なんとなくわかるSAML / Somewhat understandable SAML

Copyright Nulab Inc. All Rights Reserved. ,BOBUB)JSPTF ࣗݾ঺հ αʔϏε։ൃ෦"QQT՝σϖϩούʔ ೥ೖࣾ
ɾΞΧ΢ϯτ؅ཧೝূೝՄܾࡁ ɾ/VMBC1BTTͷ։ൃ

Copyright Nulab Inc. All Rights Reserved. 4".- 4".-ͱ͸ ɾҟͳΔΠϯλʔωοτυϝΠϯؒͰϢʔβʔೝূΛߦ͏ͨΊͷ ɹ9.-Λϕʔεʹͨ͠ඪ४ن֨
ɹ೥ɿࡦఆ ɹ೥ɿόʔδϣϯ ɾೝূͱೝՄʹରԠ͢Δϓϩτίϧ ɾγϯάϧαΠϯΦϯʹΑ͘༻͍ΒΕΔ 4FDVSJUZ"TTFSUJPO.BSLVQ-BOHVBHF

Copyright Nulab Inc. All Rights Reserved. 6TFS"HFOU ɾར༻ऀ ɾϢʔβʔ͕࢖༻͢Δϒϥ΢βΛࢦ͢͜ͱ͕ଟ͍ ొ৔ਓ෺ʛ6TFS"HFOU
ొ৔ਓ෺͸ਓ

Copyright Nulab Inc. All Rights Reserved. 6TFS"HFOU *EFOUJUZ1SPWJEFS ɾར༻ऀ ɾϢʔβʔ͕࢖༻͢Δϒϥ΢βΛࢦ͢͜ͱ͕ଟ͍
ొ৔ਓ෺͸ਓ ɾೝূ৘ใΛఏڙ͢Δଆ *E1 ɾ"[VSF"%΍0LUB౳ɺ*%Λ؅ཧ͢Δ΋ͷ ొ৔ਓ෺ʛ*EFOUJUZ1SPWJEFS

Copyright Nulab Inc. All Rights Reserved. 6TFS"HFOU *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS ɾར༻ऀ
ɾϢʔβʔ͕࢖༻͢Δϒϥ΢βΛࢦ͢͜ͱ͕ଟ͍ ొ৔ਓ෺͸ਓ ɾೝূ৘ใΛఏڙ͢Δଆ *E1 ɾ"[VSF"%΍0LUB౳ɺ*%Λ؅ཧ͢Δ΋ͷ ɾೝূ৘ใΛ࢖༻͢Δଆ 41 ɾओʹ4BB4 ొ৔ਓ෺ʛ4FSWJDF1SPWJEFS

৴པؔ܎ ͓ޓ͍ͷ৘ใΛ ࣄલʹަ׵͓ͯ͘͠ ࣄલʹ৴པؔ܎ͷߏங͕ඞཁ

৴པؔ܎ ϩάΠϯ

৴པؔ܎ ϩάΠϯ 4".- 3FRVFTU

৴པؔ܎ ϩάΠϯ 4".- 3FRVFTU ೝূ

৴པؔ܎ ϩάΠϯ 4".- 3FRVFTU ೝূ 4".- "TTFSUJPO

৴པؔ܎ ϩάΠϯ 4".- 3FRVFTU ೝূ 4".- "TTFSUJPO 4".- "TTFSUJPO ݕূ

Copyright Nulab Inc. All Rights Reserved. 4".-"TTFSUJPO *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS 4".-
"TTFSUJPO

Copyright Nulab Inc. All Rights Reserved. 4".-"TTFSUJPO *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS 4".-"TTFSUJPO
/BNF*% ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ 4".-"TTFSUJPOʹ͸͜ͷΑ͏ͳ৘ใ͕ೖ͍ͬͯΔ ˞આ໌ͷͨΊ؆ུԽ͍ͯ͠·͢

/BNF*% ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ ϢʔβʔͷϚοϐϯάʹ͸/BNF*%Λ࢖༻

/BNF*% ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ *% EPHHP!FYBNQMFDPN QFOHV!FYBNQMFDPN DBUUP!FYBNQMFDPN IJSPTF!FYBNQMFDPN /BNF ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝

/BNF*% ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ *% EPHHP!FYBNQMFDPN QFOHV!FYBNQMFDPN DBUUP!FYBNQMFDPN IJSPTF!FYBNQMFDPN ϚοϐϯάͰ͖ͳ͍ͧʁ ϑΥʔϚοτ͕͋ͬͯͳ͍ʁ /BNF ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝

