Authentication and Authorization

Two distinct things, often confused:

• Authentication (authn) — proves who the actor is. The output is an identity (a user, a service, an agent).
• Authorization (authz) — decides what that identity is allowed to do. The output is a permit/deny on a specific action against a specific resource.

You can have great authn and zero authz and still leak the entire database. Most real-world breaches in academic systems are authz failures — IDOR-style "I logged in as student A and changed the URL to student B's ID" — not authn failures. Plan and review accordingly.

Authentication

Use the institutional SSO. Do not roll your own.

For any institution-facing application, identity comes from the institutional identity provider (IdP) — typically a SAML or OIDC integration with the central SSO. Your application should be a Service Provider / Relying Party, not an identity store.

Why: the IdP enforces password policy, MFA, account lifecycle (offboarding when someone leaves), suspicious-activity detection, and shared compromise response. Reimplementing any of that in your app means re-implementing all of it, badly.

Practical guidance — default to OAuth 2.1 (consolidates OAuth 2.0 + best-current-practice; PKCE required for all clients including confidential; implicit and ROPC removed):