What is authentication vs authorization?

Question

Accepted Answer

**Authentication** — who are you? **Authorization** — what can you do?

**Authentication:**
```csharp
// Program.cs
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = builder.Configuration["Jwt:Issuer"],
            ValidAudience = builder.Configuration["Jwt:Audience"],
            IssuerSigningKey = new SymmetricSecurityKey(key)
        };
    });

app.UseAuthentication();
```

**Authorization:**
```csharp
// Policy-based
builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("AdminOnly", policy =>
        policy.RequireRole("Admin"));

options.AddPolicy("MinimumAge", policy =>
        policy.Requirements.Add(new MinimumAgeRequirement(18)));
});

// Usage
[Authorize(Policy = "AdminOnly")]
public IActionResult AdminDashboard() { }

[Authorize(Roles = "Admin,Manager")]
public IActionResult ManageUsers() { }
```

**Order:**
1. Authentication (identify user).
2. Authorization (check permissions).

C#: What is authentication vs authorization?