Multi-factor authentication (also sometimes called two-step authentication) refers to the ability to include factors other than passwords in the identity proofing process during authentication. There are two major categories of factors: browser- or device-based; and IDP-based. Browser, or device-based factors are integrated with the login page and all proofing occurs in the user-agent integration with the device. The FIDO specification provide standards for this type of MFA integrations. Examples include fingerprint readers or facial recognition software using the device camera. IDP-based factors are integrated with the identity provider service. There are not currently any widely used standards. Examples include TOPT, HOTP, Push notifications, SMS OTP, email OTP, and telephone-base OTP. Multi-factor authentication does not require a set number of factors, a single factor may be adequate or multiple factors may be required. Passwordless login is where none of the factors are password-based and may only include one factor.
Authentication is the process of mapping a person, process, or machine to a digital identity. The mapping process is called proofing. Proofing may involve something the identity possesses (e. g., a security key, a physical key), something it knows (e. g., a password), or something it is (e. g., a fingerprint, facial recognition).
Authorization is the process of granting or denying access to resources by identities.
Single Sign is the ability for user to only log in once per user agent for a set period of time - typically an hour. (What is the SSO timeout currently set to on our systems?). That means once a user logs in to one application they don't have to re-enter their credentials for other applications.
Single sign-on means the user only has to log in once even if they are accessing multiple applications. Same sign-on means the user uses the same credentials to log into each application.
Access governance is the process of establishing, monitoring and auditing who within your organization has access to what, when and how. Access governance tools provide tools and processes to provide:
- Birthright access
- Access request flows
- Access recertification process
- Access expiration
- Access auditing
A token is an identity provider generated digital representation of an identity that has completed the authentication process.