0

From a conceptual point of view, can authorization occurs without authentication taking place first? I'm thinking about few cases where authorization seems to occur without authentication taking place first:

  1. A web application denying access to a protected page to an unauthenticated user;
  2. A firewall denying access to host
Improve this question
  • 1
    Technically, Authorization always comes first before Authentication. You are denied access until you Authenticate and are granted different Authorization. – schroeder♦ Sep 3 '15 at 19:58
  • @schroeder i agree, i think also these examples show authorization occuring without authentication first. – Othman Sep 3 '15 at 20:06
  • 1
    I guess you could call unauthenticated access a form of authentication, but that would be about the same as calling "being bald" a type of a "hairstyle." – mricon Sep 3 '15 at 20:33
3

Authentication is about proving the identity of a requester. "Identity" can be a specific property or requirement, e.g. "being a US citizen" or "being 21+ years old" (to take some examples from @David's answer).

Authorization is about deciding what a specific identity should be allowed to do. For instance, an authorization rule can state that "whoever is 21+ years old can buy beer".

In general you will need both to be granted access. In the beer example, the bartender needs to make sure that the putative customer really is 21+ years old, and he must also, at some point, get the information that beer can legally be sold to customers who are 21+ years old. The order in which he does both operations is not relevant, as long as they are both fulfilled. In fact, the beer-selling example is a prime example of authorization occurring before authentication: the bartender learns about the authorization rule ("21+ -> OK") way before he meets the customer.

In many computer systems, we prefer to do authentication first, for the following reasons:

  • Getting authorization rules for the request at hand may be expensive. We do not want to do that for any as-yet-unauthenticated requester, because it could become a Denial-Of-Service.

  • Sysadmins are usually nervous about making their authorization rules known by and large. Gathering authorization information before authentication can leak such information to just anybody.

Improve this answer
1

The only possible point of authorization without authentication that I can think of, and this is gleaned from previous posts, is the idea of a unauthenticated user. In the case of wireless LANs, if you are not authenticated you are authorized to access a restricted network.

In this case this network may be restricted to people that are specifically not authenticated and authorization is applied before authentication occurs.

In this case the reverse logic is used, if you are not authenticated then you are authorized to access this network.

Thanks

Improve this answer
0

From a conceptual point of view, can authorization occurs without authentication taking place first?

Not really.

A web application denying access to a protected page to an unauthenticated user;

The web application needs to fail to authenticate the user before it can know to apply the authorization rule for unauthenticated user. So authentication already happens before the server knows to authorize the user to view only an access denied page.

A firewall denying access to host

A firewall authenticates a packet based on the source and destination IP addresses and ports. So it's not really unauthenticated.

Improve this answer
  • 1) you need to explain "not really", 2) this violates the basic idea of secure access which is "deny, unless authenticated" meaning nothing needs to fail, but rather, something needs to succeed, 3) I'm not sure any portion of this answer is correct - there are ways that firewalls can authenticate on far more than port/IP and port/IP isn't an "authentication" – schroeder♦ Sep 4 '15 at 15:10
  • 1
    @schroeder: tell me how are you supposed to know whether a person is allowed entry into a building before you determine who the person is? You can't. You need to determine the rule to apply (authentication) before you can apply the rule (authorization). The only way you can do authorization without authentication is if your rule is simply an allow all (or deny all), in which case the auth is moot. The process of determining the rule for that applies for the incoming data is what is meant here by authentication. – Lie Ryan Sep 4 '15 at 15:39
  • 1
    @schroeder: I don't see how this violates the idea of deny by default. Whether you call it "failing authentication" or "authenticated as unauthenticated user" or "no successful authentication" is just a matter of semantic/wordplay. They essentially boil down to the same thing: the rule for unauthenticated user is to be applied, which in most cases means to deny access. – Lie Ryan Sep 4 '15 at 15:45
  • 1
    @schroeder: I'm specifically talking about the narrow case of a basic TCP/IP layer firewall, not higher level firewalls. A TCP/IP layer firewall groups streams of packets into streams by the IP/port combinations, and based on the rule set by the network administrator, the traffic analyzer dynamically adapts the firewall rules to block/redirect IP/port that the analyzer deemed undesirable/requires inspection. Some firewall products combine firewall, traffic analyzer, and other heuristics engines to a single product and calls the entire thing firewall. I'm not referring to that type of firewall. – Lie Ryan Sep 4 '15 at 15:57
0

You have to go back to the original meaning of both words.

  • to authenticate is to prove the authenticity or validity of a given assertion or claim. For instance I claim to American. I have to prove it is true. I do that with a birth certificate or a passport. It proves I am American. I have authenticated a piece of information about me. Another great example is your data of birth. You go to a bar and you authenticate your age. Yes you are over 21. Yes you can drink. Who you are is irrelevant. Authentication in IT is usually about proving your identity i.e., I am Bob.

  • to authorize is to let a client do an action on an application or a service or data. In my previous examples, the bartender would authorize the client to drink a glass of wine.

With this in mind, can authorization happen before authentication? If you consider authentication about proving your identity, your name, then yes authentication can happen after authorization, i.e. I drink but I haven't proven my identity.

If however you take authentication in the broader sense, then no you cannot authorize without having authenticated some claims / assertions of the client first.

Improve this answer
0

Authorization can happen before authentication.

In a system where authorization checks are inexpensive and fast and authentication checks are expensive and slow you might choose to do the authorization check first.

An example would be something like SSH. If the user account is disabled and logins aren't permitted the server could reject the session before an authentication check happens on the premise that even if the client can authenticate the login would fail.

One caveat is that this kind of system would let an unauthenticated entity enumerate authorization grants.

Improve this answer
0

From a conceptual point of view, can authorization occurs without authentication taking place first?

Yes, but not before identification, which is the first checkpoint in any realm system.
When the identification doesn't occur at all, it's just a case of an identification failure in which the authorization may be applied without authentication.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.