コンシューマ向けサービスで使われている認証認可仕様とデジタル署名 / saloff1-ritou

by ritou

Slide 1

Slide 1 text

ίϯγϡʔϚ޲͚αʔϏεͰ࢖ΘΕ͍ͯΔ ೝূೝՄ࢓༷ͱσδλϧॺ໊ ͍ͱ͏Γΐ͏!SJUPV αϧΦϑॺ໊ϒλ໺࿠͸ೝূઌഐͷເΛݟͳ͍

Slide 2

Slide 2 text

͍ͱ͏Γΐ͏ • (ג)ϛΫγΟ ΤϯδχΞ - Identity / Platform • OpenID ϑΝ΢ϯσʔγϣϯɾδϟύϯ ΤόϯδΣϦετ(2߸ػ) • Blog : ritou.hatenablog.com • Twitter : @ritou (ळాͷೣ) • ˌidcon, #iddance !2

Slide 3

Slide 3 text

ຊ೔ͷ಺༰ • ೝূपΓͰ࢖ΘΕ͍ͯΔ/͜Ε͔Β࢖ΘΕͦ͏ͳ࢓༷ Λ঺հ • σδλϧॺ໊ͷ࢖ΘΕͲ͜Ζʢ͞ΘΓ͚ͩʣ !3

Slide 4

Slide 4 text

ೝূೝՄपΓͷΩʔϫʔυ • OAuth 2.0 & OpenID Connect • WebAuthn / FIDO !4

Slide 5

Slide 5 text

OAuth 2.0 & OpenID Connect

Slide 6

Slide 6 text

OAuth 2.0 RFC 6749/6750 (2012/10~) • RFC 6749 : τʔΫϯϕʔεͷϦιʔεΞΫηεͷ͘͠Έ • ొ৔ਓ෺͸Client, Server, Resource Owner ͷ3ऀ • Client͕Resource OwnerͷύεϫʔυͳͲΛѻΘͳ͍(※) • RFC 6750 : Bearer TokenͰAPIΞΫηε͢Δํ๏ • ΞΫηετʔΫϯͷऔಘํ๏ • ΞΫηετʔΫϯΛ༻͍ͨAPIΞΫηεํ๏ !6

Slide 7

Slide 7 text

OAuth 2.0ར༻ྫ ͸ͯͳϒϩάͷInstagram࿈ܞ !7

Slide 8

Slide 8 text

OAuth 2.0ར༻ྫ ͸ͯͳϒϩάͷInstagram࿈ܞ !8

Slide 9

Slide 9 text

Կ͕ߦΘΕͨͷ͔ʁ !9 3FTPVSDF0XOFS $MJFOU 4FSWFS *OTUBHSBN࿈ܞΛ ༗ޮԽ͢Δ *OTUBHSBNͷը૾ ΁ͷΞΫηεݖݶΛཁٻ ΞΫηε͕ڐՄ͞Εͨ͜ͱΛ௨஌ ̏ ͸ͯͳϒϩάʹΑΔ *OTUBHSBNͷը૾΁ͷΞΫηεΛ Ϣʔβʔ͕ڐՄ

Slide 10

Slide 10 text

!10 IUUQTUXJUUFSDPNLVSB@MBCTUBUVT "VUIPSJ[BUJPO$PEF 'MPX *NQMJDJU'MPX

Slide 11

Slide 11 text

No content

Slide 12

Slide 12 text

OAuth 2.0ͷτʔΫϯͱ༻్ !12 • Access Token - APIΞΫηε • Refresh Token - Access Tokenߋ৽ • Authorization Code - Access Token / Refresh Tokenऔಘ

Slide 13

Slide 13 text

͍ΘΏΔOAuthೝূ (OAuth as a Authentication) !13 • OAuth 2.0ͰϓϩϑΟʔϧAPI͔ΒϢʔβʔࣝผࢠ Λऔಘ͠ɺೝূػೳʹར༻ • ౷Ұ͞Ε͍ͯͳ͍ϓϩϑΟʔϧAPI • Native ApplicationͱόοΫΤϯυαʔόʔؒͷΞΫηετʔ ΫϯͷϋϯυϦϯά

