What is the difference between authentication and authorization?

Short answer

Authentication answers the question "who are you?": the user is verified to be the person they claim to be with a proof such as a password, a certificate or a second factor. Authorization answers the question "what can you do?": it is determined which screens, objects and operations the authenticated user will access. Authentication is applied first, and authorization after it. For TR7 management users, where the identity is verified is determined by the Authorization Source field (Local, LDAP, Radius, TACACS) in the Device Users form, and the scope of access by User Type. Although the field is named "Authorization source", what it selects is the source where the identity is verified; even if the user is verified with LDAP, RADIUS or TACACS+, the user's permissions come from the User type in TR7.

Where It Is Used in TR7

Where	Field / label	What for
Settings → User Management → Device Users	Authorization Source: Local, LDAP, Radius, TACACS	Authentication: whether the management user's password is verified on TR7 or on an external server
Settings → User Management → Device Users	Client Certificate Authentication	Authentication: login to the management interface with a client certificate (mTLS)
Settings → Device Management → Management Access	Two-factor Authentication (2FA)	Authentication: a verification code in addition to the password at management interface login
Settings → User Management → Device Users	User Type and the User vServices, Backend Service Permission, Certificate Management, Certificate Selection fields that open according to its role	Authorization: the user's role and the objects the role covers
AGS → Authentication	Authentication Providers, Authentication Servers, Local Databases, Multi-Factor Authentication (MFA)	Authentication: users who enter the application behind the AGS-enabled vService
AGS-enabled vService → Flowchart	Decision Point, Switch, Allow, Deny	Authorization: granting or denying the authenticated user's access based on a condition
Load Balancer → Actions / Conditions	The User Authentication (On HTTP request) action and the User Authentication condition	Authentication: requesting a username and password from the browser in the HTTP request coming to the vService

Comparison

	Authentication	Authorization
Question	Who are you?	What can you do?
Input	Password, certificate, OTP	Role, group, rule
Order	First	After
For a TR7 management user	Authorization source, Client Certificate Authentication, 2FA	User type and scope fields
In AGS	Authentication Provider and MFA steps	Decision point / Switch steps, Allow and Deny endings

Common Misconceptions

• "Authorization source determines the user's permissions." The field selects only where the password is verified; permissions come from User Type. Authorization Source cannot be changed after the user is created.
• "The permissions of a user who logs in with LDAP, RADIUS or TACACS+ also come from that server." The external server verifies only the password; the role is the User type in the user record on TR7. Users created automatically at first login are assigned Default User Type to Create; its default value is Read-only User.
• "Someone whose password is correct can do everything." Authentication proves only the identity; the user does not see the menus outside the user's role and cannot perform the operations outside it.

How it is done in the documentation

• Device Users · The Authorization and Access Model
• Device Users · Authorization Source
• Device Users · User Types
• AGS · Authentication Options

Related questions

• What is RBAC (Role-Based Access Control); how is it applied in TR7?
• What is AAA (Authentication, Authorization, Accounting); what is an accounting record for?
• What is the difference between MFA and 2FA?
• Can I define users who only have monitoring rights, or who can manage only specific vServices?