我发现这篇文章中的类比对我很有帮助。

Consider a person walking up to a locked door to provide care to a pet while the family is away on vacation. That person needs: Authentication is in the form of a key. The lock on the door only grants access to someone with the correct key in much the same way that a system only grants access to users who have the correct credentials. Authorization is in the form of permissions. Once inside, the person has the authorization to access the kitchen and open the cupboard that holds the pet food. The person may not have permission to go into the bedroom for a quick nap.

因此，简而言之，认证是关于用户身份的，而授权是关于用户权限的。

身份验证是验证您的登录用户名和密码的过程。

授权是验证您是否可以访问某些内容的过程。

正如身份验证vs授权所言:

Authentication is the mechanism whereby systems may securely identify their users. Authentication systems provide an answers to the questions: Who is the user? Is the user really who he/she represents himself to be? Authorization, by contrast, is the mechanism by which a system determines what level of access a particular authenticated user should have to secured resources controlled by the system. For example, a database management system might be designed so as to provide certain specified individuals with the ability to retrieve information from a database but not the ability to change data stored in the datbase, while giving other individuals the ability to change data. Authorization systems provide answers to the questions: Is user X authorized to access resource R? Is user X authorized to perform operation P? Is user X authorized to perform operation P on resource R?

参见:

Wikipedia上的身份验证与授权

认证是验证实体身份的过程。例如

Webserver每次都要求用户输入登录名/密码，以验证创建该帐户的用户是否是现在正在访问该帐户的用户。

授权是允许每个实体获得所需数量的服务/资源的过程。例如

On blogging site (eg. medium.com) users can create an account and write a post and publish. And users can read all posts published by others as well. Here the blogging server first authenticates the user with the user login credentials (login/password) and then it authorizes to read all others post and write/modify the post only created by the user. Here authorization is used by the server to limit which all post each user can modify. Users can create a free google account by which google server provides free services like mail, calendar, chat, drives etc. But the storage provided for all these services to free users are 15GB (as of now). User can pay a monthly or annual fee to google server to increase the storage space. Here google server authorizes every authenticated user to limit the amount of resource usage.

在当今的互联网中，授权被广泛用于对客户端施加访问限制。

身份验证是确定某人确实是他们所声称的那个人的过程。 授权是指决定谁可以做什么的规则。例如，亚当可能被授权创建和删除数据库， 而Usama只被授权阅读。

这两个概念是完全正交和独立的，但它们都是安全设计的核心，如果其中任何一个概念都不正确，就会导致妥协。

就web应用程序而言，简单地说，身份验证是指你检查登录凭证，看看你是否识别出用户已登录，而授权是指你在访问控制中查看是否允许用户查看、编辑、删除或创建内容。

补充@Kerrek的答案;

身份验证为通用形式(所有员工都可以登录机器)

授权是专用形式(但管理员只能在机器上安装/卸载应用程序)