Gary's Front Door.
Three factors. One golden ticket. Three ways to prove yourself at your mate's shop — a sealed letter, a plain wristband, and a wristband with your photo on it.
Gary upgrades his front door with a proper security system. Three ways to prove you're allowed in. Each one covers a different category of evidence.
First, a keypad — type a code to unlock. That's something you know: passwords, PINs, security questions. Weakest — someone can watch you type it, guess it, or brute force it.
Second, a key — a physical thing you carry. That's something you have: smart cards, TOTP phone apps, hardware tokens, SSH keys. Stronger — someone needs to steal the physical object.
Third, a fingerprint scanner. That's something you are: biometrics — fingerprints, Face ID, iris scans. Hardest to steal.
Gary's wife makes him use two of them — the key AND the keypad. That's MFA — Multi-Factor Authentication. Two different types. Two passwords is NOT MFA — that's two things you know. A key plus a keypad IS MFA — something you have plus something you know.
Gary's getting tired of unlocking every room separately. He goes to the ticket booth (Door 88 — Kerberos). Proves who he is once, gets a golden ticket. Now every door in the building opens without asking again.
That's SSO — Single Sign-On. Kerberos (port 88) is the golden ticket system Active Directory uses.
Gary's mate runs a shop on the next street. He trusts Gary's ticket booth, so he accepts Gary's golden ticket too — no need for a separate login.
That's federation — trusting another organisation's identity system.
Method 1: Gary's ticket booth writes a formal letter on thick paper, stamped with the official seal, and hands it to Gary. He walks to his mate's shop and presents it. The sealed letter is an XML assertion. That's SAML — a signed document passed between the identity provider and the service. Enterprise SSO lives here.
Method 2: Gary's mate doesn't need to know who Gary is — he just needs to know Gary is allowed to use the espresso machine. Gary's ticket booth gives him a plain wristband with "ESPRESSO: YES" printed on it. No name, no photo — just permission. That's OAuth — it grants authorisation (what you can access) without identity. "Let this app access my Google Drive" is OAuth.
Method 3: Same wristband, but this time it has Gary's photo laminated on it and the text "GARY, MANAGER, ESPRESSO: YES." Now his mate knows who Gary is AND what he's allowed to do. That's OIDC — OpenID Connect — OAuth with an ID token bolted on. "Sign in with Google" is OIDC.
Password plus PIN is not MFA — that's two things you know. Password plus TOTP app is MFA — that's something you know plus something you have. Two factors, two different types. Always. — Story 10 · Authentication & Identity