Authentication is the process of verifying identity. This identity can be a user account used by a person, a host ID used by a machine, a server certificate used by a server software component, or a client certificate used by a client software component. Authentication is usually performed by proving the identity bearer has a secret that is known only to the bearer.
After an identity is authenticated, authorization is the process of determining who is allowed to do what. Authorization is accomplished by assigning privileges or roles to an identity that accesses system objects.
A privilege is an access right to one or more system objects. A role is a collection of privileges. A role can be assigned to one or more users. A user may have multiple roles. Unlike hierarchical users, a role does not contain another role.
Out of the box, the Symphony security model uses Symphony’s own user account database. A user account defined in the database includes a password to provide authentication, and assigned role, which provides authorization.
Symphony also provides a security plug in for sites that prefer to use a third-party security mechanism, such as Kerberos, LDAP, or ActiveDirectory, and so on.
User accounts are created and managed in EGO. EGO authorizes users from its user database.
Each consumer is associated with a list of user accounts that are allowed to access the consumer. Different user accounts can submit or control workload. However, each consumer is associated with only one user account for running workload—all workload that runs under one consumer runs under one operating system account.
Sometimes service instances require user-specific privileges to access certain resources. Sometimes due to a security policy at an organization, it is necessary to isolate the user under which a process runs. Symphony provides flexible ways to configure the user account under which workload runs, allowing you to isolate users and applications.
Impersonation means that the system runs executables under a designated operating system account.