cybozu.comの認証 / cybozu.com authentication

by mwatanabe

Slide 1

Slide 1 text

cybozu.comͷೝূ աڈɺݱࡏɺະདྷ ΞϓϦέʔγϣϯج൫νʔϜɹ౉ล ੓ٛ Cybozu Tech Conference 2016

Slide 2

Slide 2 text

ࣗݾ঺հ • ౉ล ੓ٛʢΘͨͳ΂·͞Α͠ʣ • ΞϓϦέʔγϣϯج൫νʔϜ  ϛυϧ΢ΣΞ͔ΒϑϩϯτΤϯυ·Ͱ • 2010೥ೖࣾ • ʹΘ͔ւ֎αοΧʔϑΝϯͰ͢

Slide 3

Slide 3 text

ࠓ೔࿩͢͜ͱ • cybozu.comͷϩάΠϯػೳ • ෳ਺ϓϩμΫτؒͰͷೝূ৘ใͷڞ༗ • cybozu.comͷγϯάϧαΠϯΦϯ • ࠓޙͷ՝୊ͱເͷ͋Δະདྷͷ࿩

Slide 4

Slide 4 text

cybozu.com • B2BΫϥ΢υαʔϏε • ̍ςφϯτ̍αϒυϝΠϯʢςφϯτ㲈ձࣾʣ • ̍ςφϯτ಺ʹෳ਺ͷϓϩμΫτ • ϩάΠϯը໘͸̍ςφϯτʹ͚̍ͭͩ

Slide 5

Slide 5 text

αϒυϝΠϯͰςφϯτΛ෼͚Δ

Slide 6

Slide 6 text

̍ςφϯτෳ਺ϓϩμΫτ corpA.cybozu.com

Slide 7

Slide 7 text

cybozu.comڞ௨؅ཧ corpA.cybozu.com

Slide 8

Slide 8 text

cybozu.comͷϩάΠϯ

Slide 9

Slide 9 text

No content

Slide 10

Slide 10 text

cybozu.comͷϩάΠϯ • Α͋͘Δύεϫʔυೝূ • αϒυϝΠϯදࣔͰςφϯτΛࣝผՄೳ • ಛʹ೉͍͜͠ͱ͸ͯ͠ͳ͍ • ͨͩ͠ϩάΠϯͷηΩϡϦςΟઃఆ͸ෳࡶ

Slide 11

Slide 11 text

ෳࡶͳϩάΠϯͷઃఆ • ೖྗิॿ • ύεϫʔυϙϦγʔ • ΞΧ΢ϯτϩοΫΞ΢τ • ηογϣϯ༗ޮظݶ • SAML • ϩάΠϯࣦഊ࣌ͷϝοηʔδ

Slide 12

Slide 12 text

ͳͥෳࡶͳͷ͔ • ΦϯϓϨϛεϓϩμΫτͷػೳΛ࠶ݱ • ͍Ζ͍ΖͳاۀͷηΩϡϦςΟཁ݅ʹରԠ  ྫ)؅ཧऀͱҰൠϢʔβʔͰҟͳΔύεϫʔυͷ࠷খจࣈ਺ • ϒϥ΢βͷਐԽʹ൐͍ෆཁʹͳΓͭͭ͋Δ߲ ໨΋࢒͍ͬͯΔ => ఆظతͳ͓૟আ͕ඞཁ  ྫ)ϒϥ΢βͷύεϫʔυϚωʔδϟΛ੍ޚ͢Δઃఆ

Slide 13

Slide 13 text

ෳ਺ϓϩμΫτؒͷ ೝূ৘ใͷڞ༗

Slide 14

Slide 14 text

ೝূ৘ใͷڞ༗ʁ • ڞ௨؅ཧͷϩάΠϯը໘ͰϩάΠϯͨ͠Β  ͢΂ͯͷϓϩμΫτʹΞΫηεՄೳʹ͢Δ͜ͱ • ڞ௨؅ཧ͔ΒϩάΞ΢τͨ͠Β  ͢΂ͯͷϓϩμΫτ͔ΒϩάΞ΢τ͞ΕΔ͜ͱ

