Authentication (AuthN): Verifying identity. "Who are you?"
- Passwords, MFA, certificates, tokens
- SSO (Single Sign-On): One login for multiple services
- OIDC: Authentication layer built on OAuth
Authorization (AuthZ): Verifying permissions. "What can you do?"
- OAuth : Delegated authorization (granting access)
- RBAC (Role-Based Access Control): Permissions by role
- Principle of least privilege: Minimum necessary access
Interview question: "How do you implement least privilege?"
Start with no access. Add permissions as needed. Review regularly. Use time-bound access for elevated privileges.