Authentication
Ayrıca şöyle anılır authn, login, proving possession
Authentication answers one question: does this person possess the thing they said they possess. It does not answer who they are, and it does not answer what they may do.
Three words that get used interchangeably and should not
Identification is establishing who someone is, usually once, at enrolment. Authentication is proving on each return that you are the same party. Authorization is deciding what that party may do. A system can authenticate perfectly and have no idea who the person is, which is exactly what a pseudonymous account is.
Why strength is a separate axis from identity
You can prove who someone is very thoroughly at enrolment and then let them back in with a weak password, or barely check them at enrolment and require a hardware key every time. NIST's scales split these deliberately, and conflating them produces requirements that are expensive in the wrong place.
Where Solidus sits
Password, OAuth provider, and a DID challenge that proves control of a key. That last one is the interesting mechanism, because it authenticates against something the user holds rather than something a server stores. None of the three is phishing-resistant in the way origin-bound platform authenticators are.
Nereden geliyor
Bunu başkası belirtti. Solidus bir araya getiriyor.
A general concept rather than anyone's specification, given precise scales by NIST SP 800-63B and eIDAS. Solidus implements several authentication mechanisms and invented none of them.
Bunu nasıl doğrularsınız
Bugün üretimde çalışıyor.
The mechanisms are readable in the auth backend: password login, OAuth callbacks, and the DID challenge flow. What is absent is equally checkable, since no WebAuthn or platform-authenticator path exists anywhere in the codebase.