Slide 15

Slide 15 text

ݹͷ࣌୅

Slide 16

Slide 16 text

ݹͷ࣌୅

Slide 17

Slide 17 text

ݹͷ࣌୅ • ϒϥ΢βͰͷϩάΠϯը໘͸ڞ௨؅ཧͷ΋ͷ͚ͩ • ΦϯϓϨϛε࣌୅ΛҾ͖ͣΓɺϓϩμΫτຖʹηογϣϯ؅ ཧʢෳ਺ͷηογϣϯΫοΩʔʣ • ΦϨΦϨೝূ࿈ܞΫοΩʔͰϓϩμΫτؒSSO • ϓϩμΫτͷಠࣗΫϥΠΞϯτʢϞόΠϧͳͲʣ͸ͦΕͧΕ Ͱೝূ • ϩάΞ΢τ͸ϩάΞ΢τ༻ͷ࿈ܞΫοΩʔΛు͘

Slide 18

Slide 18 text

ͭΒ͍ɻɻ • ΫοΩʔͰϩάΞ΢τ͢Δʹ͸ɺ͢΂ͯͷϓϩμΫτʹϦΫΤε τඈ͹͞ͳ͍ͱ͍͚ͳ͍ • ϦΫΤετඈ͹ͳ͔ͬͨϓϩμΫτ͸ϩάΠϯঢ়ଶ͕ҡ࣋͞ΕΔ • ΦϨΦϨΫοΩʔ͸ϫϯλΠϜͰ͸ͳ͍ͷͰԿճͰ΋࢖͑Δ  ʢ༗ޮظݶ͸͋Δʣ • ೝূܦ࿏͕ͨ͘͞Μ͋ΔͷͰηογϣϯ؅ཧ͕Ή͍ͣ  ʢϢʔβʔʹඥͮ͘શηογϣϯ࡟আͱ͔ʣ

Slide 19

Slide 19 text

ݱ୅

Slide 20

Slide 20 text

ݱ୅

Slide 21

Slide 21 text

ݱ୅ • ηογϣϯΫοΩʔΛ̍ͭʹ౷Ұʢڞ௨ηογϣϯʣ • ೝূ৘ใΛJSONͰKVSʹอଘͯ͠ϓϩμΫτͱڞ༗ • ڞ௨ηογϣϯͷσʔλΛมߋͰ͖Δͷ͸ڞ௨؅ཧ͚ͩ • ϓϩμΫτ͸ڞ௨ηογϣϯʹඥ͍ͮͨಠࣗηογϣϯͷσʔ λΛ؅ཧ͢Δ • ϓϩμΫτͷΤϯυϙΠϯτͰϩάΠϯ͕ඞཁͳ৔߹ʢϞό ΠϧΞϓϦͳͲʣ͸ɺڞ௨؅ཧͷϩάΠϯAPIʹసૹ͢Δ

Slide 22

Slide 22 text

ϩάΠϯॲཧͷ౷ҰʹΑΓηογϣϯ؅ ཧ΋Մೳʹ

Slide 23

Slide 23 text

cybozu.comͷSSO

Slide 24

Slide 24 text

γϯάϧαΠϯΦϯ • ҰճͷϩάΠϯ͚ͩͰෳ਺ͷαʔϏεΛ࢖͑Δ • ϩάΠϯ໊ͱύεϫʔυ͸Ұ͚֮ͭͩ͑Ε͹ྑ͍ • ଞͷαʔϏεͱcybozu.com͕SSOͰ͖Ε͹خ͍͠ • ଞͷαʔϏεͱܨ͕ΔSSOͷͨΊʹඪ४࢓༷ (SAML)Λcybozu.comʹ࣮૷ͨ͠

Slide 25

Slide 25 text

͍Ζ͍Ζܨ͕Δ • New Relic • Jenkins • Artifactory • Redash  ʢྡͷ੮ͷਓ͕SAMLपΓͷPR౤͛ͯͨʣ • etc…

