2.2. Identity Concepts

💡 First Principle: Identity concepts exist to answer two questions in sequence for every single access attempt — "who are you, really?" (authentication) and "what are you allowed to do?" (authorization) — and everything else in this section (identity providers, directories, federation) is really just infrastructure that makes answering those two questions possible at scale, across organizations, and without users re-typing passwords everywhere.

Why care: get authentication and authorization confused, and you'll misdiagnose real problems — a user who can log in but can't access a specific report has an authorization problem, not an authentication one, and the fix is completely different (adjust permissions, not reset a password). This distinction, more than any single product name, is what SC-900 tests most heavily in this section.

⚠️ Common Misconception: Assuming "identity" just means "username and password." Modern identity includes the directory that stores the identity object, the provider that issues proof of authentication, and the trust relationships (federation) that let that proof be accepted somewhere else entirely.