# Who Are You? Prove It! Identity Versus Authentication

- Link: https://www.agilicus.com/who-are-you-prove-it-identity-versus-authentication/
- Published: 2023-02-20T19:26:21+00:00
- Author: Don Bowman

Identity and authentication are two related but distinct concepts in the context
of information security.

Identity refers to who or what an entity is. It is a unique identifier that distinguishes
one entity from another. In the digital world, an identity can be represented by
a username, an email address, a digital certificate, or other similar identifiers.
Identity is the first step in any security process, as it allows you to determine
whether the entity you are dealing with is who they claim to be.

Authentication, on the other hand, is the process of verifying that an entity is
who they claim to be. In other words, it is the process of confirming the identity
of the entity. Authentication typically involves the use of credentials such as 
passwords, smart cards, or biometrics, which are used to prove that the entity is
authorized to access a particular system or resource.

An identity provider (IdP) is a service that manages and verifies the identities
of users, and then provides authentication and authorization services to other applications
and services.

When a user tries to access a service or application that uses an IdP, the IdP collects
information from the user to verify their identity. The specific information collected
can vary depending on the type of IdP, the authentication method being used, and
the level of security required by the application or service. However, here are 
some examples of the types of information an identity provider may use:

 1. User ID: A unique identifier for the user, such as an email address, username, 
    or employee ID number.
 2. Password: A secret credential that the user provides to prove their identity.
 3. Personal Information: Additional details about the user, such as name, date of 
    birth, address, or phone number.
 4. Device Information: Information about the device the user is accessing the application
    from, such as the IP address, browser type, or operating system.
 5. Multifactor Authentication Information: Additional methods of authentication beyond
    a password, such as a text message code, a security token, or biometric data (like
    a fingerprint or facial recognition).

The IdP will typically use this information to verify the user’s identity and to
generate a unique token or credential that the user can use to access the application
or service. This token or credential allows the application or service to trust 
that the user is who they say they are, without requiring the user to provide their
credentials every time they access the service.

In summary, identity is the unique identifier that represents an entity, while authentication
is the process of verifying that the entity is who they claim to be. Authentication
is typically based on credentials such as passwords or biometrics, which are used
to prove the identity of the entity.