Slide 26

Slide 26 text

SAML

Slide 27

Slide 27 text

SAML • OASIS͕ࡦఆͨ͠ೝূ࿈ܞͷͨΊͷ࢓༷ • Ϣʔβʔ͸ೝূαʔόʔʢIdentity Provider = IdPʣʹϩάΠϯ͢Δ͚ͩͰOK • Active Directory Federation Services(ADFS)ΛSAML IdPͱͯ͠࢖͑Δ • ϒϥ΢βΛܦ༝͢Δʢϓϩτίϧ΋͋ΔʣͷͰcybozu.comͱADFS͸௚઀௨ ৴Ͱ͖ͳͯ͘΋ྑ͍ • ڵຯ͕͋Δํ͸ͪ͜Β΋Ͳ͏ͧ  ʮSAMLೝূ͕Ͱ͖Δ·Ͱʯhttp://blog.cybozu.io/entry/4224

Slide 28

Slide 28 text

SAML ϑϩʔ 1.Ϣʔβ͕cybozu.comʹΞΫηε͢Δ 2.cybozu.com͕SAMLϦΫΤετΛੜ੒͢Δ 3.Ϣʔβ͕cybozu.com͔ΒSAMLϦΫΤετΛ ड͚औΔ 4.IdP͕ϢʔβΛೝূ͢Δ 5.IdP͕SAMLϨεϙϯεΛੜ੒͢Δ 6.Ϣʔβ͕IdP͔ΒSAMLϨεϙϯεΛड͚औΔ 7.cybozu.com͕SAMLϨεϙϯεΛड͚औΓݕ ূ͢Δ 8.SAMLϨεϙϯεͷ಺༰ʹ໰୊͕ͳ͍৔߹͸ Ϣʔβʔ͕cybozu.comʹϩάΠϯͨ͠ঢ়ଶʹ ͳΔ https://help.cybozu.com/ja/general/admin/saml_settings.html ΑΓҾ༻

Slide 29

Slide 29 text

ೝূαʔόʔ(IdP)͕ඞཁ • େ͖ͳاۀͰ͋Ε͹ADFS͕͋Δ৔߹΋͋Δ͕ɺ SAMLͷͨΊʹADFSΛಋೖ͢Δͷ͸ॏ͍ɻ • ͓खܰʹ΍ΔͳΒIDaaSΛ࢖͏ͷ͕ྑͦ͞͏ɻ  (Okta, OneLogin, Azure ADͳͲ)

Slide 30

Slide 30 text

SAML·ͱΊ • SSOʹ࢖͑Δඪ४࢓༷ • ϒϥ΢βΛܦ༝͢ΔͷͰɺೝূαʔόʔͱαʔϏ ε͸௚઀௨৴Ͱ͖ͳͯ͘΋ྑ͍ • ೝূαʔόʔΛཱͯΔͷ͸େมͳͷͰɺIDaaS͔Β ࢝ΊΔͷ͕ྑ͛͞ • ΤϯδχΞ͕޷͖ͳπʔϧ΋͍Ζ͍Ζܨ͕Δ

Slide 31

Slide 31 text

ࠓޙͷ՝୊ ※࣮૷ͷ༧ఆ͸ະఆͰ͢ʂ

Slide 32

Slide 32 text

ࠓޙͷ՝୊ • REST APIͷೝূํ͕ࣜಠࣗ࢓༷ͳͷͰ࿈ܞ͕ ೉͍͠ • ೋཁૉೝূͷબ୒ࢶ͕গͳ͍

Slide 33

Slide 33 text

REST APIͷೝূํࣜ • cybozu.comʹ͸REST API͕͋Δ • ೝূ͸ಠࣗͷHTTPϔομʔ • Ϣʔβʔ໊ͱύεϫʔυΛΤϯίʔυ͠ͳ͍ ͱ͍͚ͳ͍ • OAuthͳͲͷඪ४తͳ࢓༷ΛऔΓೖΕ͍ͨ

