These options serve a different purpose.
authby specifies an authentication method that is used during IKE.
secret sets it to pre-shared keys (PSK), which need to be strong to be secure (they are otherwise vulnerable to active attackers). IKE security associations (SAs) are used to negotiate ESP or AH SAs between the two authenticated peers.
ah causes the negotiation of an Authentication Header (AH) SA, which can be used to integrity protect and authenticate actual IP traffic. However, the AH protocol does not provide confidentiality, i.e. traffic won't be encrypted, and it won't work over NATs because the addresses in the IP header are included in the Integrity Check Value (ICV).
For both confidentiality and integrity protection/authentication use the Encapsulating Security Payload (ESP), which is the default in strongSwan (specific algorithms can be configured using the
esp option). It doesn't protect the outer IP header, like AH does, but it works over NATs.
Note that strongSwan does not support the combination of the two protocols, that is, the
esp options are mutually exclusive.