Wiki.Quizz.vn

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
https://drive.google.com/file/d/1TIeK1rpQMfTS7lH_6Rf-Vjq5VeziDcQB/view?usp=sharing

====== Authentication & Authorization Technologies ======

This document explains common authentication and authorization technologies from beginner to advanced.

-----

====== Overview ======

Authentication answers:

<code>
Who are you?
</code>

Authorization answers:

<code>
What are you allowed to do?
</code>

Identity and access management ecosystem:

<code>
Identity & Access Management (IAM)
│
├── Authentication (Who are you?)
│   ├── Password-based (user proves identity using secret password)
│   ├── Session-based (server stores login state using session cookie)
│   ├── Token-based (stateless authentication using tokens)
│   │   ├── JWT (JSON Web Token format used to carry claims securely signed)
│   │   └── Opaque Token (random token validated by server lookup)
│   ├── API Key (static key used to identify and authenticate client apps)
│   ├── Basic Auth (username/password sent with each request in encoded form)
│   ├── Passkeys / WebAuthn (passwordless authentication using public-key cryptography)
│   └── MFA / 2FA (extra authentication layer requiring multiple factors)
│
├── Authorization (What can you do?)
│   ├── OAuth2 (delegated authorization framework that grants limited API access without sharing credentials)
│   ├── RBAC (Role-Based Access Control using roles to define permissions)
│   ├── ABAC (Attribute-Based Access Control using user/resource/context attributes)
│   └── ACL (Access Control List defining permissions per user or group per resource)
│
└── Federation / SSO (Who vouches for you?)
    ├── OpenID Connect (OIDC) (identity layer on top of OAuth2 used for login and identity verification)
    └── SAML (XML-based enterprise federation protocol for single sign-on across organizations)
</code>

-----

====== Password Authentication ======

===== Definition =====

Most traditional authentication mechanism.

User provides:

<code>
Username
Password
</code>

Server verifies credentials.

-----

===== Workflow =====

<code>
User
  |
Username + Password
  |
  V
Server
  |
Verify Password Hash
  |
Allow / Deny
</code>

-----

===== Advantages =====

  * Simple
  * Universal support

-----

===== Disadvantages =====

  * Weak passwords
  * Password reuse
  * Phishing attacks
  * Credential leaks

-----

====== Session Authentication ======

===== Definition =====

Server stores user state.

Client stores only a Session ID.

-----

===== Workflow =====

Step 1:

<code>
User Login
</code>

Step 2:

Server creates session.

<code>
Session ID:
ABC123XYZ
</code>

Step 3:

Server stores:

<code>
ABC123XYZ
  →
{
  userId: 1,
  role: admin
}
</code>

Step 4:

Browser receives cookie.

<code>
Set-Cookie:
session_id=ABC123XYZ
</code>

-----

===== Request Flow =====

<code>
Browser
    |
session_id
    |
    V
Server
    |
Session Storage
</code>

-----

===== Advantages =====

  * Secure
  * Easy logout
  * Easy revocation

-----

===== Disadvantages =====

  * Requires server storage
  * Harder to scale

-----

===== Common Use Cases =====

  * Laravel websites
  * Admin panels
  * Internal systems

-----

====== JWT Authentication ======

===== Definition =====

JWT stands for:

<code>
JSON Web Token
</code>

A JWT is a signed token that carries user identity information.

-----

===== Structure =====

<code>
Header.Payload.Signature
</code>

Example:

<code>
xxxxx.yyyyy.zzzzz
</code>

-----

===== Workflow =====

User logs in.

Server creates JWT.

<code>
{
  "userId": 1,
  "role": "admin"
}
</code>

Server signs token.

Client stores token.

Client sends:

<code>
Authorization:
Bearer eyJhbGc...
</code>

Server verifies signature.

-----

===== Architecture =====

<code>
Client
   |
 JWT
   |
   V
API Server
</code>

-----

===== Advantages =====

  * Stateless
  * API friendly
  * Scales well

-----

===== Disadvantages =====

  * Harder logout
  * Harder token revocation

-----

===== Common Use Cases =====

  * REST APIs
  * Mobile apps
  * SPAs
  * Microservices

-----

====== API Key Authentication ======

===== Definition =====

Simple authentication using a secret key.

Example:

<code>
X-API-Key: abc123
</code>

-----

===== Workflow =====

<code>
Client
   |
 API Key
   |
   V
Server
   |
Validate Key
</code>

-----

===== Advantages =====

  * Very simple
  * Easy integration

-----

===== Disadvantages =====

  * Weak permission model
  * Difficult rotation
  * No user identity

-----

===== Common Use Cases =====

  * Internal APIs
  * Service integrations
  * Automation tools

-----

====== Basic Authentication ======

===== Definition =====

HTTP authentication standard.

Credentials sent every request.

-----

===== Example =====

<code>
Authorization:
Basic am9objpwYXNzd29yZA==
</code>

Represents:

<code>
john:password
</code>

-----

===== Advantages =====

  * Very simple

-----

===== Disadvantages =====

  * Credentials transmitted every request
  * Must use HTTPS

-----

===== Common Use Cases =====

  * Internal systems
  * Legacy applications

-----

====== OAuth2 ======

===== Definition =====

OAuth2 is an authorization framework.

OAuth2 answers:

<code>
What resources can this application access?
</code>

OAuth2 does NOT define authentication.

-----

===== Example =====

User clicks:

<code>
Continue with Google
</code>

Google asks:

<code>
Allow this app to access your profile?
</code>

User approves.

Google issues:

<code>
Access Token
</code>

Application accesses Google APIs.

-----

===== Components =====

==== Resource Owner ====

Usually:

<code>
User
</code>

==== Client ====

Application requesting access.

