Upgrade to Pro — share decks privately, control downloads, hide ads and more …

なんとなくわかるSAML / Somewhat understandable SAML

なんとなくわかるSAML / Somewhat understandable SAML

2021年11月27日に開催したNuCon 2021の発表資料です。

アーカイブ動画「NuCon 2021」
https://youtu.be/ITh1MMp6OLk

株式会社ヌーラボ

November 27, 2021
Tweet

More Decks by 株式会社ヌーラボ

Other Decks in Technology

Transcript

  1. Copyright Nulab Inc. All Rights Reserved. 4".- 4".-ͱ͸ ɾҟͳΔΠϯλʔωοτυϝΠϯؒͰϢʔβʔೝূΛߦ͏ͨΊͷ ɹ9.-Λϕʔεʹͨ͠ඪ४ن֨

    ɹ೥ɿࡦఆ ɹ೥ɿόʔδϣϯ ɾೝূͱೝՄʹରԠ͢Δϓϩτίϧ ɾγϯάϧαΠϯΦϯʹΑ͘༻͍ΒΕΔ 4FDVSJUZ"TTFSUJPO.BSLVQ-BOHVBHF
  2. Copyright Nulab Inc. All Rights Reserved. 6TFS"HFOU *EFOUJUZ1SPWJEFS ɾར༻ऀ ɾϢʔβʔ͕࢖༻͢Δϒϥ΢βΛࢦ͢͜ͱ͕ଟ͍

    ొ৔ਓ෺͸ਓ ɾೝূ৘ใΛఏڙ͢Δଆ *E1  ɾ"[VSF"%΍0LUB౳ɺ*%Λ؅ཧ͢Δ΋ͷ ొ৔ਓ෺ʛ*EFOUJUZ1SPWJEFS
  3. Copyright Nulab Inc. All Rights Reserved. 6TFS"HFOU *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS ɾར༻ऀ

    ɾϢʔβʔ͕࢖༻͢Δϒϥ΢βΛࢦ͢͜ͱ͕ଟ͍ ొ৔ਓ෺͸ਓ ɾೝূ৘ใΛఏڙ͢Δଆ *E1  ɾ"[VSF"%΍0LUB౳ɺ*%Λ؅ཧ͢Δ΋ͷ ɾೝূ৘ใΛ࢖༻͢Δଆ 41  ɾओʹ4BB4 ొ৔ਓ෺ʛ4FSWJDF1SPWJEFS
  4. Copyright Nulab Inc. All Rights Reserved. ೝূͷྲྀΕ 6TFS"HFOU *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS

    ৴པؔ܎ ͓ޓ͍ͷ৘ใΛ ࣄલʹަ׵͓ͯ͘͠ ࣄલʹ৴པؔ܎ͷߏங͕ඞཁ
  5. Copyright Nulab Inc. All Rights Reserved. ೝূͷྲྀΕ 6TFS"HFOU *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS

    ৴པؔ܎ ϩάΠϯ 4".- 3FRVFTU ೝূ 4".- "TTFSUJPO 4".- "TTFSUJPO ݕূ     
  6. Copyright Nulab Inc. All Rights Reserved. ೝূͷྲྀΕ 6TFS"HFOU *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS

    ৴པؔ܎ ϩάΠϯ 4".- 3FRVFTU ೝূ 4".- "TTFSUJPO 4".- "TTFSUJPO ݕূ     
  7. Copyright Nulab Inc. All Rights Reserved. 4".-"TTFSUJPO *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS 4".-"TTFSUJPO

    /BNF*% ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ  4".-"TTFSUJPOʹ͸͜ͷΑ͏ͳ৘ใ͕ೖ͍ͬͯΔ ˞આ໌ͷͨΊ؆ུԽ͍ͯ͠·͢
  8. Copyright Nulab Inc. All Rights Reserved. 4".-"TTFSUJPO *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS 4".-"TTFSUJPO

    /BNF*% ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ  ϢʔβʔͷϚοϐϯάʹ͸/BNF*%Λ࢖༻
  9. Copyright Nulab Inc. All Rights Reserved. 4".-"TTFSUJPO *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS 4".-"TTFSUJPO

