and entering the PIN is authentication (proving you're the card owner), while the machine checking your withdrawal limit and account rules afterward is authorization (deciding what you can actually do).

Why must authentication always happen before authorization?

There is no way to decide what an unverified identity is allowed to do; authorization decisions only make sense once the system already knows, with confidence, who is making the request.

What is a protocol, and why does authentication need one?

A protocol is an agreed-upon set of rules two systems follow so they can understand each other; without a shared rulebook, different systems might send or expect login information in incompatible ways, causing logins to fail or become insecure.

How does Kerberos work, and why is it considered safer than repeatedly sending a password?

Kerberos proves your identity once and then issues a temporary "ticket" that other systems trust, similar to showing ID once at a movie theater box office and then just showing the ticket stub afterward; your password is only used once instead of being transmitted repeatedly.

What does SAML do, using the "trusted friend" analogy?

SAML lets one trusted system tell another system "I already verified this person, let them in," like a trusted friend vouching for you at a members-only event.

How does OAuth work, using the valet key analogy?

OAuth allows one application to access specific parts of your data on another service without ever seeing your password, like a valet key that can start and drive a car but cannot open the trunk or glovebox.

What does OpenID Connect (OIDC) add on top of OAuth?

OIDC adds a simple, standard "ID card" on top of OAuth so an application also learns exactly who you are, not just what data it's allowed to access.

What is Multi-Factor Authentication (MFA), and what are its three factor types?

MFA means proving identity using two or more different types of proof, drawing from something you know (a password), something you have (a phone or key fob), and something you are (a fingerprint or face scan).

How would you define Single Sign-On (SSO) using the theme park analogy?

SSO lets you log in one time and then access multiple applications without logging in again, similar to showing your ticket once at a theme park's front gate to get a wristband, after which every ride simply scans the wristband.

Can you walk through the five steps of how SSO works?

You open a work app and it asks who you are; you're redirected to a central login page and enter credentials once; the central system verifies you and creates a trusted session token; that token is silently shown to other apps you open; each app checks and trusts the token, letting you in without an extra password.

What is the main security risk associated with SSO, and how is it commonly addressed?

SSO creates a single point of failure since one login opens many doors, so if that login is stolen, an attacker could access everything; organizations reduce this risk by pairing SSO with Multi-Factor Authentication.

What are the three types of SSO covered, and how do they differ?

Enterprise SSO (used inside a single company for internal apps), Web SSO (used for browser-based and cloud applications, often via SAML or OIDC), and Social Login (the everyday "Sign in with Google" buttons on consumer websites).

What is Federation, and how does it extend the idea of SSO?

Federation is an agreement between two or more separate organizations to trust each other's identity checks, so a person from one organization can access resources at another without a new account; it's essentially SSO stretched across organizations rather than just across apps within one company.

What is the key difference between SSO and Federation?

SSO provides one login across apps inside a single organization, while Federation provides one login across apps spanning separate organizations, with trust formally agreed upon between the companies.

What are the three steps involved in building a Federation trust relationship?

Agreement (organizations formally agree to trust each other's identity checks), Technical setup (both sides configure systems, often using SAML or OpenID Connect, to recognize each other's assertions), and Ongoing trust (employees can then move between approved systems without duplicate accounts).

What is an Identity Provider (IdP), using the front-desk security analogy?

An IdP is the system responsible for verifying who you are and issuing proof of that identity to other systems, like the security desk at an office building checking your ID badge before letting you further inside.

What is a Service Provider (SP), and how does it relate to the IdP?

A Service Provider is any application or system a user actually wants to use, and it relies on the Identity Provider to confirm who's asking rather than checking identity itself, like a store inside a theme park trusting the wristband issued at the front gate.

Can you walk through the five-step login flow involving both an IdP and an SP?

You try to open a work app (the SP); the app doesn't recognize you and sends you to the IdP's login page; you log in once at the IdP, where your identity is actually checked; the IdP issues a signed proof of identity; the SP receives and trusts that proof and lets you in.