Authentication is about proving the identity of a requester. "Identity" can be a specific property or requirement, e.g. "being a US citizen" or "being 21+ years old" (to take some examples from @David's answer).
Authorization is about deciding what a specific identity should be allowed to do. For instance, an authorization rule can state that "whoever is 21+ years old can buy beer".
In general you will need both to be granted access. In the beer example, the bartender needs to make sure that the putative customer really is 21+ years old, and he must also, at some point, get the information that beer can legally be sold to customers who are 21+ years old. The order in which he does both operations is not relevant, as long as they are both fulfilled. In fact, the beer-selling example is a prime example of authorization occurring before authentication: the bartender learns about the authorization rule ("21+ -> OK") way before he meets the customer.
In many computer systems, we prefer to do authentication first, for the following reasons:
Getting authorization rules for the request at hand may be expensive. We do not want to do that for any as-yet-unauthenticated requester, because it could become a Denial-Of-Service.
Sysadmins are usually nervous about making their authorization rules known by and large. Gathering authorization information before authentication can leak such information to just anybody.