    /BNF*% ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ  *% EPHHP!FYBNQMFDPN QFOHV!FYBNQMFDPN DBUUP!FYBNQMFDPN IJSPTF!FYBNQMFDPN /BNF ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝
  10. Copyright Nulab Inc. All Rights Reserved. 4".-"TTFSUJPO *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS 4".-"TTFSUJPO

    /BNF*% ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ  *% EPHHP!FYBNQMFDPN QFOHV!FYBNQMFDPN DBUUP!FYBNQMFDPN IJSPTF!FYBNQMFDPN ϚοϐϯάͰ͖ͳ͍ͧʁ ϑΥʔϚοτ͕͋ͬͯͳ͍ʁ /BNF ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝
  11. Copyright Nulab Inc. All Rights Reserved. 4".-"TTFSUJPO *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS 4".-"TTFSUJPO

    /BNF*% ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ  *% EPHHP!FYBNQMFDPN QFOHV!FYBNQMFDPN DBUUP!FYBNQMFDPN IJSPTF!FYBNQMFDPN /BNF*%͸ ϝʔϧΞυϨεͰཉ͍͠ /BNF*%ͷϑΥʔϚοτΛઃఆ /BNF*%͸ ϝʔϧΞυϨεͰ౉͢ /BNF ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝
  12. Copyright Nulab Inc. All Rights Reserved. 4".-"TTFSUJPO *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS 4".-"TTFSUJPO

    /BNF*% ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ  *% EPHHP!FYBNQMFDPN QFOHV!FYBNQMFDPN DBUUP!FYBNQMFDPN IJSPTF!FYBNQMFDPN /BNF*%͸ ϝʔϧΞυϨεͰཉ͍͠ /BNF*%͸ ϝʔϧΞυϨεͰ౉͢ VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT /BNF*%ͷϑΥʔϚοτΛઃఆ /BNF ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝
  13. Copyright Nulab Inc. All Rights Reserved. 4".-"TTFSUJPO *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS 4".-"TTFSUJPO

    /BNF*% IJSPTF!FYBNQMFDPN &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ  *% EPHHP!FYBNQMFDPN QFOHV!FYBNQMFDPN DBUUP!FYBNQMFDPN IJSPTF!FYBNQMFDPN /BNF*%͸ ϝʔϧΞυϨεͰཉ͍͠ /BNF*%͸ ϝʔϧΞυϨεͰ౉͢ VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT /BNF*%ͷϑΥʔϚοτ͕ϝʔϧΞυϨεʹ /BNF ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝
  14. Copyright Nulab Inc. All Rights Reserved. 4".-"TTFSUJPO *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS 4".-"TTFSUJPO

    /BNF*% IJSPTF!FYBNQMFDPN &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ  *% EPHHP!FYBNQMFDPN QFOHV!FYBNQMFDPN DBUUP!FYBNQMFDPN IJSPTF!FYBNQMFDPN /BNF*%͸ ϝʔϧΞυϨεͰཉ͍͠ /BNF*%͸ ϝʔϧΞυϨεͰ౉͢ VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT ֘౰ͷΞΧ΢ϯτ͕ϚοϐϯάͰ͖ͨ /BNF ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝
  15. Copyright Nulab Inc. All Rights Reserved. 4".-"TTFSUJPO *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS 4".-"TTFSUJPO

    /BNF*% IJSPTF!FYBNQMFDPN &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ  *% EPHHP!FYBNQMFDPN QFOHV!FYBNQMFDPN DBUUP!FYBNQMFDPN IJSPTF!FYBNQMFDPN /BNF*%͸ ϝʔϧΞυϨεͰཉ͍͠ /BNF*%͸ ϝʔϧΞυϨεͰ౉͢ VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT 4".-"TTFSUJPOʹ͸ վ͟Μ๷ࢭͷͨΊॺ໊͕ඞཁ /BNF ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝
  16. Copyright Nulab Inc. All Rights Reserved. 4".-"TTFSUJPO *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS 4".-"TTFSUJPO

    /BNF*% IJSPTF!FYBNQMFDPN &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ  *% EPHHP!FYBNQMFDPN QFOHV!FYBNQMFDPN DBUUP!FYBNQMFDPN IJSPTF!FYBNQMFDPN /BNF*%͸ ϝʔϧΞυϨεͰཉ͍͠ /BNF*%͸ ϝʔϧΞυϨεͰ౉͢ VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT ِ଄͞Εͯͳ͍͔ॺ໊Λ֬ೝ /BNF ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝
  17. Copyright Nulab Inc. All Rights Reserved. 4".-"TTFSUJPO *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS 4".-"TTFSUJPO