Slide 14

Slide 14 text

OpenID Connect (2014/2~) !14 • ʮʙͰϩάΠϯʯ(ID࿈ܞ)ͷͨΊͷ࢓༷ • OAuth 2.0Λ֦ு • ID Token - ೝূΠϕϯτͷ৘ใΛ΍ΓऔΓ • Userinfo Endpoint - ඪ४తͳϓϩϑΟʔϧAPI • Self-Issued OP - ୺຤্Ͱಈ࡞͢ΔOpenID Provider

Slide 15

Slide 15 text

!15

Slide 16

Slide 16 text

OpenID Connect - ID Token !16 • ೝূΠϕϯτͷ৘ใΛ֨ೲ • JSON Web Signatureܗࣜ • ϢʔβʔɺRPɺೝূཁٻͷ৘ใΛ֨ೲ • OP͕࣋ͭൿີ伴Ͱॺ໊ • RP͸ެ։伴ͰݕূՄೳ

Slide 17

Slide 17 text

OAuth 2.0/OIDC஀ੜޙͷมԽ !17 • Ϣʔεέʔε • Client : Web App -> Native App(Hybrid) -> Single Page App etc… • Server : monolith -> microservices • ྖҬ • SNS࿈ܞɺιʔγϟϧϩάΠϯ -> ܾࡁɺۚ༥ɺϔϧεέΞ جຊػೳ͚ͩͰ͸ཁ͕݅ຬͨͤͳ͍৔߹΋

Slide 18

Slide 18 text

!18

Slide 19

Slide 19 text

Security Considerations • RFCs • 6819 : OAuth 2.0 Threat Model and Security Considerations • 8252 : OAuth 2.0 for Native Apps • Draft • OAuth 2.0 Security Best Current Practice • OAuth 2.0 for Browser-Based Apps !19

Slide 20

Slide 20 text

Financial-grade API (FAPI) • ΦϯϥΠϯͷۚ༥αʔϏεʹ͓͚ΔOAuth 2.0/OIDC ͷ࣮૷ΨΠυϥΠϯ • Part 1: Read-Only API Security Profile - ࢀরܥ • Part 2: Read and Write API Security Profile - ߋ৽ܥ • Client Initiated Backchannel Authentication Profile (CIBA) - Client؀ڥͱೝূσόΠεͷ෼཭ !20

Slide 21

Slide 21 text

OAuth/OIDCͱσδλϧॺ໊ • ίΞͳ࢓༷ • ID Tokenͷੜ੒ɺݕূ • ͦͷଞɺ֤छϦΫΤετ/ϨεϙϯεͷอޢʹJWSͳͲΛ ར༻͢Δ֦ு͕͋Δ • Clientೝূ • ೝূ(ೝՄཁٻ) !21

Slide 22

Slide 22 text

WebAuthn / FIDO Ϣʔβʔೝূͷ͓࿩

Slide 23

Slide 23 text

ύεϫʔυೝূ !23 • ཁ͕݅ຬͨ͞ΕΔͳΒ͹ࢸߴͷೝূํࣜ • هԱετϨʔδͷར༻ʹΑΔՄൖੑ • αʔϏε͝ͱʹҟͳΔɺਪଌࠔ೉ͳจࣈྻ • ϑΟογϯάରࡦ • ࿙Ӯηʔϑͳ؅ཧ • ݱঢ় : ཁ݅Λຬͨͤͳ͍Ϣʔβʔ/αʔϏε……

Slide 24

Slide 24 text

FIDO !24 • ϩʔΧϧೝূΛར༻ • ύεϫʔυΛૹΒͳ͍ • (ੜମೝূʹݶΒͣ)༷ʑͳೝূํࣜͱͷ૊Έ߹Θ͕ͤՄೳ • ެ։伴҉߸ํࣜ • ొ࿥ : ॺ໊ͱެ։伴৘ใΛૹ৴ • ೝূ : ॺ໊Λૹ৴

