Complete Guide to Authentication in 2024

What is Authentication?

Authentication is the process of determining if the person or entity accessing a computing system really is who they claim to be. Authentication systems make a binary decision: They allow or deny access based on credentials or other proof provided by those requesting access. Authentication typically works together with authorization systems, which determine what type or level of access a user should have.

Any computing system can and should have authentication—hardware appliances, networks, servers, individual workstations, mobile devices, and internet of things (IoT) devices. In reality, many devices and computing systems have weak or ineffective authentication, or authentication is not properly configured by administrators, resulting in severe security risks.

This is part of an extensive series of guides about access management.

In this article:

How Does Authentication Work?

In a traditional authentication process, the user types in their credentials, such as a username and a password. The authentication system queries a user directory, which is either stored in the local operating system or on an authentication server. If the credentials match, the user is allowed to access the system. In the second stage, permissions assigned to users determine what objects or operations they are allowed to access, and other access rights, such as allowed access times and rate limits.

Traditional Authentication with Username and Password

The traditional authentication process created several challenges:

Traditionally, each IT system or application would handle its own authentication. This created a burden on application developers and meant that authentication systems were non-standard, in many cases not secure.
Applications are increasingly delivered over the web. Today most applications communicate via HTTP and HTTP/S. These are stateless protocols, meaning that in a traditional authentication model, users would have to login to a web application every time they accessed it.
Password-based authentication is very easily compromised by attackers, and is also inconvenient to users.

New Authentication Methods

The following innovations help address these challenges:

Standardized authentication protocols such as OIDC and SAML make it possible for application developers to use a standardized, secure authentication mechanism, without having to develop one themselves.
Token-based authentication enables users to verify their identity once via an authentication service. The service then issues a signed authentication token to the application, allowing them to sign in without providing credentials again, until the token expires.
Multi-factor authentication supplements password-based authentication with additional, stronger authentication methods, such as biometric authentication, physical tokens, and one-time passwords sent to mobile devices.

What Is Authentication Used For?

Authentication is a cornerstone of cybersecurity, serving multiple critical purposes across various domains:

Securing access to systems and data: Authentication ensures that only authorized users can access sensitive systems and data. This is vital for protecting organizational resources from unauthorized access and potential breaches.
User accountability: By verifying user identities, authentication systems maintain logs of user activities. This enables organizations to track actions back to specific users, which is essential for audit trails and compliance with regulatory requirements.
Protecting sensitive transactions: In financial services, healthcare, and other sectors handling sensitive transactions, authentication helps verify the identities of parties involved, reducing the risk of fraud and ensuring data integrity.
Enabling secure remote work: With the rise of remote work, authentication is crucial for securing remote access to corporate networks and applications. It ensures that remote employees can safely connect to organizational resources from various locations.
Supporting Identity and Access Management (IAM): Authentication is a key component of IAM systems, which manage user identities and their access to resources. This supports the principle of least privilege, ensuring users have access only to the resources necessary for their roles.
Enhancing user experience: Modern authentication methods, such as single sign-on (SSO) and biometric authentication, streamline user access to multiple applications and services. This reduces the need for multiple passwords and improves overall user convenience and security.

Authentication vs. Authorization: What’s the Difference?

Authentication is the gatekeeper that decides who gains access to an organization’s resources, including critical systems like databases, networks, business apps, and web applications. Once users are authenticated, they undergo authorization to determine which resources or specific functions they can access, based on the system’s role or permission structure.

The difference between authentication and authorization can be summarized as follows:

Authentication is responsible for verifying the identity of a user, process, or device
Authorization is responsible for identifying if an authenticated entity has permission to access certain resources, or perform certain operations

Access control refers to the complete process of granting access to users, including both authentication and authorization.

What are Authentication Factors?

An authentication factor is a certain proof that verifies a user’s identity. Here are the three categories of authentication factors:

Knowledge Factor

A knowledge factor is a category of credentials that users are expected to know. Common knowledge factors include usernames, passwords, personal identification numbers (PINs), and answers to security questions.

