Authentication vs authorisation

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which one describes authentication?

A Deciding which files you are allowed to open

B Checking who you are, such as logging in with a username and password

2. Which one describes authorisation?

A Deciding what an identified user is allowed to do

B Checking that a user really is who they say they are

3. Which step always comes first?

A Authorisation, then authentication

B Authentication, then authorisation

4. Mia types her username and password to get into the school network. What is this?

A Authentication

B Authorisation

5. Mia is logged in, but she gets the message 'Access denied' when she tries to open the teachers' marks folder. What is this?

A Authorisation

B Authentication

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1login(username, password)		Aif login_ok: check_permissions()
2if role == "teacher": open(marks)		BLogging in is authentication, not authorisation. It proves who you are and does not decide what you can do.
3Authentication always comes first, then authorisation		CAuthorisation: the system decides what you can open
4A student account and a teacher account are both authenticated but have different authorisation		DThe order is wrong. Authorisation is checked before the user has been authenticated.
5Logging in with a password = authorisation		EAuthentication: the system checks who you are
6if can_open(file): login(user)		Fstudent: read only \| teacher: read, write

Definitions

Authentication vs authorisation

Fill in the Blanks

Complete each line of code by filling in the missing parts.

step1 ← ______________ step2 ← authorisation

step1 ← authentication step2 ← _____________

IF account = "teacher" THEN allow ← true ____ allow ← false

authentication ← step _ authorisation ← step 2

user ← _____(name, password) IF user.role = "teacher" THEN open(file)

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A user ← 'student1'

B ok ← canOpen(user, pw)

C IF ok THEN

D show('Welcome')

E END IF

Question 2

A user ← login(name, pw)

B IF user ≠ NULL THEN

C show('Login failed')

D STOP

Question 3

A user ← login(name, pw)

B IF user = NULL THEN STOP

C role ← getRole(user)

D IF role = 'student' THEN

E open('marks.xlsx')

Question 4

A authorise(user, pw)

B authorise(user, 'marks.xlsx')

C open('marks.xlsx')

Question 5

A account ← 'teacher'

B canEdit ← FALSE

C IF account = 'teacher' THEN

D canEdit ← TRUE

Answer Key

Authentication vs authorisation

Section A: Quick Questions

B — Checking who you are, such as logging in with a username and password

A — Deciding what an identified user is allowed to do

B — Authentication, then authorisation

A — Authentication

A — Authorisation

Section B: Match the Pairs

if role == "teacher": open(marks) → Authorisation: the system decides what you can open

Authentication always comes first, then authorisation → if login_ok: check_permissions()

A student account and a teacher account are both authenticated but have different authorisation → student: read only | teacher: read, write

Logging in with a password = authorisation → Logging in is authentication, not authorisation. It proves who you are and does not decide what you can do.

if can_open(file): login(user) → The order is wrong. Authorisation is checked before the user has been authenticated.

Section C: Definitions

Authentication vs authorisation — Authentication checks who you are, like logging in. Authorisation decides what you can do once you are known, like which files you can open. Authentication always comes first.

Section D: Fill in the Blanks

step1 ← authentication
step2 ← authorisation

step1 ← authentication
step2 ← authorisation

IF account = "teacher" THEN
  allow ← true
ELSE allow ← false

authentication ← step 1
authorisation ← step 2

user ← login(name, password)
IF user.role = "teacher" THEN open(file)

Section E: Spot the Error

B — Logging in is authentication, which checks who you are using a password. canOpen is an authorisation idea (what you can do). Line 2 should be ok ← checkPassword(user, pw).

B — The login failed message should show when authentication fails, meaning user is NULL. With ≠ it would show for people who logged in correctly. Line 2 should be IF user = NULL THEN.

D — Authorisation decides what each account may do. A student account should not open the teacher's marks file. Line 4 should check that role = 'teacher'.

A — Authentication always comes first and checks identity using a password. Authorisation is for checking file access. Line 1 should be authenticate(user, pw).

A — The program is about a student account, which is not authorised to edit. Setting the account to 'teacher' wrongly gives it editing rights. Line 1 should be account ← 'student'.