What is the difference between authentication and authorization?

Authentication confirms the identity of the user ("Who are you?"). Authorization determines what the user can do ("What are you allowed to do?").

• Authentication: The process of establishing and confirming the user's identity. Usually involves entering a login and password, using certificates, biometrics, etc.
• Authorization: The process of defining the user's access rights to resources (files, data, functions, etc.) after their identity has been confirmed.

// Example: Login (authentication)
public boolean authenticate(String username, String password) {
    // Check credentials in the database
    // ...
    return true; // or false
}

// Example: Access check (authorization)
public boolean authorizeAccess(User user, Resource resource) {
    // Check user's roles and permissions for the resource
    // ...
    return user.hasPermission(resource, "read"); // or false
}