Authentication and Authorization

Authentication and Authorization are two fundamental concepts in the realm of security, and they play distinct roles in Spring Security and other security frameworks.

Authentication is the process of verifying the identity of a user or system. It answers the question, "Who are you?" In Spring Security, authentication involves confirming that a user is who they claim to be, typically by checking their credentials, such as a username and password. The primary goal of authentication is to ensure that the user is genuine and legitimate.

Spring Security provides various methods of authentication, such as username and password, token-based authentication (e.g., JWT), LDAP, and more. The framework handles the mechanisms for verifying and establishing a user's identity. Once authentication is successful, Spring Security typically assigns a user a set of security attributes (known as authorities or roles) that define what actions or resources they can access.

Authorization, on the other hand, is the process of determining what actions or resources an authenticated user or system is allowed to access. It answers the question, "What are you allowed to do?" Authorization is the mechanism that enforces access control policies, which specify the permissions and privileges assigned to users or roles within an application. It defines which parts of the application a user can interact with and what actions they can perform.

In Spring Security, authorization often relies on the user's roles and privileges, which are determined during the authentication process. Roles represent categories of users (e.g., "ADMIN," "USER," "GUEST"), while privileges define specific actions or resource access rights (e.g., "READ," "WRITE"). Authorization is typically implemented by configuring access control rules in the application, specifying which roles or privileges are required to access specific resources or perform certain actions.

Difference between authentication and authorization with example

1. Authentication:

It is about verifying the identity of a user or system. It determines "who" the user is.

Authentication is the process of confirming a user's identity. Let's consider a scenario where a user needs to log in to a web application.

Suppose you have a Spring Security configuration that specifies form-based authentication. When a user navigates to a protected resource, they are redirected to a login page, where they must provide their username and password.

                
    @Configuration
    @EnableWebSecurity
    public class SecurityConfig extends WebSecurityConfigurerAdapter {
        @Autowired
        public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
            auth
                .inMemoryAuthentication()
                .withUser("user")
                .password(passwordEncoder().encode("password"))
                .roles("USER");
        }

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
                .authorizeRequests()
                    .antMatchers("/secured-resource").hasRole("USER")
                    .and()
                .formLogin()
                    .loginPage("/login")
                    .permitAll()
                    .and()
                .logout()
                    .permitAll();
        }

        @Bean
        public PasswordEncoder passwordEncoder() {
            return new BCryptPasswordEncoder();
        }
    }

In this example, the configureGlobal method configures an in-memory user with the username "user" and a hashed password "password" and assigns the "USER" role. When the user logs in with these credentials, authentication is successful, and the user's identity is established.

2. Authorization:

It is about controlling what an authenticated user or system is allowed to do or access. It determines "what" actions and resources the user can use. Continuing from the previous example, let's demonstrate authorization.

In the HttpSecurity configuration, there is a rule that specifies that only users with the "USER" role can access the "/secured-resource." This is an example of authorization. If an authenticated user tries to access "/secured-resource" without the "USER" role, they will be denied access.

                
    .antMatchers("/secured-resource").hasRole("USER")

The authorization rule ensures that only users with the specified role are allowed to access the protected resource.

Authentication is the process of the user providing their credentials to log in.

Authorization is controlling access to the "/secured-resource" based on the user's role (in this case, "USER").

In summary, Spring Security handles both authentication and authorization, but they serve different purposes in the security workflow. Authentication establishes the user's identity, while authorization enforces access control policies to govern what actions and resources the user can interact with based on their identity and assigned roles or privileges.

Next Post