    /BNF*% IJSPTF!FYBNQMFDPN &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ  *% EPHHP!FYBNQMFDPN QFOHV!FYBNQMFDPN DBUUP!FYBNQMFDPN IJSPTF!FYBNQMFDPN /BNF*%͸ ϝʔϧΞυϨεͰཉ͍͠ /BNF*%͸ ϝʔϧΞυϨεͰ౉͢ VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT signature *E1 /BNF ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝
  18. Copyright Nulab Inc. All Rights Reserved. 4".-"TTFSUJPO *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS 4".-"TTFSUJPO

    /BNF*% IJSPTF!FYBNQMFDPN &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ  *% EPHHP!FYBNQMFDPN QFOHV!FYBNQMFDPN DBUUP!FYBNQMFDPN IJSPTF!FYBNQMFDPN /BNF*%͸ ϝʔϧΞυϨεͰཉ͍͠ /BNF*%͸ ϝʔϧΞυϨεͰ౉͢ VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT signature ࣄલʹূ໌ॻ͸ަ׵͓ͯ͘͠ 9ূ໌ॻ 9ূ໌ॻ /BNF ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝
  19. Copyright Nulab Inc. All Rights Reserved. 4".-"TTFSUJPO *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS 4".-"TTFSUJPO

    /BNF*% IJSPTF!FYBNQMFDPN &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ  *% EPHHP!FYBNQMFDPN QFOHV!FYBNQMFDPN DBUUP!FYBNQMFDPN IJSPTF!FYBNQMFDPN /BNF*%͸ ϝʔϧΞυϨεͰཉ͍͠ /BNF*%͸ ϝʔϧΞυϨεͰ౉͢ VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT signature 9ূ໌ॻ 9ূ໌ॻ /BNF ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝
  20. Copyright Nulab Inc. All Rights Reserved. .FUBEBUB *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS /BNF*%͸

    ϝʔϧΞυϨεͰཉ͍͠ /BNF*%͸ ϝʔϧΞυϨεͰ౉͢ VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT 9ূ໌ॻ 9ূ໌ॻ FUD FUD ৴པؔ܎Λߏங͢Δʹ͸ ৭ʑ৘ใΛަ׵͢Δඞཁ͕͋Δ
  21. Copyright Nulab Inc. All Rights Reserved. .FUBEBUB *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS /BNF*%͸

    ϝʔϧΞυϨεͰཉ͍͠ /BNF*%͸ ϝʔϧΞυϨεͰ౉͢ VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT .FUBEBUB 9ূ໌ॻ 9ূ໌ॻ 9.- FUD FUD
  22. Copyright Nulab Inc. All Rights Reserved. σʔλͷड͚౉͠ 6TFS"HFOU *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS

    ৴པؔ܎ ϩάΠϯ 4".- 3FRVFTU ೝূ 4".- "TTFSUJPO 4".- "TTFSUJPO ݕূ     
  23. Copyright Nulab Inc. All Rights Reserved. σʔλͷड͚౉͠ 6TFS"HFOU *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS

    ৴པؔ܎ ϩάΠϯ 4".- 3FRVFTU ೝূ 4".- "TTFSUJPO 4".- "TTFSUJPO ݕূ     
  24. Copyright Nulab Inc. All Rights Reserved. σʔλͷड͚౉͠ )5513FEJSFDU#JOEJOH 4".-#JOEJOHT )5511045#JOEJOH

    4".-3FRVFTUʹ࢖༻Մೳ https://idp.example.com?SAMLRequest=value 302: Redirect 41 *E1 User Agent
  25. Copyright Nulab Inc. All Rights Reserved. σʔλͷड͚౉͠ )5513FEJSFDU#JOEJOH 4".-#JOEJOHT )5511045#JOEJOH

    4".-3FRVFTUʹ࢖༻Մೳ 4".-3FRVFTU΍4".-"TTFSUJPOͷड͚౉͠ʹ࢖༻Մೳ https://idp.example.com?SAMLRequest=value 302: Redirect 41 *E1 User Agent POST *E1 41 User Agent ********** SAML Response Submit
  26. Copyright Nulab Inc. All Rights Reserved. σʔλͷड͚౉͠ )5513FEJSFDU#JOEJOH 4".-#JOEJOHT )5511045#JOEJOH

