TL;DR
An authentication server verifies user identities before granting access to networks, applications, or systems — using either single-factor or multi-factor methods. It works in tandem with an authorization server, which determines what a verified user is permitted to access. Choosing the right authentication approach is a critical security decision for any organization.
What is an authentication server?
An authentication server manages processes that allow access to a network, application, or system.
Before connecting with a server, users must prove that they are who they say they are. An authentication server handles this delicate work. You can embed authentication servers within switches, dedicated computers, or network servers. They can use out-of-the-box software, or they can run on custom code written for your organization.
No matter how you set up and deploy them, these servers have a vital role to play in keeping your critical assets safe and protected.
Is a person visiting your server an imposter? Or is this person someone you both know and trust? Authentication answers those questions.
Authentication typically begins with a password. Most of us have between 70 and 80 of them, and we're very familiar with what they are and how they work. When we visit sites, we pair passwords with usernames to gain entry.
Authentication servers can tackle this username/password combination via one of two methods:
- Single-factor: When the user enters the correct data in both fields, authentication is complete. In this case, the password is the one factor the server verifies.
- Multi-factor: The correct username/password combination isn't enough. The site requires one more step to complete authentication. That may involve sending a temporary passcode to a linked device, using a Yubikey, or other methods.
Single-factor systems seem simple for users. But it can be hard to remember all of our username/password combinations. Experts recommend using an electronic password manager to lighten the workload. But some users simply reuse the same data from website to website. A hacker with access to the right combination could log in on multiple sites.
Multi-factor authentication is more secure, as people must jump through two hoops to enter. More than half of all enterprise companies use this method to secure their sites, and more embrace the technology each year.
How does an authentication server work?
The process of verifying a person's right to access a file happens very quickly. Most users don't notice the delay. But plenty of steps are happening behind the scenes.
In a single-factor authentication site, the process looks like this:
- The user enters a username and password. The site encrypts (or scrambles) that data and sends it to the server.
- The server decrypts (or unscrambles) the data and compares it to information listed in the database.
- If the items entered match a saved combination, authentication is complete.
More steps are involved in a multi-factor authentication process:
- The user enters a username and password. The site encrypts the data and sends it to the server.
- The server decrypts the data and compares it to information saved in the database.
- If the server finds a match, it creates a one-time password that it sends back to the user. A text message sent to a cellphone on file or a note to a key in the user's possession would work. The server creates an open window, ready to accept the one-time password.
- The user receives and enters that one-time password. Authentication is complete.
Plenty of authentication protocols exist, including:
- Kerberos
- Remote Authentication Dial-In User Service (RADIUS)
- Microsoft NT LAN Manager (NTLM)
They all use slightly different technology and coding types. But each one moves users through the steps we've described above.
What's the difference between authentication and authorization?
It's easy to confuse two terms that look very similar and that people often use in concert. But it's critical to understand what sets authentication and authorization apart.
Put simply, authentication involves verifying a person's identity. Authorization involves verifying what that user should and should not access.
An authentication server handles the first step. When the server's work is complete, the person's identity is confirmed. But the authentication server must then work with an authorization server. This tool releases an access token, opening up the appropriate permissions.
| Concept | Definition | Server role | Real-world example |
|---|---|---|---|
| Authentication | Verifying a person's identity | Authentication server confirms who you are | Providing your name and email address at a conference check-in |
| Authorization | Verifying what a user should and should not access | Authorization server releases an access token with appropriate permissions | Receiving a badge and tickets for the sessions you registered and paid for |
A real-world example of authentication and authorization
An example from the physical world might make this relationship clear. Imagine that you're attending a conference of security professionals. When you arrive, you provide your name and email address, and the organizers check that data against a list of registered users. You've moved through authentication.
Then the team looks over the sessions you've registered for and the payments you've made. With that complete, they give you a badge and tickets for various events. You've moved through authorization and can do what you need to do at the conference.
Most websites pair authorization and authentication. For example, colleges use these systems to give students website logins while blocking them from seeing data from their peers.
Learn more about security with Okta
Should you use single-factor authentication? Or do you need the safety only multi-factor authentication can provide? Where should your server sit within your company's architecture?
Security teams have plenty of questions, and it's not always easy to find the answers. Find out how we can help you with multi-factor authentication, user authentication, and more.
Frequently asked questions
What does an authentication server actually do?
An authentication server manages processes that allow access to a network, application, or system. It verifies a user's identity — typically through a username and password — before granting entry, and works alongside an authorization server to determine what the verified user is permitted to access.
What is the difference between single-factor and multi-factor authentication?
Single-factor authentication is complete once the user enters the correct username and password combination. Multi-factor authentication requires one additional step, such as entering a temporary passcode sent to a linked device or using a Yubikey, making it more secure than single-factor alone.
How does the authentication process work step by step?
In a single-factor process, the user enters a username and password, the site encrypts and sends that data to the server, the server decrypts and compares it to the database, and authentication is complete if a match is found. Multi-factor authentication adds further steps: after a match is found, the server generates a one-time password and sends it to the user, who must then enter it to complete authentication.
What is the difference between authentication and authorization?
Authentication involves verifying a person's identity, while authorization involves verifying what that user should and should not access. An authentication server handles identity confirmation first; an authorization server then releases an access token that opens up the appropriate permissions.
What authentication protocols are commonly used?
Commonly used authentication protocols include Kerberos, Remote Authentication Dial-In User Service (RADIUS), and Microsoft NT LAN Manager (NTLM). They all use slightly different technology and coding types, but each moves users through the same fundamental authentication steps.
Where can an authentication server be deployed?
Authentication servers can be embedded within switches, dedicated computers, or network servers. They can use out-of-the-box software or run on custom code written for your organization.
References
New Research: Most People Have 70-80 Passwords. (February 2020). Newswire.
Study Reveals Average Person Has 100 Passwords. (October 2020). Tech.Co.
More Enterprises Use Multi-Factor Authentication to Secure Passwords. (October 2019). Security.
Understanding and Selecting Authentication Methods. (August 2001). TechRepublic.
Understanding Authentication, Authorization, and Encryption. Boston University.
