Authentication and access control in modern environments rely on a handful of well-established protocols. In Windows and Active Directory environments, Kerberos is the dominant authentication system. It is ticket-based and centered on a Key Distribution Center (KDC), which itself consists of an Authentication Server and a Ticket Granting Server. The three participants in any Kerberos exchange are the client, the application server, and the KDC. When a user authenticates, the KDC issues time-limited tickets—tokens that prove the client's identity—allowing access to services without re-sending credentials on each request. This ticket-based design avoids sending passwords over the network and supports mutual authentication between client and server.
For network access, two AAA protocols dominate. RADIUS (Remote Authentication Dial-In User Service) provides centralized authentication, authorization, and accounting, especially for VPNs, Wi-Fi, and dial-up. It runs over UDP and combines authentication and authorization while encrypting only the password. TACACS+ is a Cisco-developed AAA protocol that runs over TCP, separates authentication, authorization, and accounting, and encrypts the entire payload rather than just the password. Directory access uses a different tool: LDAP (Lightweight Directory Access Protocol), which queries and modifies directory services such as Active Directory. These protocols—Kerberos, RADIUS or TACACS+, and LDAP—form the practical foundation of identity in many enterprises.
Modern web applications rely on federated identity standards. SAML (Security Assertion Markup Language) is an XML-based standard for federated single sign-on (SSO), exchanging authentication and authorization data between identity providers and service providers. OAuth 2.0 is an authorization framework that allows third-party applications to obtain limited access to user resources without ever handling the user's credentials. OpenID Connect is an identity layer built on top of OAuth 2.0, providing authentication by issuing JSON Web Tokens that verify who the user actually is. Federation is the broader concept of trust established between two organizations' identity providers, allowing users from one to access resources in the other. Together with single sign-on—where one authentication grants access to many independent systems—these standards reduce password fatigue and centralize identity management.
To strengthen authentication beyond passwords, organizations adopt multi-factor authentication (MFA), which combines two or more independent factors. The five canonical factors are something you know (a password), something you have (a hardware token or phone), something you are (a biometric), something you do (behavioral patterns), and somewhere you are (geographic location). One-time passwords are a popular second factor. A TOTP (Time-based One-Time Password) generates a six- to eight-digit code from a shared secret and the current time, as specified in RFC 6238 and used by apps like Google Authenticator. An HMAC-based OTP (HOTP), defined in RFC 4226, generates codes from a counter value and shared secret and is often used in hardware tokens. Because each code is unique and short-lived, OTPs dramatically reduce the value of stolen passwords.