Identity Security for Software Development

Chapter 5. Authentication and Authorization

A Note for Early Release Readers

With Early Release ebooks, you get books in their earliest form—the author’s raw and unedited content as they write—so you can take advantage of these technologies long before the official release of these titles.

This will be the 6th chapter of the final book.

If you have comments about how we might improve the content and/or examples in this book, or if you notice missing material within this chapter, please reach out to the editor at [e-mail].

From here on in, we will build our identity security skills to improve the security posture of our code and applications. We start with the fundamentals of authentication and authorization, followed by integrating these practices into automation and CI/CD pipelines in later chapters.

Authentication and authorization are often thought of as interchangeable but they’re very different concepts. Authentication (AuthN) is the process of verifying the identity of a user, ensuring they are who they claim to be. Usernames and passwords are familiar forms of authentication but as we’ll see here, they’re not enough to establish true identity. Authorization (AuthZ) is the granting or denying of access rights and permissions to resources after the user’s identity is authenticated. For example, your build manager may have root-level or superuser privileges to a build server while your access is restricted or withheld completely to keep the server secure.

If you ...