Auth: Authn vs Authz

[hhstore]

related:

• ✅ Golang: Authentication Design #139 : AuthN
• ✅ Golang: Authorization/IAM(Identity and Access Management) Design #140 : AuthZ

[hhstore]

AuthN(Authentication) vs AuthZ(Authorization):

概念:

• https://www.cloudflare.com/zh-cn/learning/access-management/authn-vs-authz/
• ✅ AuthN 是 Authentication（身份验证）的缩写. 侧重: 登录 - 识别用户身份
• ✅ AuthZ 是 Authorization（授权）的缩写. 侧重: 鉴权 - 判定用户权限
• ✅ 这是身份和访问管理 (IAM) 领域中两个独立但紧密交织的概念.

扩展:

• ✅ https://goteleport.com/blog/authn-vs-authz/
• ✅ https://www.hashicorp.com/resources/microservice-authn-and-authz
• ✅ https://youtu.be/ZjPF8yZ83Wo
• ✅ https://www.infoq.cn/article/zfd1bdaqkbuprrwollu1
• ✅ https://blog.mimvp.com/article/37553.html

[hhstore]

AuthN:

参考:

• ✅ https://blog.mimvp.com/article/37834.html
• ✅ https://blog.mimvp.com/article/37796.html
• ✅ https://zhuanlan.zhihu.com/p/38942172

方案:

• ✅ Basic Auth（HTTP 基本认证）: http + password
• ✅ 基于 Session 的认证: http + cookie + session
• ✅ Bearer Token 或者 Basic Auth Password
• ✅ JWT(JSON WEB TOKEN)
• ✅ OAuth (开放授权)
• ✅ SSO
• ✅ 硬件加密设备: hardware tokens (FIDO U2F tokens, RSA tokens, Yubikey)
• ✅ 外部软件设备: mobile devices (SMS/call verification, push approvals, TOTP apps)
• ✅ 生物芯片: 指纹/人脸识别等
• ✅ Two-factor authentication: 2FA, TFA, second-factor authentication
• ✅ Multi-factor authentication (MFA)

JWT:

• https://jwt.io/
• https://talkgo.org/t/topic/1114

[hhstore]

AuthZ:

方案:

• ✅ Role-based access control (RBAC): 基于角色的访问控制
• ✅ Attribute-based access control (ABAC): 基于属性的访问控制

[hhstore]

API 加密签名方案:

• https://blog.mimvp.com/article/37824.html