Javaで実装して学ぶOAuth 2.0！

by Masatoshi Tada

Slide 1

Slide 1 text

Slide 2

Slide 2 text

Slide 3

Slide 3 text

Slide 4

Slide 4 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 גࣜձࣾΧαϨΞϧ ▸ *5ڭҭˍγεςϜ։ൃ ▸ IUUQTXXXDBTBSFBMDPKQMTTFSWJDF PQFOTFNJOBSUPQJOEFYIUNM ▸ ଞࣾʹ͸ແ͍ϓϩάϥϛϯάݚम͕ڧΈʂ ▸ +BWB&&ɺ4QSJOHɺ1JWPUBMೝఆίʔεɺ"QQMFೝఆίʔ εɺ+BWB4DSJQUɺJ04ɺ"OESPJEɺɾɾɾ 4

Slide 5

Slide 5 text

Slide 6

Slide 6 text

Slide 7

Slide 7 text

Slide 8

Slide 8 text

Slide 9

Slide 9 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ΞΫηετʔΫϯͱ͸ ▸ ΫϥΠΞϯτ͕ϦιʔεαʔόʔʹΞΫηε͢Δ ࡍͷʮ௨ߦखܗʯͷΑ͏ͳ΋ͷ ▸ ೝՄαʔόʔ͔Βൃߦ͞ΕΔ 9 GET /api/todos HTTP 1.1 Host: resource-server.com Authorization:Bearer yd2Dcweij334SSx ΞΫηετʔΫϯ

Slide 10

Slide 10 text

Slide 11

Slide 11 text

Slide 12

Slide 12 text

Slide 13

Slide 13 text

Slide 14

Slide 14 text

Slide 15

Slide 15 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ᶅΫϥΠΞϯτ ▸ ϦιʔεΦʔφʔͷೝՄΛಘͯɺͦͷ୅ཧͱͯ͠อ ޢ͞ΕͨϦιʔεʹΞΫηε͢ΔΞϓϦέʔγϣϯ ▸ αʔόʔαΠυ8FCΞϓϦɺΫϥΠΞϯταΠυ8FCΞ ϓϦɺωΠςΟϒΞϓϦͳͲଟछଟ༷ ▸ 5XJUUFSͳΒʮUXJUUFSDPNʯʮ5XFFU%FDLʯʮJ04 "OESPJE༻ΫϥΠΞϯτʯʮ%PPSLFFQFSʯͳͲ 15

Slide 16

Slide 16 text

Slide 17

Slide 17 text

Slide 18

Slide 18 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 <$.>+BWBݚम࣮ࢪதʂ ▸ +BWB&&+4'ɺ+1"ɺ$%*ʹΑΔεϚʔτ։ൃ ▸ +BWB&&+"934 ▸ 4QSJOH͸͡Ίͯͷ4QSJOH.7$ ▸ &⒎FDUJWF+BWBͷཧղͱ'JOE#VHTͷ׆༻ ▸ ͱ͜ͱΜ࢖͏ʂ+6OJUϑΝϛϦʔ 18 https://www.casareal.co.jp/ls/service/openseminar/java

Slide 19

Slide 19 text

Slide 20

Slide 20 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ΫϥΠΞϯτͷछྨʹΑΔͭͷάϥϯτλΠϓ ᶃ ೝՄίʔυάϥϯτ ▸ ओʹαʔόʔαΠυ8FCΞϓϦ ᶄ ΠϯϓϦγοτάϥϯτ ▸ ओʹΫϥΠΞϯταΠυ8FCΞϓϦ ᶅ ϦιʔεΦʔφʔύεϫʔυΫϨσϯγϟϧάϥϯτ ▸ ओʹϦιʔεαʔόʔެࣜͷωΠςΟϒΞϓϦ ᶆ ΫϥΠΞϯτΫϨσϯγϟϧάϥϯτ ▸ ΫϥΠΞϯτࣗ਎ͷ৘ใʹΞΫηε͢Δ৔߹ͳͲ 20 ←ࠓճ͸ίϨ

Slide 21

Slide 21 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ೝՄίʔυάϥϯτͷಛ௃ ▸ ೝՄαʔόʔ͸ɺ·ͣΞΫηετʔΫϯͷҾ׵݊  ೝՄίʔυ ΛΫϥΠΞϯτʹൃߦ͢Δ ▸ ϦμΠϨΫτͱΫΤϦύϥϝʔλΛར༻ͯ͠ɺ8FCϒϥ΢β Λܦ༝ͯ͠౉͢ ▸ ΫϥΠΞϯτ͸ɺೝՄίʔυΛೝՄαʔόʔʹఏࣔ͠ɺ ΞΫηετʔΫϯΛड͚औΔ ▸ 8FCϒϥ΢βʹ௚઀ΞΫηετʔΫϯΛ౉͞ͳ͍Α͏ʹ͢Δ ͨΊʢ΋͠8FCϒϥ΢β͕ѱ͍ਓʹ৐ͬऔΒΕͯͨΒΞ΢τͳͷͰʣ 21

