Authentication vs Authorization

Authentication	Authorization
"who are you"	"are you allowed to do that?"
Typically established during login	Users authentication
Used to determine authorization	set using "allow" rules' there are no "deny" rules
Can be external (LDAP)	attached to a user or group