Once a user logs in to an application, the security system asks them to provide their credentials – typically a username and a corresponding password. However, since passwords consist of a sequence of numbers, special characters, and letters, threat actors can easily crack, guess, or steal them. You can mitigate this by adding multifactor authentication (MFA).

Possession Factor

This factor requires users to provide evidence of possessing physical items, such as SIM cards, smart cards, mobile phones, FIDO2 security keys, and hardware OTP tokens. By checking whether the user has a certain piece of hardware, organizations can make it much more difficult to breach.

A threat actor can bypass this by conducting a swapping attack and gaining remote access to or stealing a certain piece of hardware. However, bypassing possession factors is much more difficult than launching a brute force attack.

Inherence Factor

Inherence is considered the strongest authentication factor because it asks users to confirm their identity by presenting evidence inherent to unique features. Common inherence factor examples include biometrics like fingerprint scans, retina pattern scans, and facial recognition.

Types of Authentication

Here are the primary types of authentication used to authenticate users and service connections.

Token authentication – a commonly-used authentication protocol that allows users to authenticate themselves once and receive a token verifying their identity. As long as the token is valid, the user can access the website or application without signing in again.

Related: Token Based Authentication

Password authentication – this requires users to memorize their credentials—typically a username and password in the form of letters, numbers, or special characters. The combination of username and password verifies the user’s identity. The more complex the password and the more frequently it is renewed, the more secure the account.
Biometric authentication – identifies individuals based on their unique biological characteristics. It stores data about an individual—for example, their fingerprint or the shape of their iris—and then compares a real-time reading with this stored data. Biometric authentication is convenient for users and is inherently secure.
Certificate-based authentication – uses a digital certificate to identify a user before accessing a resource. Digital certificates are impossible to forge without possessing the private key. It can be used to authenticate a user, device, or service account. Most certificate-based authentication solutions come with a cloud-based management system.
Multi-factor authentication (MFA) – a combination of two or more authentication factors. These can include any of the above types. Combining several factors significantly improves security and makes it much more difficult for attackers to compromise accounts.
Passwordless authentication – allows a user to access an app or IT system without entering a password or answering security questions. Instead, users provide other forms of proof such as fingerprints, proximity badges, or codes generated by hardware tokens. This authentication is often combined with MFA and single sign-on (SSO).

Single Sign On (SSO)

SSO allows users to securely verify their identity in multiple user accounts using one set of credentials. For example, a user can log in via Google, Apple, Facebook, or another provider, and grant permission to use their credentials to log into a third party application. SSO is based on certificates or tokens exchanged between service providers and identity providers.

The identity provider uses a token to send identity information to the service provider, verifying that it has successfully authenticated the user. The service provider then grants access to the user.

Authentication Protocols

An authentication protocol is a set of rules that allow a system to verify the identity of an endpoint (laptop, desktop, phone, server, etc.) or a user. Here are a few common authentication protocols.

Password Authentication Protocol (PAP)

PAP is the least secure protocol for authenticating users, primarily because it is not encrypted. This is a login process that requires a username/password combination to access the specified system, and verifies the provided credentials against a user directory.

Challenge Handshake Authentication Protocol (CHAP)

CHAP is an authentication protocol that uses a three-way exchange to authenticate users, verifying their identity with strong encryption. This works as follows:

1. The local device sends a “challenge” to the remote host

2. The remote host sends a response using a cryptographic hash function

3. The local device checks if the hash value of the response matches the expected response, and if so, establishes an authenticated connection (“handshake”). Otherwise, it closes the connection.

CHAP is more secure than PAP, because PAP only performs authentication when the user is first authenticated, while CHAP verified authentication on an ongoing basis.

OpenID Connect (OIDC)

OIDC leverages the authentication and authorization mechanisms of OAuth 2.0, commonly applied by numerous identity providers. It was created by the OpenID Foundation (OIDF), a non-profit dedicated to OpenID technology.

