# Authentication Server An authentication server is a dedicated application or service that handles the process of verifying the identity of a user, device, or system attempting to access a network or other resources. It validates credentials, such as usernames and passwords or security tokens, against a secure database of authorized identities. **Pronunciation:** aw-then-ti-kay-shun sur-ver **Difficulty:** Intermediate **Synonyms:** Identity Provider (IdP), Access Control Server (ACS), RADIUS Server, Kerberos Server **Categories:** Security, Networking **Tags:** security, networking, identity management, access control, cybersecurity Canonical: https://scaleengineer.com/glossaries/authentication-server --- ## Definitions - **Core Functionality in Network Security:** In the context of network security, an **Authentication Server** is a centralized component responsible for validating the identity of clients before they are granted access to network resources. It is a cornerstone of the AAA (Authentication, Authorization, and Accounting) security framework. ***Process Flow:*** 1. A client (e.g., a user's computer) attempts to connect to a network resource (e.g., a Wi-Fi access point or a VPN concentrator). 2. The network device, known as a Network Access Server (NAS), challenges the client for credentials. 3. The client provides its credentials (e.g., username and password). 4. The NAS forwards these credentials to the **Authentication Server** using a protocol like RADIUS. 5. The server checks the credentials against its user database (which could be local or linked to a directory service like Active Directory or LDAP). 6. If the credentials are valid, the server sends an 'Access-Accept' message back to the NAS, which then grants the client access to the network. This centralized model simplifies administration, enhances security by consolidating user credential management, and provides a single point for logging and auditing access attempts. A common example is a **RADIUS Server** used to manage access to corporate wireless networks. - **Role as an Identity Provider (IdP) in Modern Web Services:** In modern web and cloud architectures, the **Authentication Server** often functions as an **Identity Provider (IdP)**. This role is central to implementing federated identity and Single Sign-On (SSO) systems, which allow users to access multiple independent applications with a single set of credentials. Instead of each application managing its own user database, they delegate the authentication process to a trusted, centralized **IdP**. This approach enhances user experience and security, as users have fewer passwords to remember and the risk of password compromise is reduced. ***Key Concepts:*** * **Protocols**: Standard protocols like Security Assertion Markup Language (SAML), OAuth 2.0, and OpenID Connect (OIDC) define the communication flow between the application (Service Provider or Relying Party) and the **Identity Provider**. * **Trust Relationship**: The application establishes a trust relationship with the **IdP**. When a user tries to log in, the application redirects them to the **IdP**. * **Authentication and Assertion**: The user authenticates directly with the **IdP**. Upon success, the **IdP** sends a secure assertion (e.g., a SAML assertion or an ID Token) back to the application, confirming the user's identity. For example, when you use a "Log in with Google" or "Sign in with Microsoft" button on a third-party website, Google's or Microsoft's **Authentication Server** is acting as the **IdP**. ## Etymology The term combines 'Authentication', from the Greek 'authentikos' meaning 'genuine', with 'Server', from the Latin 'servire' meaning 'to serve'. It literally means a server that verifies genuineness. ## First used 1980s ## Historical context The concept of authentication has existed since the early days of computing, initially through simple password files on individual machines, like `/etc/passwd` on Unix systems. The need for centralized authentication grew with the rise of computer networks in the 1980s. MIT's Project Athena developed Kerberos, a foundational example of a network **Authentication Server**. Kerberos introduced the concept of tickets to grant access, which prevented the need to send passwords over the network for every request. During the dial-up internet era of the 1990s, RADIUS (Remote Authentication Dial-In User Service) became a de facto standard. Internet Service Providers used a **RADIUS Server** as an **Access Control Server (ACS)** to authenticate users connecting to their networks. With the explosion of the web in the 2000s and beyond, the role of the **Authentication Server** evolved into that of an **Identity Provider (IdP)**. Protocols like SAML, OAuth, and OpenID Connect emerged to facilitate federated identity and Single Sign-On (SSO), allowing users to log in to multiple applications and services using a single set of credentials managed by a central authority. ## Q&A - **What is the primary function of an Authentication Server?:** The primary function is to verify, or authenticate, the identity of a client (user, device, or application) requesting access to a protected resource. It accomplishes this by validating the credentials provided by the client against a secure database of authorized identities. Upon successful authentication, it often issues a token or ticket that the client can use to access other resources without re-entering credentials. - **How is an Authentication Server different from an Authorization Server?:** Authentication and Authorization are distinct but related concepts. An **Authentication Server** answers the question, "Who are you?" by verifying your identity. In contrast, an **Authorization Server** answers the question, "What are you allowed to do?" by determining the specific permissions and access rights an already authenticated user has for a particular resource. In many modern systems like OAuth 2.0, these roles are separated, though they can sometimes be handled by the same service. ## Usage examples - To log into the corporate Wi-Fi, my laptop had to communicate with the company's **Authentication Server** to verify my credentials. - The single sign-on (SSO) solution relies on a centralized **Authentication Server**, which acts as the **Identity Provider (IdP)** for all connected applications. - When the user entered their password, the request was sent to the **Authentication Server**, which confirmed their identity and issued an access token. - Our network security was significantly improved by implementing a dedicated **Access Control Server (ACS)** to manage all VPN connections. ## Related terms - Authorization - Single Sign-On (SSO) - Identity and Access Management (IAM) - Multi-Factor Authentication (MFA) - OAuth 2.0 - OpenID Connect (OIDC) - SAML - RADIUS - Kerberos ## Popular related terms - Authorization - Single Sign-On (SSO) - Multi-Factor Authentication (MFA) - Identity Provider (IdP)