This is my first question here in Information Security SE. Is there a recommendation to help telling the scenarios where authentication should precede authorization from the ones where authorization comes first?
I experienced both situations at different workplaces (the situation was very similar, switching to a system user with a certain set of privileges in Unix command line). When does authorization need to come first to spare the authentication? When should it authenticate first so as to not to tell a potential intruder that the user impersonated would not be entitled for the current operation?
Are there situation specific generic guidelines or rules for this?
--
OK, let me come up with a specific situation. Logged in with own employee user ID, SUing to another user. I mistyped the system user I was about to switch to, but the other is also an existing user in our environment. Before asking for password, I got rejected saying I wasn't authorized to perform this operation.
Given that I just finished an anti-social engineering course today, I wondered whether it was a good idea to tell me I wasn't authorized (even this may be a useful piece of information for someone trying to impersonate me in the corporate network).
su
on an account, then you are not allowed just like you wouldn't be allowed tols
a forbidden directory. When we refer to authentication here, it's not the authentication built inside ofsu
, but the authentication done bysu
(effectively reading your UID and GID) in order to determine whether you should be authorised to use the utility with the passed parameters. It's like askingls
to show you a file before it verifies whether you're allowed to. – Steve Dodier-Lazaro Jul 14 '14 at 19:23