Who are you, and what may you do?

Classroom resources

Load these into Waypoints Prepare: choose Load URL and paste the copied address, or download the file and import it. In Prepare, the worksheet's Teacher edition shows the answers; the student copy hides them.

• Slides Download Copy address for Prepare Present from the browser, or export to PowerPoint or PDF.
• Worksheet Download Copy address for Prepare Print the student copy; the Teacher edition has the answers.

Students will be able to

• I can explain the difference between authentication and authorisation.
• I can explain why multi-factor sign-in is safer.
• I can set permissions so each role has only what it needs.

Timing

Predict and Try 6 min · Worked example 10 min · Vary 12 min · Practise and Make 12 min

Before class

Try the board yourself. The practice accounts are on the board (Sam: maple, Ms Lee: orbit, Admin: quartz-river-71; MFA code 4096); they are made up and only work here.

The one idea (the kit's typical width): authentication proves identity, authorisation decides actions; both are needed on a shared system. Least privilege limits the damage from a stolen or misused account.

Real-world link: the school's own systems (who can see what in the learning management system); avoid showing real accounts.

Running the lesson

1. Predict: students who chose "it works" hold Sam's misconception.
2. Try: ask what was checked first, and what second.
3. Worked example: map each line to authentication or authorisation.
4. Vary: ask what an attacker would need with MFA on.
5. Make: ask why admins don't get to change marks.

The hard part (on purpose)

Students treat "signed in" as "allowed". Keep asking two questions in order: who are you? what may you do?

When students get stuck

Answers to the checks

1. signed in, but…: Sam the student signs in with the right password, then tries to change the class marks. What happens?
   Denied. The password proved it is Sam (authentication); the permissions say students may only read Marks (authorisation).
2. Try: sign in and try: Sign in as Sam (password maple) and try to change Marks. Then read Marks.
   
   Sam is signed in (authenticated) but may only read Marks (authorised to read, not change).
3. One request, two checks: Which is **authentication**?
   Typing your password to prove who you are
   Authentication answers "who are you?"; authorisation answers "what may you do?"
4. Find the mistake: Sam explains what signing in allows. Click the line where it first goes wrong.
   line 3
   Line 3: signing in only proves who Sam is. What Sam may do is a separate check, the permissions for students.
5. Why multi-factor?: Why add a code from a phone (multi-factor sign-in)?
   A stolen password alone is no longer enough to get in
   An attacker would need your password and your phone.
6. A teacher: Sign in as Ms Lee (password orbit) and change Marks.
   
   Teachers may change Marks: same action, different person, different permission.
7. Wrong password: Sign out, then try to sign in as Ms Lee with a wrong password, and change Marks.
   
   Without signing in, the system doesn't know who you are, so it allows nothing.
8. Multi-factor: Turn on multi-factor sign-in and sign in as Ms Lee with her password and the code 4096.
   
   Password and code: two factors. A stolen password alone would fail now.
9. The admin role: Admins can change Settings but only read Marks. Why not let admins change everything?
   Their job doesn't need it, and a stolen admin account could do less damage
   Least privilege: if an account is misused or stolen, it can only do what that role needs.
10. Sort them: Authentication (who are you?) or authorisation (what may you do?)
    Typing a password → Authentication; A fingerprint unlock → Authentication; A code from an app on your phone → Authentication; Students may read but not change Marks → Authorisation; Only the class teacher can open the gradebook → Authorisation; A shared folder set to view only → Authorisation
    Proving identity is authentication; rules about actions are authorisation.
11. Strong passwords: Which password is strongest?
    purple-otter-sings-at-dawn
    Length beats tricks: a long passphrase of unrelated words is hard to guess and easy to remember.
12. Review: DNS: Review: what does DNS do?
    Turns a name into an IP address
    It is the internet's address book.
13. least privilege: This table gives everyone too much. Click cells to set least privilege: students change Homework, read Marks, nothing in Settings; teachers change Homework and Marks, nothing in Settings; admins read Homework and Marks, change Settings.
    
    Every role can do its job and nothing more, so a stolen account can do the least harm.

Solutions

One possible solution for each task. Other correct programs are fine.

Vary: one change at a time › A teacher

Open task: any program that does what the step asks.

Vary: one change at a time › Wrong password

Open task: any program that does what the step asks.

Vary: one change at a time › Multi-factor

Open task: any program that does what the step asks.

Vary: one change at a time › The admin role

Open task: any program that does what the step asks.

least privilege

Open task: any program that does what the step asks.

Stretch and support

Stretch: Some systems use roles (teacher, student) and some give permissions to each person. What are the trade-offs for a school?

Support: Two questions on the board: Who are you? (authentication) What may you do? (authorisation).

Exit ticket

Give one example of authentication and one of authorisation. Why use multi-factor sign-in?

Authentication: a password or fingerprint. Authorisation: students may only read marks. MFA means a stolen password alone isn't enough.

What each step is for

• signed in, but…: Committing to whether a signed-in student can change marks tests the new move: authentication and authorisation are separate checks.
• Try: sign in and try: Signing in as Sam and trying to change Marks settles the prediction: signed in, yet denied.
• Worked example: two checks: Following one request through both checks models the new move, plus why least privilege matters. Sam treats signing in as permission to do anything, the misconception planted after the method.
• Vary: one change at a time: Each task changes one thing: a different user, a wrong password, multi-factor sign-in, then the admin's role.
• access control: Sorting examples into authentication and authorisation, judging passwords and permissions, and a review of DNS.
• least privilege: Fixing a permissions table so every role has exactly what its job needs reverses the process: students start from the jobs and set the permissions.

Where it leads

Next: Hashes and keys (how passwords are stored and secrets shared).

Links: Secret messages' challenge and response is another way to prove who you are.