What is the difference between 'authentication' and 'authorization' in the context of GitHub access control?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Auth-N vs auth-Z: authentication is your driver's license — proving who you are. Authorization is the club bouncer checking if you're on the VIP list for this particular room. In GitHub, SAML/SSO handles auth-N; repository permissions handle auth-Z.
Full explanation below image
Full Explanation
Authentication and authorization are two distinct security concepts critical to GitHub's access control model: (1) Authentication (AuthN) — Verifies the identity of a user. GitHub authentication methods include: username/password, two-factor authentication (2FA), SSH keys, SAML SSO, OIDC. When GitHub asks 'who are you?', authentication provides the answer. (2) Authorization (AuthZ) — Determines what an authenticated user is allowed to do. GitHub authorization is implemented through: repository permission levels (read, triage, write, maintain, admin), organization roles (member, owner, billing manager), team permissions, enterprise policies, IP allow lists, branch protection rules. Both are required for secure access — authentication without proper authorization means anyone can do anything once logged in; authorization without authentication means permissions can't be enforced.