Here is the key difference between OIDC and OAuth 2.0:

OAuth 2.0 is an authorization protocol
OIDC is an identity authentication protocol

OIDC helps a client service verify the identity of end-users. It can also share (on request) user claims such as name and email address.

OIDC works with various clients, including single-page applications (SPA) and mobile applications. Here are key benefits of OIDC:

You can use OIDC for single sign-on (SSO) across several applications.
OIDC uses JSON Web Tokens (JWT), and HTTP flows to avoid sharing end-user credentials with client services.
The protocol comes with built-in consent, requiring explicit consent from users before sharing their data.
OIDC is simple to implement and is ideal for use in mobile applications.

Related: OIDC Authentication

Lightweight Directory Access Protocol (LDAP)

LDAP is a software protocol that enables users or applications to locate data about organizations, individuals and other resources, such as files and devices in a network. It can be used for resources on the public Internet or a corporate Intranet. The LDAP directory tells the user where in the network something is located. For example, it is possible to search for a specific user or a service available on the network. LDAP returns the hostname, and then the user can use DNS to obtain the IP and connect to it.

Security Assertion Markup Language (SAML)

SAML is an open standard that allows application developers to implement single sign on (SSO) and federated identity. It provides a standardized and secure protocol, based on XML, that allows applications to transfer authentication and authorization data between them. SAML can be used to implement SSO among multiple applications, which can be deployed within an enterprise network, operated by third-party vendors, or running within customer networks. All these applications can request and receive a user’s identity, authentication, and authorization levels.

Related: OIDC vs SAML

Extensible Authentication Protocol (EAP)

The protocol supports different types of authentication, from one-time passwords to smart cards. When used for wireless communications, EAP is highly secure because it allows remote devices to perform mutual authentication using built-in encryption. In the EASP protocol, all transmissions are encrypted—this is achieved by connecting the user to an access point, requesting credentials, verifying their identity through an authentication server, and then requesting a user ID through the server to verify again.

JSON Web Token (JWT)

JWT is an encoded version of a “claim”, a secure transfer of information between two parties. A claim can be used to:

Assert that a specific party issued the token and it is authentic
Determine how long the token is valid
Provide information about permissions granted to the user
Provide general information about the user which can be used by the application

JWTs use a digital certificate to prove who issued the claim. Technically, a JSON Web Token includes three parts: a header, specifying the algorithm used in the certificate, a payload, which contains the information included in the claim, and the digital signature.

Related: JWT Authentication

API Authentication Methods

Application Programming Interfaces (APIs) are increasingly used to extend application functionality, enable integration between software components, and access remote data services. API authentication does not involve a human user. Instead, it verifies that a service account making programmatic calls is allowed to access the system.

Basic HTTP Authentication

With this method, the user agent provides a username and password to prove its identity. This method utilizes the HTTP headers themselves and requires no cookies, session IDs or login pages. It is easy to use, but is vulnerable to attacks that can intercept user credentials in transit.

API Keys

An API key is an identifier that indicates who is making a web service request (or other API request). A key is generated when new users register for the API. The API key is associated with a security token, which the user agent sends with every future request. When a user agent attempts to re-enter the system, it provides a unique key to prove that it is the same user as before.

Although this API authentication method is very fast and reliable, it is often misused. More importantly, you should realize that API keys are not an authorization method, and without setting up authorization, all users will have access to all API functionality.

OAuth 2.0

Open Authorization is an open standard authorization protocol based on tokenization. It is commonly used across the Internet to enable third-party services like Google and Twitter to share end-user account information without exposing user credentials to the third party. OAuth serves as an intermediary acting on behalf of end-users. It provides third-party services with an access token authorizing the sharing of specific account information, eliminating the need to share passwords. This process of obtaining an access token is called “authorization flow”.