Slide 34

Slide 34 text

ೋཁૉೝূ • cybozu.comͰ͸ೋཁૉೝূͱͯ͠ΫϥΠΞϯτূ໌ॻ͕͋Δ ͕ɺIPΞυϨε੍ݶΛಥഁ͢ΔͨΊͷཁૉͱͯ͠࢖͏ • ΫϥΠΞϯτূ໌ॻΛWebView͔Β࢖͏ͷ͸Ή͍ͣ  ʢϞόΠϧΤϯδχΞஊʣ • TOTPʢGoogle Authenticatorతͳ΍ͭʣͳͲͷɺΑ͋͘Δೋ ཁૉೝূͷબ୒ࢶ΋͋ͬͯྑ͍ͷͰ͸ • FIDO U2F(ޙड़)ରԠͷυϯάϧ(yubikeyͳͲ)΋໘നͦ͏

Slide 35

Slide 35 text

ເͷ͋Δະདྷͷ࿩

Slide 36

Slide 36 text

ເͷ͋Δະདྷͷ࿩ • ਓྨ͸ύεϫʔυೝূʹർฐ͍ͯ͠Δ • ύεϫʔυແ͠Ͱೝূͯ͘͠Ε·ͤΜ͔ • FIDO͕͋Δ΍ͳ͍͔ʂ

Slide 37

Slide 37 text

FIDO

Slide 38

Slide 38 text

FIDO Alliance • ύεϫʔυҎ֎ͷೝূͷ࢓༷Λࡦఆ͍ͯ͠Δ • UAFʢύεϫʔυϨεೝূʣͱU2Fʢೋཁૉೝ ূʣͷ࢓༷Λެ։ • ̎ͭͷ࢓༷Λ·ͱΊͯFIDO2.0ͱ͠ɺͦΕΛجʹ ʮWeb Authenticationʯͱͯ͠W3CͰ࢓༷ࡦఆத   https://www.w3.org/TR/webauthn/

Slide 39

Slide 39 text

Web Authentication • W3Cͷυϥϑτ • ϒϥ΢βͷରԠঢ়گ͸·ͩ·ͩͰϓϩμΫτಋೖ͸ະདྷͷ࿩͕ͩɻɻ • Windows HelloʢWindowsͷੜମೝূʣରԠ୺຤ͷEdge͔Β͓ࢼ͠ Ͱ͖Δʂ • ͭ·Γ͸Edge͔ΒੜମೝূͷػೳΛࢼͤΔͱ͍͏͜ͱ • Web authentication and Windows Hello  https://developer.microsoft.com/en-us/microsoft-edge/platform/documentation/dev-guide/device/web-authentication/

Slide 40

Slide 40 text

Windows Hello

Slide 41

Slide 41 text

Χοͱͳͬͯϓϩτ࣮૷ͨ͠ • Surface Pro4 • إೝূͰWindows HelloΛ࢖͑Δ • cybozu.comʹإೝূͰϩάΠϯͩʂ • σϞ͠·͢  1. windows helloͷإೝূઃఆ  2. cybozu.comʹೝূσόΠεΛొ࿥  3. cybozu.comʹإೝূͰϩάΠϯ

Slide 42

Slide 42 text

·ͱΊ • cybozu.comͷೝূपΓΛͬ͘͟Γ࿩ͨ͠ • B2BͰ͸͍Ζ͍ΖͳηΩϡϦςΟཁ͕݅͋Δ • ΦϯϓϨϛεͷ࢓༷ΛҾ͖ͣΓ͗͢Δͱ௧͍໨ΛݟΔ • ϩάΠϯॲཧ͸ҰՕॴʹ·ͱΊΔͱ֦ு͕༰қ • Ϋϥ΢υͷ͓खܰͳSSOʹ͸IDaaS͕ྑͦ͞͏ • FIDO͸ະདྷײ͋Δ • Զͨͪͷઓ͍͸͜Ε͔Βͩ

Slide 43

Slide 43 text

͓͠·͍