Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am vague among the three following terms: authorization, federation, entitlement (as stated by the OpenAM product: OpenAM provides open source Authentication, Authorization, Entitlement and Federation software). I cannot differentiate which one is about what.

Could anyone please point me a simple definition about these terms?

share|improve this question
up vote 0 down vote accepted

Authorization is the access policy stating to which protected objects or services a client has access.

Authentication is the proof of identity that the client provides to validate his authorization.

Federation (usually identity federation) is to make one central online identity valid over several different services. Google Accounts and Facebook Connect are identity federation systems.

Entitlement could be anything IMO. The closest I get is that when you are authorized access to a service or object, you are entitled as authorized to that service or object.

This way, to get access to your Security.StackExchange account, you may authenticate with your Google Accounts ID and find that you've (earlier) authorized StackExchange to use your Google ID credentials at that service. Also, when authenticated, you find that your Google Accounts user is authorized to access StackExchange, and you are approved access.

A classic misconception is that authorization is the same as access approval, although authorization is established in the registration phase (happens only one time), but access approval is done each time, based on the authenticated user's authorization, looked up in the access policy.

share|improve this answer

There are the three major components of security: Confidentiality, Integrity, Availability. This triad is as inviolate as the fire triangle (heat, fuel, oxygen).

The concepts you (@Tri.Bao) are asking about go to both Confidentiality and Availability.

Authentication is merely the term to express the concept, "You are who you say you are." It is the first step in identifying that you are in fact the user you claim to be. This is enforced at the primary level by your log-in password.

Okay, so the system has authenticated you and you are now past the front door and facing a bunch of locked doors. To gain access through those doors (which lead to the applications or services you want to use), you have to be granted permission (Authorization) to do so. This means that someone in authority, often the app/service owner as well as your manager, have to give you the "Okay" for your account to be provisioned with those permissions. These permissions are often tailored on a "need to know" or "least privilege" basis, such that you are given permissions based on a) what you need to see, b) what you need to use, and/or c) what you need to revise. All of these things fall under "Authorization."

"Entitlement" is generally (but not always) used to describe option c) above, in that you are entitled to full access to the server/directory/application/service. The problem comes when an organization use the terms interchangeably, but this is understandable given the fact that the term "entitlement" was simply coined out of thin air and not fully defined. Different terms should (and generally do) have different meanings, at a granular level.

So, to many, entitlement and authorization are exactly the same. It doesn't hurt to ask!

A "Federated user is generally part of a role-based access control (RBAC) schema where the user is part of an authenticated group with authorized access to the server/directory/application/service in question. Cloud-based access controls often require Multi-Factor Authorization (MFA) where a PIN+security token is required in addition to your login password to gain access. I won't go into that here, but Wikipedia does a pretty good job of explaining MFA (also often known as 2FA if only password+PIN/token are the only two authentication/authorization criteria).

I hope this helps.

Tom Regner - CISSP, Sr. Technical Writer, Cloud Operations

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.