/BNF*% ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ *% EPHHP!FYBNQMFDPN QFOHV!FYBNQMFDPN DBUUP!FYBNQMFDPN IJSPTF!FYBNQMFDPN /BNF*%͸ ϝʔϧΞυϨεͰཉ͍͠ /BNF*%ͷϑΥʔϚοτΛઃఆ /BNF*%͸ ϝʔϧΞυϨεͰ౉͢ /BNF ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝

/BNF*% ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ *% EPHHP!FYBNQMFDPN QFOHV!FYBNQMFDPN DBUUP!FYBNQMFDPN IJSPTF!FYBNQMFDPN /BNF*%͸ ϝʔϧΞυϨεͰཉ͍͠ /BNF*%͸ ϝʔϧΞυϨεͰ౉͢ VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT /BNF*%ͷϑΥʔϚοτΛઃఆ /BNF ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝

/BNF*% IJSPTF!FYBNQMFDPN &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ *% EPHHP!FYBNQMFDPN QFOHV!FYBNQMFDPN DBUUP!FYBNQMFDPN IJSPTF!FYBNQMFDPN /BNF*%͸ ϝʔϧΞυϨεͰཉ͍͠ /BNF*%͸ ϝʔϧΞυϨεͰ౉͢ VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT /BNF*%ͷϑΥʔϚοτ͕ϝʔϧΞυϨεʹ /BNF ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝

/BNF*% IJSPTF!FYBNQMFDPN &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ *% EPHHP!FYBNQMFDPN QFOHV!FYBNQMFDPN DBUUP!FYBNQMFDPN IJSPTF!FYBNQMFDPN /BNF*%͸ ϝʔϧΞυϨεͰཉ͍͠ /BNF*%͸ ϝʔϧΞυϨεͰ౉͢ VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT ֘౰ͷΞΧ΢ϯτ͕ϚοϐϯάͰ͖ͨ /BNF ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝

/BNF*% IJSPTF!FYBNQMFDPN &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ *% EPHHP!FYBNQMFDPN QFOHV!FYBNQMFDPN DBUUP!FYBNQMFDPN IJSPTF!FYBNQMFDPN /BNF*%͸ ϝʔϧΞυϨεͰཉ͍͠ /BNF*%͸ ϝʔϧΞυϨεͰ౉͢ VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT 4".-"TTFSUJPOʹ͸ վ͟Μ๷ࢭͷͨΊॺ໊͕ඞཁ /BNF ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝

/BNF*% IJSPTF!FYBNQMFDPN &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ *% EPHHP!FYBNQMFDPN QFOHV!FYBNQMFDPN DBUUP!FYBNQMFDPN IJSPTF!FYBNQMFDPN /BNF*%͸ ϝʔϧΞυϨεͰཉ͍͠ /BNF*%͸ ϝʔϧΞυϨεͰ౉͢ VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT ِ଄͞Εͯͳ͍͔ॺ໊Λ֬ೝ /BNF ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝

/BNF*% IJSPTF!FYBNQMFDPN &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ *% EPHHP!FYBNQMFDPN QFOHV!FYBNQMFDPN DBUUP!FYBNQMFDPN IJSPTF!FYBNQMFDPN /BNF*%͸ ϝʔϧΞυϨεͰཉ͍͠ /BNF*%͸ ϝʔϧΞυϨεͰ౉͢ VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT signature *E1 /BNF ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝

/BNF*% IJSPTF!FYBNQMFDPN &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ *% EPHHP!FYBNQMFDPN QFOHV!FYBNQMFDPN DBUUP!FYBNQMFDPN IJSPTF!FYBNQMFDPN /BNF*%͸ ϝʔϧΞυϨεͰཉ͍͠ /BNF*%͸ ϝʔϧΞυϨεͰ౉͢ VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT signature ࣄલʹূ໌ॻ͸ަ׵͓ͯ͘͠ 9ূ໌ॻ 9ূ໌ॻ /BNF ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝

/BNF*% IJSPTF!FYBNQMFDPN &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝ ൃߦऀ )0(&*E1 ༗ޮظݶ *% EPHHP!FYBNQMFDPN QFOHV!FYBNQMFDPN DBUUP!FYBNQMFDPN IJSPTF!FYBNQMFDPN /BNF*%͸ ϝʔϧΞυϨεͰཉ͍͠ /BNF*%͸ ϝʔϧΞυϨεͰ౉͢ VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT signature 9ূ໌ॻ 9ূ໌ॻ /BNF ,BOBUB)JSPTF &NBJM IJSPTF!FYBNQMFDPN ॴଐ "QQT՝

