I use Identify (who claims is coming, it may be used to decide how to authenticate them), Authenticate (make sure that the above matches the user on file) and Authorize (provide to the application a set of stored permissions for the user)