The IAAA Flow
Identification → AAAIdentification
Claim identity (username)
→
Authentication
Prove identity (password, cert, MFA)
→
Authorization
What can you access?
→
Accounting
Log what you did
VPN Authentication Flow (with RADIUS)
Client
User on internet
→ sends credentials →
VPN Concentrator
Receives login request
→ passes to →
RADIUS Server
Validates credentials
→ approved →
File Server
User gains access
The VPN concentrator does NOT hold user credentials — it passes them to the RADIUS server for validation.
Authorization: No Model vs. With Model
| Aspect | No Authorization Model | With Authorization Model (RBAC) |
|---|---|---|
| Structure | User → Resource (direct) | User → Role/Group → Resource |
| Scalability | ❌ Poor — grows exponentially | ✅ Excellent — add user to role = done |
| Auditability | ❌ Hard to know why access exists | ✅ Clear — role defines all access |
| Adding a new user | Assign permissions individually to each resource | Assign to role — inherits all permissions |
| Changing a resource's permissions | Update every user individually | Update the role once |
Memory Aids
IAAA Order
ID first → Auth second → Authz third → Accounting last. Cannot authorize before authenticating. Cannot authenticate without identifying first.
Auth-n vs Auth-z
AuthentiCATION = verify identity (WHO are you?). AuthoriZATION = verify rights (WHAT can you do?).
Accounting ≠ Finance
In IT, Accounting = audit logging. Tracks login times, session duration, data volumes. Not financial accounting.