What is authentication, and what exactly does it verify?
Authentication (Authentifizierung) is the recurring process of checking that a (partial) identity really belongs to the subject presenting it, by verifying with a certain confidence that the subject's credentials match the claimed identity.
Three words in that definition carry the meaning:
- Recurring: authentication happens at every login, again and again. The one-off steps that come before it (checking who someone is and registering them) are identity proofing and enrollment, a different process.
- (Partial) identity: a person has many partial identities, such as an employee account, a private mail account or a bank customer number. Authentication checks the link between one of them and the subject in front of the system.
- With a certain confidence: authentication never delivers certainty, only a degree of assurance that depends on the means used.
It helps to separate it from identification: typing a user name claims an identity ("I am alice"); authentication is the proof of that claim. Only after both comes authorisation, the decision about what the authenticated subject may do.
German uses several words for the same process: Authentifizierung, Authentifikation, Authentisierung, and in everyday speech simply Login. Some German texts distinguish Authentisierung (the subject presents proof) from Authentifizierung (the system checks it), but they are often used as synonyms.
Go deeper:
Authentication (Wikipedia) — authentication in computer science, its factors and types.- OWASP Authentication Cheat Sheet — how authentication is built and hardened in real applications.