How does Django's authentication system work, and what is the difference between authentication and authorisation?

Authentication establishes who you are; authorisation decides what you may do. Django provides both.

Authentication: authenticate() runs the configured backends and returns a user or None. login() puts the user's id in the session. AuthenticationMiddleware then attaches request.user on every subsequent request, falling back to AnonymousUser. Passwords are stored using PBKDF2 by default, salted and iterated, and the hasher is upgraded transparently on the next successful login.

Authorisation:

• Permissions — Django creates add, change, delete, and view permissions per model automatically. Check them with user.has_perm('app.change_order').
• Groups — named collections of permissions, so you assign a role rather than individual rights.
• Enforcement — the @login_required and @permission_required decorators, or LoginRequiredMixin and PermissionRequiredMixin on class-based views.

Note: Django's model-level permissions do not cover object-level rules such as "only the author may edit this post". Say that you would implement that in the view or with a package like django-guardian — knowing the limitation matters more than knowing the API.