AuthN

AuthN, short for authentication, is the process of verifying the claimed identity of a user, device, or other entity attempting to access a system. It serves as the initial gate in access control and is distinct from authorization (AuthZ), which determines what actions an authenticated entity is allowed to perform.

In practice, AuthN relies on evidence presented by the entity—credentials or other factors. Typical methods include knowledge factors (passwords or PINs), possession factors (security tokens, mobile devices, smart cards), and inherence factors (biometrics such as fingerprints or facial recognition). Modern systems increasingly support passwordless approaches that rely on cryptographic credentials or biometric verification.

Standards and protocols commonly used with AuthN include SAML 2.0 for federated identity, OAuth 2.0 and OpenID Connect for delegated authentication, and WebAuthn/FIDO2 for strong, phishing-resistant authentication using public-key cryptography with platform or roaming authenticators. PKI-based certificates are another option for machine-to-machine or user authentication in certain deployments.

Authentication flows vary from simple single-factor logins to multi-factor arrangements. Organizations may employ step-up or adaptive authentication, where additional factors are required based on context such as user risk, location, or device health. Federated and delegated authentication enable users to authenticate with trusted external providers.

Security and governance considerations are central to AuthN. Passwords are prone to reuse and phishing, so multi-factor authentication—preferably phishing-resistant authenticators—significantly improves security. Proper session management, device trust, and privacy-aware logging are also important. AuthN design often aligns with standards and compliance frameworks such as NIST SP 800-63 and ISO/IEC 27001.