AuthN and AuthZ

AuthN(Authentication)

Password-based authentication

• A password is required to verify your identity
• Users first create an account by providing necessary details such as email address and password and then access

Password-less authentication

• Users log in via magic link or OTP delivered via email or text message

2FA(Two Factor Authentication) / MFA(Multi Factor Authentication)

• Enhanced and flexible authentication for an additional layer of security using two-factor or multi-factor authentication

Single Sign On

• SSO allows users to access multiple applications with a single set of credentials
• A method developed to allow access to various information systems without re-authentication through one-time system authentication

Social Authentication

• Verify and authenticate with existing credentials from the social networking platform
• This method uses existing credentials from social networking platforms such as Facebook, Twitter, Google, etc. to identify users

API Authentication

• API authentication is the process of authenticating the identity of a user trying to access a service on a server
• API Key / Token

Biometric authentication

• Includes the use of an individual’s unique biological characteristics to confirm identity
• The user’s biometric data is captured and stored in a database and then compared to verify user authentication
• Iris, fingerprint, face, and behavior recognition

AuthZ(Authorization)

API keys

• This method is also used for authentication and authorization
• If a user attempts to gain authenticated access to the system during registration, an API key is generated and used
• API Key is a long string usually included in the URL or header of the request
• API keys are primarily used as a means of identifying who is calling the API
• This method is used by both AuthN and Authz
• Role-based access control (RBAC) can be implemented for system-to-system and user-to-system permission management

HMAC (Hash-Based Message Authentication Code)

• In cryptography, HMAC is a specific type of message authentication code that contains a cryptographic hash function and a secret encryption key
• Like other MACs (Message Authentication Code), it can be used to simultaneously verify data integrity and authenticity of messages

JWT / JSON Web Token

• JWT is an open standard for securely transferring data between parties and users are authorized using public/private key pairs

SAML / Security Assurance Markup Language

• Standard single sign-on format (SSO) that exchanges authentication information via digitally signed XML documents
• XML-based authentication and authorization system between two entities: a service provider and an identity provider

OpenID

• Closer to Authentication as it verifies user identity based on authentication from an authentication server
• This not only allows the client to verify the end user identity based on the Authorization Server’s authentication
• Able to obtain interoperable, REST-like basic profile information about end users

OAuth

• An open standard for access delegation used as a common means for Internet users to grant websites or applications access to their information on other websites without providing a password
• This mechanism is used by several companies, including Amazon, Google, Facebook, Microsoft, and Twitter, and allows users to share information about their accounts with third-party applications or websites

AuthN VS AuthZ

ETC

HTTP Authentication Scheme

The server can specify multiple authentication schemes for the client to choose from. The following table describes some authentication schemes commonly found in Windows applications.

GPT

1. (HTTPS Header) HTTP Basic Authentication

• Description: This is the simplest form of authentication, and the user ID and password are encoded in Base64 and transmitted in the HTTP header.
• Advantage: Simple and easy to implement.
• Disadvantage: Vulnerable in security and can be easily hijacked unless encrypted using SSL/TLS.

GET /protected-resource HTTP/1.1
Host: example.com
Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=

2. (HTTPS Header) HTTP Digest Authentication

• Description: This is a method of hashing and transmitting user authentication information, and is a form of enhanced security than Basic Authentication.
• Advantage: Stronger security because authentication information is transmitted as a hash.
• Disadvantages: Relatively complex implementation, may still be vulnerable to man-in-the-middle attacks.

# 1단계: 서버가 클라이언트에게 challenge를 보냅니다.
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Digest realm="example.com",
                  qop="auth",
                  nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",
                  opaque="5ccc069c403ebaf9f0171e9517f40e41"

# 2단계: 클라이언트가 응답을 보냅니다.
GET /protected-resource HTTP/1.1
Host: example.com
Authorization: Digest username="username",
                      realm="example.com",
                      nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",
                      uri="/protected-resource",
                      qop=auth,
                      nc=00000001,
                      cnonce="0a4f113b",
                      response="6629fae49393a05397450978507c4ef1",
                      opaque="5ccc069c403ebaf9f0171e9517f40e41"

3. (HTTPS Header) Token-based Authentication

• Description: After user authentication, the server issues a token to the client and includes this token in subsequent requests for authentication.
• JWT (JSON Web Token): A self-contained token that maintains trust between the client and server.
• OAuth2: Mainly used for API access and protects resources through access tokens.
• Advantage: Scalable without having to store session state on the server.
• Disadvantage: Requires security considerations for token validity period management and token theft.

GET /protected-resource HTTP/1.1
Host: example.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

4. OAuth2

• Description: An authentication protocol that grants access, where the Resource Owner grants third-party applications access to the Resource Server.
• Advantage: Delegation of authority is possible, and various authentication flows (Authorization Code, Implicit, Client Credentials, Password) are supported.
• Disadvantage: Relatively complex implementation and setup.

5. OpenID Connect

• Description: An authentication protocol based on OAuth2, which provides ID tokens for user authentication.
• Advantage: Standardized method, easy integration between various applications.
• Disadvantage: Involves the complexity of OAuth2.

6. SAML (Security Assertion Markup Language)

• Description: An XML-based authentication and authorization standard, primarily used when implementing single sign-on (SSO) in corporate environments.
• Advantage: Advantageous for implementing SSO between various systems.
• Disadvantage: Implementation is somewhat complicated based on XML, and there may be performance overhead.

7. X.509 Certificates

• Description: A public key-based authentication method in which the client and server use X.509 certificates to authenticate each other.
• Advantages: High security level, mutual authentication possible.
• Disadvantage: Certificate management is complicated and setup can be difficult.

8. API Keys

• Description: A unique key used by the client to access the server is issued and authenticated.
• Advantages: Simple implementation and easy API access control.
• Disadvantage: Security is vulnerable if the key is leaked.

9. LDAP (Lightweight Directory Access Protocol)

• Description: Manages user information and performs authentication through a directory service.
• Advantages: Centralized user management, possible integration of various applications.
• Disadvantage: LDAP server setup and management required.

10. Kerberos

• Description: A network authentication protocol that uses tickets to mutually authenticate users and services.
• Advantages: High security, ticket-based authentication.
• Disadvantage: Initial setup is complicated, time synchronization is required.

11. Mutual TLS (mTLS)

• Description: This is a TLS extension method where the server and client authenticate each other. Both client and server mutually authenticate using X.509 certificates.
• Advantages: Very high security level, provides mutual authentication.
• Disadvantage: Certificate management is complicated and setup can be difficult.

Each authentication method should be chosen based on your specific use case and security requirements. For example, in environments where high security is required, you can use X.509 certificates or mTLS, and when simple authentication is required, you can use API keys or Basic Authentication. OpenID Connect and OAuth2 provide both scalability and security, making them suitable for integrating various applications.