What Exactly is "Authentication": From the Limits of Passwords to FIDO2, Passkeys, and IdP Architecture

Introduction Recently, while reading protocol specifications (RFCs) like OAuth 2.0 or OpenID Connect (OIDC), have you ever stumbled upon a fundamental question? "By the way, what exactly is happening behind the scenes during 'Authentication'?" We normally click the "Login" button and access SaaS or internal systems without a second thought. However, behind the scenes, an epic technical relay is taking place—starting from the user's fingertips (physical device), diving deep into the enterprise directory (database), and flying between applications as tokens. In this article, we won't just explain protocols. We will unravel the entire picture in 4 steps, from "how to verify the identity of the person (the starting point)" to "how to convey that result to the system (the federation)" . By reading from top to bottom, the long-standing haze of "why are these technologies being used now?" should completely clear up. 1. The Authentication Revolution "How do we confirm that the person on the ot