Authentication

Introduction

Authentication happens constantly, often invisibly: an employee signing into a laptop, a customer logging into online banking, an administrator connecting to a Linux server over SSH, a VPN user approving an MFA push, a mobile app authenticating against an API, Microsoft 365 redirecting to an identity provider, a smart card unlocking a government workstation, a server proving its identity with a TLS certificate, an application exchanging an OAuth token, two companies federating with SAML, a passkey replacing a password, or a Wi-Fi access point checking credentials against a RADIUS server.

For anyone pursuing IT support, cybersecurity, IAM, cloud security, SOC operations or systems administration, authentication is foundational knowledge. Large organisations rarely rely on just one authentication technology — a multinational company might simultaneously run Microsoft Entra ID for cloud authentication, Active Directory and Kerberos for Windows workstations, LDAP for older internal apps, SAML for enterprise SaaS, OpenID Connect for modern web apps, OAuth for API authorisation, RADIUS for VPN access, FIDO2 keys for privileged admins, passkeys for customers, and smart cards/PKI for high-security users — all at once.

Understanding how these technologies interact matters far more than memorising individual definitions. That's the goal of this module.

Learning Objectives

By the end of this module (all 6 lessons), you should be able to explain Authentication, Authorisation and Accounting; describe authentication factors and why MFA matters; explain how passwords are securely stored and attacked; describe MFA technologies, biometrics, FIDO2 and passkeys; explain OAuth roles, flows, tokens and JWTs; explain OpenID Connect and Single Sign-On; describe SAML federation; explain Kerberos, NTLM and LDAP; describe RADIUS, certificates/PKI and smart cards; explain sessions, token revocation and authentication troubleshooting; and design a basic enterprise authentication architecture.

1👤 Authentication, Authorisation and Accounting

Before looking at any protocol, you need to separate three concepts that are frequently confused.

Authentication and authorisation are therefore separate security decisions. This distinction matters a lot for OAuth, which is primarily an authorisation framework, not an authentication protocol — a common source of confusion covered in Lesson 3.

The combination of all three is often called AAA. RADIUS (Lesson 6) is a classic example of an AAA protocol.

2🏷️ Identity vs Authentication

An identity is a representation of an entity — a human user, administrator, service, application, server, workstation, mobile device, API, or IoT device. An identity might carry attributes such as:

Username: jsmith
Name: John Smith
Department: Finance
EmployeeID: 55217
Email: john.smith@example.com
Role: Finance Analyst
Manager: Jane Wilson
Country: UK

Authentication verifies that whoever is claiming to be jsmith can prove that claim. Identity management systems then control the account's entire lifecycle:

This is why authentication and Identity and Access Management are so closely connected — a topic Module 10 covers in depth.

3🔑 Authentication Factors

Authentication mechanisms are traditionally grouped into factor categories.

Modern platforms may also evaluate contextual signals — IP address, country, network, device compliance, OS, browser, geolocation, time, user behaviour, risk score, impossible travel, malware status — but these function as risk signals layered on top of the three real factors, not independent factors themselves.

4⚠️ Single-Factor Authentication

Single-factor authentication uses only one category of evidence. The classic example is:

Username + Password

Although two values are entered, this is still single-factor because both belong to the knowledge category. Passwords can be phished, guessed, reused, leaked, keylogged, stolen from breached databases, captured by malware, or obtained through social engineering — which is exactly why the rest of this module exists: MFA, biometrics, FIDO2, passkeys, and phishing-resistant authentication all exist to reduce dependence on a single knowledge factor.

📚 Lessons in This Module

Work through these in order — each builds on ideas from the last. Every lesson has its own "Mark lesson complete" button and labs; your progress across all six is tracked below.