Unit
- Identity: A digital representation of a user, device, or service. Identity systems manage unique identifiers, attributes, and credentials. In distributed systems, identity often spans multiple domains and requires federation to link accounts across providers.
- Authentication: The process of verifying a claimed identity. This is typically done through something you know (password), something you have (token), or something you are (biometric). Authentication establishes confidence that the entity is who they claim to be.
- Authorization: The process of determining what an authenticated entity is allowed to do. Authorization policies define access rights to resources, often expressed as permissions or roles. It depends on successful authentication but is a separate concern.
- Identity Provider (IdP): A system that creates, maintains, and manages identity information while providing authentication services. Examples include LDAP directories, social login providers, and enterprise SSO solutions.
- Service Provider (SP): An application that relies on an IdP for authentication. The SP trusts the IdP's assertion about the user's identity and uses it to grant access to its resources.
- Single Sign-On (SSO): A property where a user logs in once and gains access to multiple applications without re-entering credentials. SSO reduces password fatigue and improves security by centralizing authentication.
- Federation: A set of agreements and standards that enable identity and access management across different organizations. Federated identity allows users from one domain to access resources in another domain using their home credentials.
- Trust Relationship: An established agreement between an IdP and an SP that defines how identity information is exchanged. Trust can be direct or brokered through a federation hub.
- OAuth 2.0: An authorization framework that enables applications to obtain limited access to user accounts on an HTTP service. It decouples resource access from credential sharing by issuing tokens instead of passwords. OAuth defines roles: resource owner, client, authorization server, and resource server.
- Bearer Token: An opaque string used as a credential in HTTP requests. The token is included in the Authorization header, typically as "Bearer <token>". Bearer tokens are easy to use but must be protected against interception because anyone possessing the token can access authorized resources.
- Scope: A mechanism to limit an application's access to a user's account. Scopes are strings that define specific permissions, such as "read" or "write". During authorization, the client requests scopes, and the user or authorization server grants a subset. Scopes enable fine-grained access control.
- Refresh Token: A credential used to obtain new access tokens without requiring the user to re-authenticate. Refresh tokens are long-lived and stored securely by the client. When an access token expires, the client sends the refresh token to the authorization server to get a new access token, enhancing user experience.
Code Example
Python
import hashlib, secrets
# Simulating password hashing for authentication
def hash_password(password, salt=None):
if salt is None:
salt = secrets.token_hex(16)
hashed = hashlib.pbkdf2_hmac('sha256', password.encode(), salt.encode(), 100000)
return salt + ':' + hashed.hex()
# Store hash and compare
stored = hash_password('P@ssw0rd123')
salt, _ = stored.split(':')
print(hash_password('P@ssw0rd123', salt) == stored) # TrueThis demonstrates a secure password storage technique using PBKDF2. Each password is salted with a cryptographically random value, and the hash is computed with a high iteration count to resist brute-force attacks. Always hash passwords; never store them in plain text.
Quick Revision
- Identity, authentication, and authorization form the three pillars of access control.
- Authentication verifies identity; authorization defines permissions.
- IdPs and SPs work together via trust relationships to enable SSO and federation.
- Password hashing with salt and slow algorithms is critical for security.