What is Authentication in Web Applications?
- Welcome to the Authentication & Identity Security series.
- This series is designed for Middleware, DevOps and Cloud Engineers.
- Learn how authentication works in enterprise applications, APIs, cloud platforms, and Docker environments.
- Includes real-world examples using LDAP, Active Directory, Azure Entra ID, WebSphere, and modern authentication technologies.
Table of Contents
Introduction
Authentication is the first layer of security in any enterprise application. Before a user can access an application, API, cloud portal the system must verify the user's identity.
Whether you are managing IBM WebSphere, JBoss EAP, Apache Tomcat, Azure, Docker, or API Gateways, authentication is a critical component of enterprise security architecture.
Authentication prevents unauthorized access to applications, APIs, cloud resources, and sensitive business data.
What is Authentication?
Authentication is the process of verifying the identity of a user, application, or system before granting access to resources.
Simply put:
Authentication answers the question: "Who are you?"
Applications typically validate user credentials against:
- LDAP
- Microsoft Active Directory
- Azure Entra ID
- Database
- Identity Providers
How Authentication Works
User │ ▼ Login Page │ ▼ Username & Password │ ▼ Application Server │ ▼ LDAP / AD / Azure Entra ID │ ▼ Identity Verification │ ▼ Session or Token Created │ ▼ Access Granted
Once authentication is successful, the application creates a session or issues a token to establish trust between the user and the application.
Authentication vs Authorization
| Authentication | Authorization |
|---|---|
| Verifies identity | Verifies permissions |
| Who are you? | What can you access? |
| Occurs first | Occurs after authentication |
| Login process | Access control process |
Enterprise Example
A user logs into the Azure Portal.
Authentication checks:
Is this user really Pradeep?
Authorization checks:
Can the user create Virtual Machines? Can the user modify NSGs? Can the user access Production Resources?
Enterprise Example: LDAP Authentication
Many traditional enterprise applications use LDAP or Active Directory for centralized authentication.
Architecture
User Browser
│
▼
IBM HTTP Server / NGINX
│
▼
WebSphere Application Server
│
▼
LDAP / Active Directory
Authentication Flow
- User accesses the application.
- User enters username and password.
- WebSphere receives the login request.
- WebSphere sends credentials to LDAP.
- LDAP validates the credentials.
- WebSphere creates a session.
- Browser receives a JSESSIONID cookie.
- User gains access to the application.
Real-World Example
Application: https://www.company.com LDAP Server: ldap://ldap.company.com:389 Successful Login Response: Set-Cookie: JSESSIONID=ABC123XYZ789
LDAP verifies whether the user exists and whether the supplied credentials are valid.
Enterprise Example: Azure Entra ID Authentication
Modern cloud-native applications use Azure Entra ID for centralized identity and access management.
Architecture
User │ ▼ Web Application │ ▼ Azure Entra ID │ ▼ MFA Verification │ ▼ JWT Token │ ▼ Application Access
Authentication Flow
- User opens the application.
- Application redirects the user to Azure Entra ID.
- User enters credentials.
- Multi-Factor Authentication is completed.
- Azure Entra ID validates the identity.
- JWT token is issued.
- User is redirected back to the application.
- Application validates the token and grants access.
Benefits
- Single Sign-On
- Multi-Factor Authentication
- Centralized Identity Management
- Conditional Access Policies
- Improved security posture
Traditional vs Modern Authentication
| Traditional Authentication | Modern Authentication |
|---|---|
| LDAP | Azure Entra ID |
| Active Directory | Identity Provider |
| Session-Based | Token-Based |
| JSESSIONID | JWT |
| Stateful | Stateless |
| WebSphere / JBoss / Tomcat | Cloud & Microservices |
| On-Premises | Hybrid & Cloud |
Why Authentication Matters
Authentication protects critical enterprise systems and reduces the risk of unauthorized access.
- Enterprise applications
- APIs
- Customer data
- Cloud resources
- Docker
- Administrative portals
Common authentication-related issues handled by Middleware and DevOps teams include:
- LDAP connectivity failures
- Active Directory integration issues
- Login failures
- Session timeout problems
- SSO redirection loops
- Expired JWT tokens
- OAuth2 configuration issues
- Azure Entra ID authentication failures
- Load balancer session affinity issues
Key Takeaways
- Authentication verifies identity before access is granted.
- Authorization determines what an authenticated user can access.
- Traditional enterprise applications commonly use LDAP, Active Directory, sessions, and cookies.
- Modern applications use Azure Entra ID, JWT tokens, OAuth2, OIDC, and MFA.
- Authentication is the first layer of security for applications, APIs, and cloud platforms.
- Understanding authentication is essential for Middleware, DevOps, Cloud, and Security Engineers.
What’s Next?
Part 2 – Sessions, Cookies & JSESSIONID Explained
In the next article, we will understand how applications maintain user identity after successful authentication and how session management works in WebSphere, JBoss, Tomcat, and modern web applications.
Series: Authentication & Identity Security for Middleware, DevOps & Cloud Engineers
Author: Pradeep V
Blog:
MiddlewareBox.com
