# Authentication and authorization

Nais helps your applications [log in users](#logging-in-users), [validate inbound requests](#validating-inbound-requests) and [make authenticated outbound requests](#making-outbound-requests) using the following identity providers:

- [**Entra ID**](/auth/entra-id.md) (aka Azure AD)

  For employees and internal services.
- [**ID-porten**](/auth/idporten.md)

  For Norwegian citizens.
- [**TokenX**](/auth/tokenx.md)

  For internal applications acting on-behalf-of ID-porten citizens.
- [**Maskinporten**](/auth/maskinporten.md)

  For machine-to-machine communication between organizations or businesses.

Your application may have multiple use cases that can require a combination of services.

📚 To learn more about authentication and authorization in general, see [the explanations page](/auth/explanations.md).
If you just want to get started, continue reading below.

See the different scenarios below to identify which service(s) you need for your application, and follow the links to the respective service for more details.

## Logging in users

Depending on who your users are, you can use the following services to log them in:

🧍 Log in *employees* :octicons-arrow-right-24: [Entra ID](/auth/entra-id.md)

🧍 Log in *citizens* :octicons-arrow-right-24: [ID-porten](/auth/idporten.md)

## Validating inbound requests

...from applications acting

```mermaid
graph TD
  B1[on-behalf-of]
  B2[as themselves]

  B1 --> |citizens| TokenX[<a href='tokenx'>TokenX</>]
  B1 --> |employees| AAD_machine[<a href='entra-id'>Entra ID</>]
    
  
  B2 --> |internally| AAD_machine[<a href='entra-id'>Entra ID</>]
  B2 --> |externally| Maskinporten[<a href='maskinporten'>Maskinporten</a>]
```

The graph above can also be described as:

:material-server:🧍 Validate requests from *internal* application acting on behalf of *employee* :octicons-arrow-right-24: [Entra ID](/auth/entra-id.md)

:material-server:🧍 Validate requests from *internal* application acting on behalf of *citizen*:octicons-arrow-right-24: [TokenX](/auth/tokenx.md)

:material-server: Validate requests from *internal* application :octicons-arrow-right-24: [Entra ID](/auth/entra-id.md)

:material-server: Validate requests from *external* application :octicons-arrow-right-24: [Maskinporten](/auth/maskinporten.md)

## Making outbound requests

```mermaid
graph TD
  B1[on-behalf-of]
  B2[as application]

  B1 --> |citizens| TokenX[<a href='tokenx'>TokenX</>]
  B1 --> |employees| AAD_machine[<a href='entra-id'>Entra ID</>]
  
  B2 --> |internally| AAD_machine[<a href='entra-id'>Entra ID</>]
  B2 --> |externally| Maskinporten[<a href='maskinporten'>Maskinporten</a>]
```

The graph above can also be described as:

:material-server:🧍 Make requests to *internal* API on behalf of *employee* :octicons-arrow-right-24: [Entra ID](/auth/entra-id.md)

:material-server:🧍 Make requests to *internal* API on behalf of *citizen* :octicons-arrow-right-24: [TokenX](/auth/tokenx.md)

:material-server: Make requests to *internal* API :octicons-arrow-right-24: [Entra ID](/auth/entra-id.md)

:material-server: Make requests to *external* API :octicons-arrow-right-24: [Maskinporten](/auth/maskinporten.md)