Many applications need the same two checks: who is asking, and what that person may open. An authentication and authorization infrastructure is the shared set of services that performs those checks, so each application does not build and store them on its own.
What the Shared Services Check
The first check confirms identity. The second check reads a policy and allows or refuses the requested action. Both checks are called by the application, and the answers come back from the shared services.
- Identity. A password, a key, or a second factor is tested, and a successful test names the person or the service account.
- Permission. A policy says which records, screens, or actions that identity may use.
- One place to change. Revoking a password or a permission updates every application that calls the shared services.
Shared Checks and Local Checks
| Compared | Shared Services | Checks Inside One Application |
| Where the rules live | In a service that many applications call | In that application’s own store |
| A password change | One change covers every application that calls the service | Each application must be updated on its own |
| A refused action | The shared policy refuses it, and the application obeys the answer | Only that application’s own rules can refuse it |