==== Authorization Server ====

Issues tokens.

Examples:

  * Google
  * Microsoft
  * Auth0
  * Okta
  * Keycloak

==== Resource Server ====

Protected APIs.

-----

===== Tokens =====

==== Access Token ====

Used for API access.

<code>
Authorization:
Bearer token
</code>

==== Refresh Token ====

Obtains new access tokens.

-----

===== Common Use Cases =====

  * Login with Google
  * Third-party integrations
  * Enterprise APIs

-----

====== OpenID Connect (OIDC) ======

===== Definition =====

OIDC is an authentication layer built on top of OAuth2.

OAuth2 answers:

<code>
What can this app access?
</code>

OIDC answers:

<code>
Who is the user?
</code>

-----

===== Workflow =====

User authenticates.

Identity Provider returns:

<code>
ID Token
</code>

Typically a JWT.

Example:

<code json>
{
  "sub": "123456",
  "email": "john@example.com",
  "name": "John"
}
</code>

-----

===== Common Providers =====

  * Google
  * Microsoft Entra ID
  * Auth0
  * Okta
  * Keycloak

-----

===== Common Use Cases =====

  * Login with Google
  * Enterprise SSO
  * Modern authentication systems

-----

====== SAML ======

===== Definition =====

SAML stands for:

<code>
Security Assertion Markup Language
</code>

Enterprise identity federation protocol.

Uses XML.

-----

===== Workflow =====

<code>
Employee
    |
    V
Company Identity Provider
    |
    V
Application
</code>

-----

===== Advantages =====

  * Enterprise standard
  * Mature ecosystem

-----

===== Disadvantages =====

  * XML complexity
  * Older technology

-----

===== Common Use Cases =====

  * Enterprise SSO
  * Government systems
  * Legacy corporate environments

-----

====== Single Sign-On (SSO) ======

===== Definition =====

SSO is a capability, not a protocol.

Goal:

<code>
Login once.
Access multiple applications.
</code>

-----

===== Example =====

<code>
Google Login
      |
      +--> Gmail
      +--> Drive
      +--> Docs
      +--> Calendar
</code>

-----

===== Technologies Used =====

  * OIDC
  * SAML

-----

====== Multi-Factor Authentication (MFA) ======

===== Definition =====

Adds extra authentication factors.

Instead of:

<code>
Password
</code>

Use:

<code>
Password
+
Additional Factor
</code>

-----

===== Examples =====

  * SMS OTP
  * Authenticator App
  * Security Key
  * Passkey

-----

===== Advantages =====

  * Stronger security
  * Protects against password theft

-----

====== Passkeys / WebAuthn ======

===== Definition =====

Modern passwordless authentication.

Uses:

<code>
Public Key
Private Key
</code>

cryptography.

-----

===== Registration =====

Device creates:

<code>
Public Key
Private Key
</code>

Server stores:

<code>
Public Key
</code>

Device stores:

<code>
Private Key
</code>

-----

===== Login =====

Server sends challenge.

Device signs challenge.

Server verifies signature.

-----

===== Advantages =====

  * Phishing resistant
  * No password leaks
  * Better user experience

-----

===== Common Use Cases =====

  * Modern authentication systems
  * High-security applications

-----

====== Authorization Models ======

===== RBAC =====

Role-Based Access Control.

Permissions based on roles.

Example:

<code>
Admin
  → All Permissions

Manager
  → Reports

User
  → Own Data
</code>

-----

===== ABAC =====

Attribute-Based Access Control.

Permissions based on attributes.

Example:

<code>
Department = Finance

AND

Document Department = Finance
</code>

Result:

<code>
Allow Access
</code>

-----

===== ACL =====

Access Control List.

Permissions attached directly to resources.

Example:

<code>
budget.xlsx

John  → Read
Alice → Read/Write
Bob   → Denied
</code>

-----

====== Kerberos ======

===== Definition =====

Enterprise authentication protocol.

Widely used with:

  * Active Directory
  * Windows Domains

-----

===== Workflow =====

<code>
User Login
    |
    V
Active Directory
    |
Ticket
    |
    V
Applications
</code>

-----

===== Common Use Cases =====

  * Corporate networks
  * Enterprise infrastructure

-----

====== Modern Enterprise Architecture ======

A typical enterprise architecture:

<code>
User
 |
 V
OIDC Login
 |
OAuth2
 |
JWT
 |
API Gateway
 |
Microservices
 |
RBAC
</code>

Where:

<code>
OIDC
= Authentication

OAuth2
= Authorization

JWT
= Token Format

RBAC
= Permissions

MFA
= Additional Security
</code>

-----

====== Technology Comparison ======

^ Technology ^ Category ^ Purpose ^
| Session | Authentication | Server-side login state |
| JWT | Authentication | Token-based identity |
| API Key | Authentication | Service identification |
| Basic Auth | Authentication | Username/password transport |
| OAuth2 | Authorization | Delegated access |
| OIDC | Authentication | User identity |
| SAML | Authentication/SSO | Enterprise federation |
| MFA | Authentication | Additional verification |
| Passkeys | Authentication | Passwordless login |
| RBAC | Authorization | Role permissions |
| ABAC | Authorization | Attribute permissions |
| ACL | Authorization | Resource permissions |
| Kerberos | Authentication | Enterprise authentication |

-----

====== Quick Memory Guide ======

<code>
Session
= Server remembers you

JWT
= You carry your identity

OAuth2
= Permission delegation

OIDC
= User identity

SAML
= Enterprise SSO

MFA
= Extra verification

Passkey
= Passwordless authentication

RBAC
= Role permissions

ABAC
= Attribute permissions

ACL
= Resource permissions
</code>