Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am vague among the three following terms: authorization, federation, entitlement (as stated by the OpenAM product: OpenAM provides open source Authentication, Authorization, Entitlement and Federation software). I cannot differentiate which one is about what.

Could anyone please point me a simple definition about these terms?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

Authorization is the access policy stating to which protected objects or services a client has access.

Authentication is the proof of identity that the client provides to validate his authorization.

Federation (usually identity federation) is to make one central online identity valid over several different services. Google Accounts and Facebook Connect are identity federation systems.

Entitlement could be anything IMO. The closest I get is that when you are authorized access to a service or object, you are entitled as authorized to that service or object.

This way, to get access to your Security.StackExchange account, you may authenticate with your Google Accounts ID and find that you've (earlier) authorized StackExchange to use your Google ID credentials at that service. Also, when authenticated, you find that your Google Accounts user is authorized to access StackExchange, and you are approved access.

A classic misconception is that authorization is the same as access approval, although authorization is established in the registration phase (happens only one time), but access approval is done each time, based on the authenticated user's authorization, looked up in the access policy.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.