Authentication vsAuthorization

Authentication is the basic security feature of any organization. An organization without Authentication is like gold mine without any guard.

Authentication and Authorization works hands-in-hand and are a MUST-TO-HAVE in any organization or in any system or in any application.

Authentication is majorly tagged with Security whereas Authorization is majorly tagged with Privacy.

Let’s try to understand with an example, for example, in a hospital close relative, family or friends are allowed to come and meet the patient, but all these people normally are AUTHENTICATED or stopped by the guard at the main gate who checks their ID cards or anything which can assure that they are legitimate people e.g., guard can ask, why they are here etc. Once they are in, at the main hospital counter someone again asks them who they want to meet, if the patient’s name is there in system, then they are allowed to go ahead.

Referring to the above example close relative, family, or friends have passed the Security (authentication process) and now we like it or not they can go at any level/ floor or any room in the hospital, means they are still able to violate other patient’s privacy by entering any room they like. Here authorization process is missing.

Now, consider, a hospital staff member has been tagged along with close relative, family, or friends to take them to the exact patient’s room, in other words, they are AUTHORIZED for only one room where the patient is. This way, Privacy (authorization process) of other patients is taken care.

Let’s also map Authentication and Authorization with data. To get access to any application or database, once user has been given access via authentication process to make sure that person is a legitimate employee of the company, he/ she can access anything in that application or database. But same time, by using Authorization, the user is restricted to access only relevant tables or columns or rows they are Entitled for.