Auth & sessions

Two packages cover this ground: pkg/auth handles authentication (sessions, passwords, JWT, the backend chain) and pkg/authz handles authorization (role-based access control). This section splits them by the question you are actually asking:

• Your first login — the complete worked slice: a users table, a UserProvider, POST /login through the authentication chain, session, logout, CSRF. Start here if you are building sign-in for your own application.
• RBAC & the middleware chain — the default-deny policy gate, and why your first session-authenticated route answered 403. Read this one before adding more middleware.
• Sessions & passwords — session stores, cookie defaults, RenewToken/Destroy, bcrypt hashing.
• JWT — stateless auth, from a single secret to a rotating keyset with a public JWKS endpoint.
• Backends & federated sign-in — the ordered auth_backends chain, LDAP, writing your own backend, the conformance suite, and OIDC/SAML identity providers.

Which mechanism is which

You want	Use	Page
Sign in users of your app against your table	auth.UserProvider + the chain	Your first login
Sign in against a corporate directory	auth_backends: [ldap, local]	Backends
"Sign in with …" via an identity provider	auth_federated (OIDC/SAML)	Backends → Federated
Stateless tokens for APIs and services	JWTManager	JWT
Decide who may reach which route	pkg/authz policy gate	RBAC & middleware
Admin accounts for the orbit panel	nucleus createuser	orbit

Identity travels through the request context as auth.Claims (auth.ContextWithClaims to inject, auth.ClaimsFromContext to read); the RBAC gate, log attribution and your handlers all read the same claims.