One important thing most of the consultants forget to talk during the requirement gathering stage is about the authentication and authorization.
Authentication is nothing but knowing if the user is the right and authenticated user. It is like asking the question Who are you? Someone should authenticate if the user is correct user. There are many systems available to do this job, where they save the passcode of the user and then they crosscheck the passcode when authentication is requested, and if the passcode is right then it allows the user to enter the system.
Authorization comes into picture only after the user is authenticated. It is like giving permission to access the data. Not all the users should have access to all the data; giving right permission to the users is necessary to maintain the security of the data.
Let us have a look at thefollowing...