authentication-pattern

name	authentication-pattern
description	Security pattern for implementing authentication in software systems. Use when designing or reviewing authentication mechanisms, implementing login systems, verifying user identity, protecting system access, or addressing OWASP authentication flaws. Provides guidance on enforcers, verifiers, evidence providers, subject registration, credential management, and security considerations.

Authentication Security Pattern

Authentication verifies that a subject (user, service, device) is who they claim to be before allowing system access. This pattern is a prerequisite for authorization and auditing.

When to Use

Use this pattern when:

• Designing a new login or identity verification system
• Reviewing existing authentication mechanisms for flaws
• Integrating with external identity providers (OAuth, SAML)
• Implementing API authentication (keys, tokens)
• Establishing audit trails for user actions

Core Components

Roles

Role	Type	Responsibility
Subject	Entity	Requests actions from the system
Enforcer	Enforcement Point	Intercepts requests; ensures authentication before processing. Must be incorporated into the system
Verifier	Decision Point	Validates credentials against evidence to determine authentication success
Evidence Provider	Entity	Stores/provides evidence for credential verification (internal or external)

Data Elements

• credential: Proof of identity provided by Subject