The Inbox of Doom
Carlos opened his laptop on his first day at MegaLogistics to find 47 access requests waiting. Warehouse staff needed shipping system access. Finance needed payroll. IT wanted server management rights. Every request was a manual task: find the user, find the resource, assign permissions. One by one.
"There's no authorization model," he said to his manager. "Every user is directly mapped to every resource they need. It's chaos."
"That's why we hired you," she replied.
Who Are You?
Carlos started with the basics. Every access request begins with identification — the user claims an identity. "When you type your username," he explained at the all-hands meeting, "you're telling the system who you are. The system doesn't know yet if you're really that person. It just records the claim."
Identification was simple: a username, an account ID, a device name. The system noted the claim without yet validating it.
Prove It
Authentication was the next step. "This is where we verify the claim," Carlos told the team. "A password proves you know a secret only the real user should know. A fingerprint proves your biometrics match. A one-time code from your phone proves you have a physical device."
He deployed RADIUS — a centralized Authentication, Authorization, and Accounting server. When warehouse staff logged into the VPN, the VPN concentrator passed their credentials to RADIUS. RADIUS checked the database. Approved. The concentrator then granted access.
But people weren't the only things that needed authentication. MegaLogistics had 300 remote scanners and printers — devices in warehouses across the country. "A printer can't type a password," Carlos noted. "But it can present a certificate."
He set up a Certificate Authority (CA) and generated signed digital certificates for every device. Each certificate — signed by the MegaLogistics CA — proved the device was company-owned. The VPN concentrator could now verify any device's certificate against the CA's signature automatically.
🔑 Authentication Methods
- Passwords / MFA — for human users
- Digital Certificates — for devices (systems can't type passwords)
- Certificate Authority (CA) — trusted entity that signs and manages certificates
- RADIUS — centralized AAA server that validates credentials
What Are You Allowed to Do?
Authentication confirmed identity. Now came authorization — determining what each authenticated user could actually access. Carlos stared at the old system: 800 users, hundreds of resources, each mapped directly. "If I change one resource's permissions," he muttered, "I need to update 300 users who access it."
He replaced it with an authorization model. Instead of User → Resource, he created groups: Warehouse, Finance, IT, HR. He assigned permissions to groups, not individuals. When a new warehouse employee joined, Carlos added them to the Warehouse group — instantly inheriting all the right permissions. One action. Done.
"This scales," he told his manager. "It doesn't matter if we have 800 users or 8,000."
🗂️ Authorization Models
- No model: User → Resource directly (doesn't scale, hard to audit)
- With model: User → Role/Group → Resource (scalable, clear, easy to manage)
- Role-Based (RBAC): permissions assigned to roles; users assigned to roles
- Attribute-Based: access based on user attributes, resource attributes, environment
Record Everything
The final layer was accounting — tracking what everyone did. RADIUS logged every login attempt: timestamp, username, session duration, data transferred, logout time. "If there's ever a security incident," Carlos explained, "we can trace exactly who accessed what and when."
Three months later, an inventory discrepancy triggered an investigation. Carlos pulled the RADIUS logs, found that a single account had accessed the inventory database at 3 AM from an unusual IP address, downloaded 5GB of records, and disconnected. The logs told the whole story. Accounting had done its job.