Once the distinction between what the user is/is not and what the user may/may not do is clarified, it becomes apparent that the authentication of what the user is/is not (the claims) are often better handled by a third party than by any individual application.
Continuing the analogy, the nightclub may have a membership system, and certain members may be regular or VIP.