Identity, authentication and authorization

Three questions, not one

Identity represents a person, device, workload or agent. Authentication establishes that identity using an accepted method. Authorization decides whether the established identity may perform a requested action.

Successful authentication does not imply unlimited authorization. A signed-in learner can be allowed to read one course while being denied administrative changes.

1. 01Requester
2. 02Authentication
3. 03Identity provider
4. 04Identity information
5. 05Authorization policy
6. 06Allow or deny action

Providers, directories and relying services

An identity provider authenticates subjects and supplies identity information that applications can consume. A directory service stores and organizes identities, groups, devices and attributes. A relying service evaluates the information and its own policy before granting or denying an action.

Single sign-on can let one authentication event support access to multiple applications, but each application still has an authorization decision. Tokens carry assertions or claims; possessing a token does not make every action valid for every service.

Federation extends trust across a boundary

Federation lets one administrative domain rely on identity information from another under a defined trust relationship. It does not merge the two directories and it does not remove authorization at the target service.

Identity as a security perimeter

Cloud services may be reached from many networks and devices, so identity signals and access policy become central to security decisions. Network location remains a signal, not automatic proof of trust.

?

Comprobación rápida

A service knows who the requester is but denies changing billing settings. Which decision denied the action?

Elige una respuesta

AAuthorizationBAuthenticationCName resolution

Comprobar respuesta

Next stepUse the identity hub

Connect the lesson to its source, diagram, practice and SC-900 objective.