Slide 22

Slide 22 text

Slide 23

Slide 23 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ೝՄίʔυʹΑΔΞΫηετʔΫϯऔಘ 23 ೝՄαʔόʔ ΫϥΠΞϯτ Ϧιʔε  Φʔφʔ Web  ϒϥ΢β※ ※Webϒϥ΢β͸ɺ࢓༷ॻͰ͸ʮϢʔβʔΤʔδΣϯτʯͱهࡌ͞Ε͍ͯ·͢ ᶃॳճΞΫηε ᶄೝՄΤϯυϙΠϯτʹϦμΠϨΫτ ᶅೝՄը໘ ᶆೝՄ ᶇೝՄίʔυൃߦʴϦμΠϨΫτ ᶈೝՄίʔυ ᶉΞΫηετʔΫϯ

Slide 24

Slide 24 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ΞΫηετʔΫϯΛར༻ͨ͠ϦιʔεΞΫηε 24 ೝՄαʔόʔ ΫϥΠΞϯτ Ϧιʔε  Φʔφʔ Web  ϒϥ΢β ੥ٻॻ࡞੒  ࢿྉ༣ૹ Ϧιʔε  αʔόʔ ᶃϦΫΤετ ᶅΞΫηε  ɹτʔΫϯ  ɹݕূ ᶆϢʔβʔ৘ใ΍είʔϓ ᶈϨεϙϯε ᶉϨεϙϯε ᶇείʔϓΛ  ɹνΣοΫ ᶄϦιʔεʹΞΫηε  with ΞΫηετʔΫϯ

Slide 25

Slide 25 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 0"VUI࢓༷Ͱະఆٛͷ෦෼ᶃ 25 ೝՄαʔόʔ ΫϥΠΞϯτ Ϧιʔε  Φʔφʔ Web  ϒϥ΢β ᶃॳճΞΫηε ᶄೝՄΤϯυϙΠϯτʹϦμΠϨΫτ ᶅೝՄը໘ ᶆೝՄ ᶇೝՄίʔυൃߦʴϦμΠϨΫτ ᶈೝՄίʔυ ᶉΞΫηετʔΫϯ Ͳ͏ೝՄ͢Δ͔͸ܾ·ͬͯͳ͍  ˠ։ൃऀ͕࡞ΓࠐΉඞཁ͕͋Δ

Slide 26

Slide 26 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 0"VUI࢓༷Ͱະఆٛͷ෦෼ᶄ 26 ೝՄαʔόʔ ΫϥΠΞϯτ Ϧιʔε  Φʔφʔ Web  ϒϥ΢β ੥ٻॻ࡞੒  ࢿྉ༣ૹ Ϧιʔε  αʔόʔ ᶃϦΫΤετ ᶅΞΫηε  ɹτʔΫϯ  ɹݕূ ᶆϢʔβʔ৘ใ΍είʔϓ ᶈϨεϙϯε ᶉϨεϙϯε ᶇείʔϓΛ  ɹνΣοΫ ᶄϦιʔεʹΞΫηε  with ΞΫηετʔΫϯ ΞΫηετʔΫϯΛ  ૹΔ෦෼Ҏ֎͸  ΄ͱΜͲະఆٛ

Slide 27

Slide 27 text

Slide 28

Slide 28 text

Slide 29

Slide 29 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ೝূ͕ඞཁͳՕॴᶃ 29 ೝՄαʔόʔ ΫϥΠΞϯτ Ϧιʔε  Φʔφʔ Web  ϒϥ΢β ᶃॳճΞΫηε ᶄೝՄΤϯυϙΠϯτʹϦμΠϨΫτ ᶅೝՄը໘ ᶆೝՄ ᶇೝՄίʔυൃߦʴϦμΠϨΫτ ᶈೝՄίʔυ ᶉΞΫηετʔΫϯ ೝՄͨ͠ͷ͸ຊ౰ʹϦιʔεΦʔφʔʁ  ˠϦιʔεΦʔφʔͷIDɾύεϫʔυͰೝূ

