Authorization
Authorization is about determining what services or resources that a known actor is allowed to access, and what action the actor can take. In short, authorization verifies the resources the user is entitled to access.
Authorization and Authentication are often tightly coupled, but they are technically distinct concepts. A particular token may enable an actor to access a protected resource (authorization) without including any information about the identity of the actor (authentication). Conversely, you may need to request authentication from an IdP service to determine a user’s identity, but will itself have its own data that corresponds to that user and defines what the user is entitled to do.
The difference between Authentication and Authorization is like having a staff secure identity badge with your photo and name on it, and a color bar showing what parts of a secure building you are allowed to access. A guard at a gate to a secure zone may not need to know your identity but merely check the color of your badge to verify that you are entitled to enter.
Proper authorization schemes allow for different type of tokens to provide different type of access, even if they are issued for the same underlying user.
Parent topic:Authentication and Authorization