Slide 25

Slide 25 text

WebAuthn !25 • FIDO2 : WebΞϓϦέʔγϣϯ͔Β΋FIDO • WebAuthn (Web Authentication API) • FIDOΛར༻͢ΔαʔϏε͕ݺͼग़͢JavaScript API • CTAP • ηΩϡϦςΟΩʔͱ΍ΓͱΓ͢ΔͨΊͷ࢓༷ɺϒϥ΢β͕࣮૷

Slide 26

Slide 26 text

WebAuthn - ొ৔ਓ෺ !26 • Relying Party : WebΞϓϦ • Authenticator : ηΩϡϦςΟΩʔɺσόΠε • Client : Webϒϥ΢β

Slide 27

Slide 27 text

WebAuthn - ొ࿥ϑϩʔ !27 1. ొ࿥༻ύϥϝʔλ࡞੒  (RP৘ใ,Ϣʔβʔ৘ใ, ϩʔΧϧೝূͷ༗ແͳͲ) 3. Authenticator/Platform ͷػೳΛݺͼग़͢ 2. JS APIͷݺͼग़͠ 4.ϩʔΧϧೝূ 伴ϖΞੜ੒ ॺ໊࡞੒ 5. ৽͍͠ެ։伴ͱॺ໊ 6. JS API͔Βͷ໭Γ஋ 7.֤छݕূ ެ։伴ͷอଘ Authenticator (SecurityKey etc…) Client (ϒϥ΢β) Relying Party

Slide 28

Slide 28 text

WebAuthn - ೝূϑϩʔ !28 1. ೝূ༻ύϥϝʔλ࡞੒  (ެ։伴৘ใ,ϩʔΧϧೝ ূͷ༗ແͳͲ) 3. Authenticator/Platform ͷػೳΛݺͼग़͢ 2. JS APIͷݺͼग़͠ 4.ϩʔΧϧೝূ ॺ໊࡞੒ 5. ॺ໊ 6. JS API͔Βͷ໭Γ஋ 7.֤छݕূ ೝূ׬ྃॲཧ Authenticator (SecurityKey etc…) Client (ϒϥ΢β) Relying Party

Slide 29

Slide 29 text

FIDOͷϢʔεέʔε !29 • ύεϫʔυϨεͳೝূํࣜͱͯ͠ (ॴ࣋+ϩʔΧϧೝূ) • 2ஈ֊/2ཁૉ໨ͷೝূํࣜͱͯ͠ (ॴ࣋) • ॏཁͳॲཧͷલͷຊਓ֬ೝͱͯ͠

Slide 30

Slide 30 text

̎ஈ֊(ཁૉ)ೝূͱϑΟογϯά !30 ϑΟογϯάϝʔϧɺ ϝοηʔδ ϑΟογϯάαΠτ ʢFYBNQMFJOGPʣ ਖ਼نͷαΠτ FYBNQMFDPN *%ύεϫʔυ ϫϯλΠϜ ύεϫʔυ औಘͨ͠ *%ύεϫʔυ ϫϯλΠϜ ύεϫʔυ !30

Slide 31

Slide 31 text

FIDOͷϑΟογϯά଱ੑ !31 ϑΟογϯάϝʔϧɺ ϝοηʔδ ϑΟογϯάαΠτ ʢFYBNQMFJOGPʣ ਖ਼نͷαΠτ FYBNQMFDPN *%ύεϫʔυ Ξαʔγϣϯ ॺ໊ͳͲ औಘͨ͠ *%ύεϫʔυ Ξαʔγϣϯ !31 PSJHJO୯ҐͰ伴ϖΞΛ ੜ੒͍ͯ͠ΔͷͰ ϑΟογϯάαΠτʹ ϩάΠϯͰ͖ͳ͍ ϑΟογϯάαΠτ޲͚ͷ ΞαʔγϣϯΛਖ਼نͷαΠτʹ ૹͬͯ΋ݕূࣦഊ͢Δ

Slide 32

Slide 32 text

WebAuthn/FIDOͱσδλϧॺ໊ !32 • ొ࿥/ೝূϑϩʔͷνϟϨϯδ/Ϩεϙϯεͷݕূ • ެ։伴৘ใΛ༻͍ͯॺ໊ݕূ • Authenticator ͷਅਖ਼ੑͷݕূ • ূ໌ॻνΣʔϯͷݕূ