Slide 30

Slide 30 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ೝূ͕ඞཁͳՕॴᶄ 30 ೝՄαʔόʔ ΫϥΠΞϯτ Ϧιʔε  Φʔφʔ Web  ϒϥ΢β ᶃॳճΞΫηε ᶄೝՄΤϯυϙΠϯτʹϦμΠϨΫτ ᶅೝՄը໘ ᶆೝՄ ᶇೝՄίʔυൃߦʴϦμΠϨΫτ ᶈೝՄίʔυ ᶉΞΫηετʔΫϯ ೝՄίʔυΛૹ͖ͬͯͨͷ͸ຊ౰ʹΫϥΠΞϯτʁ  ˠclient_idɾclient_secretͰBASICೝূ ※client_idͱclient_secret͸ɺೝՄαʔόʔʹࣄલʹൃߦͯ͠΋Β͏

Slide 31

Slide 31 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ೝূ͕ඞཁͳՕॴᶅ 31 ೝՄαʔόʔ ΫϥΠΞϯτ Ϧιʔε  Φʔφʔ Web  ϒϥ΢β ੥ٻॻ࡞੒  ࢿྉ༣ૹ Ϧιʔε  αʔόʔ ᶃϦΫΤετ ᶅΞΫηε  ɹτʔΫϯ  ɹݕূ ᶆϢʔβʔ৘ใ΍είʔϓ ᶈϨεϙϯε ᶉϨεϙϯε ᶇείʔϓΛ  ɹνΣοΫ ᶄϦιʔεʹΞΫηε  with ΞΫηετʔΫϯ ΞΫηετʔΫϯΛૹ͖ͬͯͨͷ͸  ຊ౰ʹϦιʔεαʔόʔʁ  ˠϦιʔεαʔόʔͷIDɾύεϫʔυ  ͰBASICೝূ

Slide 32

Slide 32 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ΞΫηετʔΫϯͷೝূ͸ʁ ▸ ΞΫηετʔΫϯൃߦޙͷϦιʔεΦʔφʔຊਓ ֬ೝ͸͠ͳ͍ ▸ ΞΫηετʔΫϯʹ༗ޮظݶΛ͚ͭΔɺ  ΞΫηετʔΫϯͷ࠶ൃߦ SFGSFTIτʔΫϯ ɺ  ΞΫηετʔΫϯͷണୣ SFWPLF ɺ  ͳͲͷߟྀ͸ඞਢ ▸ ࣌ؒͷ౎߹্ɺࠓճ͸಺༰ʹؚΊ·ͤΜ 32

Slide 33

Slide 33 text

Slide 34

Slide 34 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 <$.>1JWPUBMೝఆݚम࣮ࢪதʂ ▸ $PSF4QSJOH ▸ ᶃ݄೔ʙ೔ɺᶄ݄೔ʙ೔ ▸ ϋΠϨϕϧͳʮ4QSJOHͷجૅʯ ▸ %*ɺ"01ɺςετɺ%#ɺτϥϯβΫγϣϯɺ 8FCɺ3&45ɺ4FDVSJUZɺ4QSJOH#PPUɺ .JDSPTFSWJDFTʜ 34 https://www.casareal.co.jp/ls/service/openseminar/pivotal

Slide 35

Slide 35 text

Slide 36

Slide 36 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ࠓճͷαϯϓϧΞϓϦ ▸ 50%0؅ཧΞϓϦ ▸ ೝՄαʔόʔ ▸ Ϧιʔεαʔόʔ ▸ ಡΈॻ͖ΫϥΠΞϯτ ▸ ಡΉ͚ͩΫϥΠΞϯτ 36 ੥ٻॻ࡞੒  ࢿྉ༣ૹ JSON HTML ΞΫηε  τʔΫϯ ݕূ ίʔυ -> https://github.com/MasatoshiTada/oltu-todo

Slide 37

Slide 37 text

Slide 38

Slide 38 text

Slide 39

Slide 39 text

Slide 40

Slide 40 text

Slide 41

Slide 41 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ͦͷଞͷ0"VUIରԠϥΠϒϥϦ ▸ 4QSJOH4FDVSJUZ0"VUI ▸ ߴػೳ͕ͩެࣜυΩϡϝϯτ͕গͳ͍ ▸ IUUQTQSPKFDUTTQSJOHJPTQSJOHTFDVSJUZPBVUIEPDT PBVUIIUNM ▸ 5FSBTPMVOB։ൃΨΠυϥΠϯ͕ৄ͍͠ʢઅ0"VUIʣ ▸ 4QSJOH4FDVSJUZʹ΋0"VUIػೳ͕ՃΘΔ༧ఆ ▸ IUUQTHJUIVCDPNTQSJOHQSPKFDUTTQSJOHTFDVSJUZUSFF NBTUFSPBVUI 41