OAuth 2.0 offers the same benefits, but it is a new protocol that does not offer compatibility with OAuth 1.0. Notable OAuth 2.0 improvements include:

Simplified signatures
A new authorization code flow that accommodates mobile applications
Short-lived tokens that support long-lived authorizations

Related: OAuth Grant Types

Authentication Strategies in a Microservices Architecture

Most development teams are transitioning from a monolithic application architecture to a microservices architecture. A microservices application is decomposed into multiple, independent components, each of which does one thing well. These microservices communicate with each other using APIs, and are easy to maintain and update. In a microservices architecture, there are several important concerns with regard to authentication:

Do clients communicate with microservices directly?
Who is responsible for authenticating requests?
How to share data, such as user directories, across microservices?

Here are three possible approaches and their pros and cons.

1. Authentication Performed Separately By Each Microservice

One approach is to have each microservice implement authentication separately. This is quite problematic, because it requires duplication of the authentication code on each microservice. It also requires duplicating user authentication data between all microservices, or forcing specific clients to connect to specific microservices, which creates strong coupling.

A better way to implement this approach is to have a central authentication database, such as a user directory, which all microservices can query. This reduces duplication and coupling, but still requires each microservice to implement authentication.

2. Backend Authentication Service

In this approach, the application includes a dedicated microservice that performs authentication. This microservice is deployed behind the scenes, and when a microservice receives an authentication request, it forwards it to the authentication microservice to verify the user’s identity.

One downside of this approach is that it slows down processing requests, because each request needs to travel to the authentication service and back. Another downside is that authorization is determined by business logic. There may be separate authentication policies for each microservice, and these need to be stored in the authentication service, again creating strong coupling.

3. API Gateway

The most mature and effective approach is to use an API gateway—this is a service deployed in front of the microservices application, which serves as a single endpoint for all user requests. Users send requests to the API gateway without being aware of the underlying microservices. The API gateway handles authentication, and forwards the request to the relevant microservice.

This addresses most of the issues in the first two approaches. It eliminates coupling, and reduces the latency of authentication requests. To solve the problem of authorization business logic, the API gateway can forward a request together with details about the user and their security context, and each microservice can use this information to form its own authorization decision.

Best Practices for Authentication Security

Use Passwordless Authentication

Passwordless authentication eliminates the need for users to remember and manage complex passwords, reducing the risk of password-related security breaches. This method leverages alternatives such as biometrics, hardware tokens, or one-time codes sent to trusted devices. By using these stronger, more user-friendly authentication methods, organizations can significantly improve security while also enhancing user experience.

Implementing passwordless authentication often involves integrating with identity providers that support standards like WebAuthn, which allows for secure and seamless authentication using devices with built-in security features. Additionally, passwordless systems can be combined with multi-factor authentication (MFA) to provide an even higher level of security, ensuring that unauthorized access is prevented even in cases where a user’s biometric data or hardware token is compromised.

Use Secure Authentication Tokens

Authentication tokens, used in systems such as token-based authentication, must be securely stored and transmitted to prevent unauthorized access. Ensure that tokens are encrypted during transmission and storage using secure algorithms. Implement secure token storage solutions, such as hardware security modules (HSMs) or secure key management services, to safeguard tokens from being exposed.

Use short-lived tokens to minimize the impact of potential token theft, and employ token revocation mechanisms to immediately invalidate tokens in case of suspicious activity or token compromise. Educate developers on secure token handling practices to prevent common vulnerabilities like token leakage.

Monitor and Log Authentication Attempts

Consistently monitor and log all authentication attempts to detect and respond to suspicious activities. Implement comprehensive logging mechanisms that capture details such as login times, IP addresses, and user-agent strings.

Use centralized logging systems and integrate with security information and event management (SIEM) tools to analyze logs in real-time. Automated alerts should be configured to notify security teams of unusual patterns, such as multiple failed login attempts or logins from unfamiliar locations.

