Note: Many topics at this site are reduced versions of the text in "The Encyclopedia of Networking and Telecommunications." Search results will not be as extensive as a search of the book's CD-ROM.

According to RFC 2828 (Internet Security Glossary, May 2000), authentication is "the process of verifying an identity claimed by or for a system entity." The key word here is verify, and the correct terminology is to say that "an authentication system verifies an identity."

Authentication can provide assurance that users (or systems) are who they say they are. Authorization refers to a user's ability to access resources on a network, usually based on user account rights and privileges. Refer to "Access Control" for details about how authenticated users are allowed to access system resources.

Authentication may be performed directly on the computer that the user is attempting to access, but in distributed environments, the user account and security information are usually stored and managed by a special security server. When a user logs on, the username and password are verified with the security server. Done properly, passwords are never sent across the wire. It is essential that the user's password be kept private and never cross the network, especially as readable text where eavesdroppers could easily capture the information and use it to access secure systems by masquerading as the user. Instead, unique handshake schemes are used to authenticate users in a secure way as discussed here.

While stand-alone security servers provide many benefits (centralized security and security management), authenticating users in distributed environments presents a number of interesting challenges.