An authentication and authorization method and system are provided. The method includes: receiving an authentication request transmitted from a first device; transmitting the authentication request to an authentication and authorization server subsystem; authenticating the authentication request and generating authentication information; generating an authorization request used to request a second device for authorization according to the authentication information; and authenticating the authorization request, generating an authorization information and transmitting the authorization information to the first device through an authentication and authorization client subsystem so that the first device communicates with the second device directly according to the authorization information.