    4".-3FRVFTUʹ࢖༻Մೳ 4".-3FRVFTU΍4".-"TTFSUJPOͷड͚౉͠ʹ࢖༻Մೳ https://idp.example.com?SAMLRequest=value 302: Redirect 41 *E1 User Agent POST *E1 41 User Agent ********** SAML Response Submit Ϣʔβʔͷϒϥ΢βΛܦ༝ͯ͠ σʔλΛ΍ΓͱΓ͢Δ
  27. Copyright Nulab Inc. All Rights Reserved. σʔλͷड͚౉͠ )5513FEJSFDU#JOEJOH 4".-#JOEJOHT )5511045#JOEJOH

    4".-3FRVFTUʹ࢖༻Մೳ 4".-3FRVFTU΍4".-"TTFSUJPOͷड͚౉͠ʹ࢖༻Մೳ https://idp.example.com?SAMLRequest=value 302: Redirect 41 *E1 User Agent POST *E1 41 User Agent ********** SAML Response Submit Ϣʔβʔͷϒϥ΢βΛܦ༝ͯ͠ σʔλΛ΍ΓͱΓ͢Δ
  28. Copyright Nulab Inc. All Rights Reserved. σʔλͷड͚౉͠ )5513FEJSFDU#JOEJOH 4".-#JOEJOHT )5511045#JOEJOH

    4".-3FRVFTUʹ࢖༻Մೳ 4".-3FRVFTU΍4".-"TTFSUJPOͷड͚౉͠ʹ࢖༻Մೳ https://idp.example.com?SAMLRequest=value 302: Redirect 41 *E1 User Agent POST *E1 41 User Agent ********** SAML Response Submit Ϣʔβʔͷϒϥ΢βΛܦ༝ͯ͠ σʔλΛ΍ΓͱΓ͢Δ JavaScript౳Λ༻͍ͯࣗಈͰSubmit
  29. Copyright Nulab Inc. All Rights Reserved. ೝূϑϩʔʛ41JOJUJBUFE 6TFS"HFOU *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS

    ৴པؔ܎ ϩάΠϯ 4".- 3FRVFTU ೝূ 4".- "TTFSUJPO 4".- "TTFSUJPO ݕূ     
  30. Copyright Nulab Inc. All Rights Reserved. ೝূϑϩʔʛ41JOJUJBUFE 41JOJUJBUFE HTTP Redirect

    Binding HTTP POST Binding 6TFS"HFOU *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS ৴པؔ܎ ϩάΠϯ 4".- 3FRVFTU ೝূ 4".- "TTFSUJPO 4".- "TTFSUJPO ݕূ     
  31. Copyright Nulab Inc. All Rights Reserved. ೝূϑϩʔʛ*E1JOJUJBUFE *E1JOJUJBUFE HTTP POST

    Binding 6TFS"HFOU *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS ৴པؔ܎ ϩάΠϯ ೝূ 4".- "TTFSUJPO 4".- "TTFSUJPO ݕূ    
  32. Copyright Nulab Inc. All Rights Reserved. ͍͞͝ʹ ;FOOʹͯ޷ධൢചதʂ ΋͏গ͠ৄ͘͠஌Γ͍ͨ৔߹͸ʜ 4".-ೖ໳

    IUUQT[FOOEFWLYOUCPPLTDBDFB 4".-ೝূʹରԠͯ͠΄͍͠ͱݴΘΕͯ΋ɺ΋͏಄Λ๊͑Δඞ ཁ͸͋Γ·ͤΜɻ 41Λ࣮૷͢Δ্Ͱࠓ·Ͱ৮ΕΒΕΔ͜ͱͷͳ͔ͬͨ Ͳ͏͍͏ઃܭ͕ඞཁ͔ʁ ԿΛؾΛ͚ͭͳ͚Ε͹ͳΒͳ͍͔ʁ ͷΤοηϯεΛ٧ΊࠐΈ·ͨ͠ɻ ٕज़ॻయʹ޲͚ͯ ిࢠॻ੶Խ ˍදࢴϦχϡʔΞϧ࡞ۀத