The furnace.auth vocabulary implements a pluggable authentication framework.

Usernames and passwords are verified using an authentication provider.
Authentication providers

Users have capabilities assigned to them.
Authentication capabilities

An authentication realm is a responder which manages access to protected resources.
Authentication realms

Actions contained inside an authentication realm can be protected by wrapping them with a responder.
Protected resources

Actions contained inside an authentication realm can access the currently logged-in user profile.
User profiles

Authentication realms can be adorned with additional functionality.
Optional authentication features

A concrete example.
Furnace authentication example