Copyright Nulab Inc. All Rights Reserved. .FUBEBUB *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS /BNF*%͸
ϝʔϧΞυϨεͰཉ͍͠ /BNF*%͸ ϝʔϧΞυϨεͰ౉͢ VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT 9ূ໌ॻ 9ূ໌ॻ FUD FUD ৴པؔ܎Λߏங͢Δʹ͸ ৭ʑ৘ใΛަ׵͢Δඞཁ͕͋Δ

Copyright Nulab Inc. All Rights Reserved. .FUBEBUB *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS /BNF*%͸
ϝʔϧΞυϨεͰཉ͍͠ /BNF*%͸ ϝʔϧΞυϨεͰ౉͢ VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT VSOPBTJTOBNFTUD4".-OBNFJE GPSNBUFNBJM"EESFTT .FUBEBUB 9ূ໌ॻ 9ূ໌ॻ 9.- FUD FUD

4".-3FRVFTUʹ࢖༻Մೳ https://idp.example.com?SAMLRequest=value 302: Redirect 41 *E1 User Agent

4".-3FRVFTUʹ࢖༻Մೳ 4".-3FRVFTU΍4".-"TTFSUJPOͷड͚౉͠ʹ࢖༻Մೳ https://idp.example.com?SAMLRequest=value 302: Redirect 41 *E1 User Agent POST *E1 41 User Agent ********** SAML Response Submit

4".-3FRVFTUʹ࢖༻Մೳ 4".-3FRVFTU΍4".-"TTFSUJPOͷड͚౉͠ʹ࢖༻Մೳ https://idp.example.com?SAMLRequest=value 302: Redirect 41 *E1 User Agent POST *E1 41 User Agent ********** SAML Response Submit Ϣʔβʔͷϒϥ΢βΛܦ༝ͯ͠ σʔλΛ΍ΓͱΓ͢Δ

4".-3FRVFTUʹ࢖༻Մೳ 4".-3FRVFTU΍4".-"TTFSUJPOͷड͚౉͠ʹ࢖༻Մೳ https://idp.example.com?SAMLRequest=value 302: Redirect 41 *E1 User Agent POST *E1 41 User Agent ********** SAML Response Submit Ϣʔβʔͷϒϥ΢βΛܦ༝ͯ͠ σʔλΛ΍ΓͱΓ͢Δ JavaScript౳Λ༻͍ͯࣗಈͰSubmit

Copyright Nulab Inc. All Rights Reserved. ೝূϑϩʔʛ41JOJUJBUFE 41JOJUJBUFE HTTP Redirect
Binding HTTP POST Binding 6TFS"HFOU *EFOUJUZ1SPWJEFS 4FSWJDF1SPWJEFS ৴པؔ܎ ϩάΠϯ 4".- 3FRVFTU ೝূ 4".- "TTFSUJPO 4".- "TTFSUJPO ݕূ

Copyright Nulab Inc. All Rights Reserved. ͍͞͝ʹ ;FOOʹͯ޷ධൢചதʂ ΋͏গ͠ৄ͘͠஌Γ͍ͨ৔߹͸ʜ 4".-ೖ໳
IUUQT[FOOEFWLYOUCPPLTDBDFB 4".-ೝূʹରԠͯ͠΄͍͠ͱݴΘΕͯ΋ɺ΋͏಄Λ๊͑Δඞ ཁ͸͋Γ·ͤΜɻ 41Λ࣮૷͢Δ্Ͱࠓ·Ͱ৮ΕΒΕΔ͜ͱͷͳ͔ͬͨ Ͳ͏͍͏ઃܭ͕ඞཁ͔ʁ ԿΛؾΛ͚ͭͳ͚Ε͹ͳΒͳ͍͔ʁ ͷΤοηϯεΛ٧ΊࠐΈ·ͨ͠ɻ ٕज़ॻయʹ޲͚ͯ ిࢠॻ੶Խ ˍදࢴϦχϡʔΞϧ࡞ۀத

なんとなくわかるSAML / Somewhat understandable SAML

なんとなくわかるSAML / Somewhat understandable SAML

More Decks by 株式会社ヌーラボ

Other Decks in Technology

Featured

Transcript