What is identification, authentication, and authorization? What should come first?

Identification, authentication, and authorization are three sequential access control steps:

1. Identification — the process of determining who is trying to gain access. Usually, this involves entering a username, login, or another unique identifier.

2. Authentication — verifying the claimed identity. For example, checking a password, biometric data, or a token to ensure the user is who they claim to be.

3. Authorization — defining the rights and permissions of the authenticated user, i.e., what they are allowed to do in the system.

The order is always: first identification (who?), then authentication (prove you are), and only after successful authentication does authorization (what you are allowed) occur.

Example:

• The user enters a login (identification).
• The system checks the password (authentication).
• If the password is correct, the system checks what actions are permitted for this user (authorization).