Authentication versus authorization

Authentication (AuthN) is very often mixed up with authorization (AuthZ). Authentication deals with identity (who are you?) and, in general, requires a trusted identity provider. Multiple providers exist, such as Azure AD, Okta, or GitHub, and even social media platforms such as Facebook, Google, or Twitter can be used as a provider. Authorization deals with permissions (what are you trying to do?) and is very implementation-specific in terms of what application resources need to be protected.

It generally takes multiple attempts to understand the difference, and even then you can still get confused between the two. The source of confusion is that in some cases, the authentication provider and the authorization provider are the same. For instance, in our WordPress example, WordPress provides the authentication (it has the username and password) and authorization (it stores the users under admin or user roles, for example).

However, in most...