Implement Account Lockout Mechanisms

To protect against brute-force attacks, implement account lockout mechanisms that temporarily disable accounts after a predefined number of failed login attempts. Configure account lockout policies to trigger after a threshold of 3-5 consecutive failed attempts, with lockout durations ranging from a few minutes to several hours, depending on security requirements.

Implement progressive delay strategies, where the lockout duration increases with each subsequent failed attempt, to further deter attackers. Ensure that account lockout events generate alerts for administrators, enabling them to investigate potential attack attempts and assist legitimate users in regaining access if locked out.

Authentication for SaaS with Frontegg

Frontegg’s solution acts as a flexible authentication-as-a-service for all kinds of SaaS use-cases and requirements. For starters, it offers powerful user-based authentication, including powerful protocols such as OAuth, Open ID connect, SAML, and WebAuth. You can also enjoy granular security policies such as MFA, user lockouts, device verification and much more.

Start for free

See Additional Guides on Key Access Management Topics

Together with our content partners, we have authored in-depth guides on several other topics that can also be useful as you explore the world of access management.

Read the guide

Cookie	Duration	Description
_vis_opt_s	3 months 8 days	Visual Website Optimizer sets this cookie to detect if there are new to or returning to a particular test.
_vis_opt_test_cookie	session	Visual Website Optimizer creates this cookie to determine whether or not cookies are enabled on the user's browser.
li_gc	6 months	Linkedin set this cookie for storing visitor's consent regarding using cookies for non-essential purposes.
lidc	1 day	LinkedIn sets the lidc cookie to facilitate data center selection.
messagesUtk	6 months	HubSpot sets this cookie to recognize visitors who chat via the chatflows tool.

Cookie	Duration	Description
_gcl_au	3 months	Google Tag Manager sets the cookie to experiment advertisement efficiency of websites using their services.
_hjSession_*	1 hour	Hotjar sets this cookie to ensure data from subsequent visits to the same site is attributed to the same user ID, which persists in the Hotjar User ID, which is unique to that site.
_hjSessionUser_*	1 year	Hotjar sets this cookie to ensure data from subsequent visits to the same site is attributed to the same user ID, which persists in the Hotjar User ID, which is unique to that site.
_hp2_ses_props.*	1 hour	Heap sets this cookie to store the timestamp and cookie domain or path.
_omappvp	1 year 1 month 4 days	The _omappvp cookie is set to distinguish new and returning users and is used in conjunction with _omappvs cookie.
_omappvs	20 minutes	The _omappvs cookie, used in conjunction with the _omappvp cookies, is used to determine if the visitor has visited the website before, or if it is a new visitor.
_vwo_uuid_v2	1 year	This cookie is set by Visual Website Optimiser and calculates unique traffic on a website.
cb_anonymous_id	1 year	Clearbit sets this cookie to track page views and traits for Clearbit.
cb_group_id	1 year	Clearbit sets this cookie to track page views and traits for Clearbit.

Cookie	Duration	Description
bcookie	1 year	LinkedIn sets this cookie from LinkedIn share buttons and ad tags to recognize browser IDs.
cb_user_id	1 year	Clearbit sets this cookie to collect data on visitors. This information is used to assign visitors into segments, making website advertising more relevant.

Cookie	Duration	Description
__Host-session	14 days	No description available.
__tld__	session	Description is currently not available.
_cfuvid	session	Description is currently not available.
_crowdcontrol_session_key	session	Description is currently not available.
_g2_session_id	session	Description is currently not available.
_hp2_hld346349427843107.1065080579	5 minutes	Description is currently not available.
_hp2_hld6722177740337317.1065080579	5 minutes	Description is currently not available.
_hp2_hld8090462093010520.1065080579	5 minutes	Description is currently not available.
cbtest	1 year	Description is currently not available.
debug	never	No description available.
events_distinct_id	session	Description is currently not available.
h1_device_id	1 year	Description is currently not available.
pfjscookies	1 year	Description is currently not available.

Complete Guide to Authentication in 2024

What is Authentication?

How Does Authentication Work?