Slide 42

Slide 42 text

Slide 43

Slide 43 text

Slide 44

Slide 44 text

Slide 45

Slide 45 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 <$.>1JWPUBMೝఆݚम࣮ࢪதʂ ▸ 4QSJOH#PPU%FWFMPQFS ▸ ॳճɿ݄೔ʙ೔ ▸ 4QSJOH#PPUͷجૅ͔ΒԠ༻·Ͱ ▸ 1JWPUBMͱڞ࠵Ͱମݧηϛφʔ΍Γ·͢ʂ 45 https://www.casareal.co.jp/ls/service/openseminar/pivotal

Slide 46

Slide 46 text

Slide 47

Slide 47 text

Slide 48

Slide 48 text

Slide 49

Slide 49 text

Slide 50

Slide 50 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ᶃॳճΞΫηε ▸ ೝՄΤϯυϙΠϯτ΁ϦμΠϨΫτ͢Δίʔυ 50 // ϦμΠϨΫτઌͷURLΛ૊ΈཱͯΔ OAuthClientRequest oAuthRequest = OAuthClientRequest .authorizationLocation(“https://localhost:8888/api/authorize”) .setResponseType(“code”) .setClientId(“readwriteclient”) .setRedirectURI(“https://localhost:8081/api/redirect”) .setState("xyz") .buildQueryMessage(); // ೝՄΤϯυϙΠϯτ΁ϦμΠϨΫτ return Response.status(Response.Status.FOUND) .location(URI.create(oAuthRequest.getLocationUri())) .build(); readwrite-client/src/main/java/com/example/readwriteclient/web/exception/mapper/AccessTokenRequiredExceptionMapper.java ೝՄΤϯυϙΠϯτURL response_type client_id redirect_uri state※ ※stateͷ”xyz”͸Ծͷ஋Ͱ͢ɻຊདྷ͸ϥϯμϜͳจࣈྻʹ͠·͢ɻ

Slide 51

Slide 51 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ᶃॳճΞΫηε ▸ ΫϥΠΞϯτ͔Β8FCϒϥ΢β΁ͷϨεϙϯε ▸ ೝՄαʔόʔͷೝՄΤϯυϙΠϯτ΁ϦμΠϨΫτ 51 302 FOUND Location: https://localhost:8888/api/authorize? response_type=code&redirect_uri=https%3A%2F%2Flo calhost%3A8081%2Fapi%2Fredirect&state=xyz&client _id=readwriteclient

Slide 52

Slide 52 text

Slide 53

Slide 53 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ᶄೝՄΤϯυϙΠϯτʹϦμΠϨΫτʙᶅೝՄը໘ ▸ 8FCϒϥ΢β͕ɺઌ΄ͲͷϦμΠϨΫτͰࢦఆ ͞Εͨ63-ʹϦΫΤετ 53 GET https://localhost:8888/api/authorize? response_type=code&redirect_uri=https%3A%2F%2Flo calhost%3A8081%2Fapi%2Fredirect&state=xyz&client _id=readwriteclient

Slide 54

Slide 54 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ᶄೝՄΤϯυϙΠϯτʹϦμΠϨΫτʙᶅೝՄը໘ ▸ ೝՄΤϯυϙΠϯτͷίʔυ 54 @GET @Controller public String goToApprovalView(@Context HttpServletRequest req) throws OAuthProblemException, OAuthSystemException { // ϦΫΤετͷੜ੒ʢඞཁͳύϥϝʔλͷνΣοΫ΋ߦ͏ʣ OAuthAuthzRequest oAuthRequest = new OAuthAuthzRequest(req); …(தུ)… // ೝՄը໘΁ϑΥϫʔυ models.put("client", client); models.put("state", oAuthRequest.getState()); return "approval.html"; } authorization-server/src/main/java/com/example/authorizationserver/web/controller/AuthorizationController.java

Slide 55

Slide 55 text

Slide 56

Slide 56 text

Slide 57

Slide 57 text

Slide 58

Slide 58 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ᶆೝՄʙᶇೝՄίʔυൃߦʴϦμΠϨΫτ ▸ ೖྗ͞Εͨ*%ͳͲΛड͚औΔίϯτϩʔϥʔ 58 @POST public Response approve(@FormParam("loginId") String loginId, @FormParam("password") String password, @FormParam("client_id") String clientId, @Context HttpServletRequest httpServletRequest) { // ϦιʔεΦʔφʔͷೝূ ResourceOwner resourceOwner = resourceOwnerService.findByLoginId(loginId); if (!resourceOwner.getPassword().equals(password)) { throw new NotAuthorizedException(…); } // ೝՄίʔυͷൃߦ OAuthIssuer oAuthIssuer = new OAuthIssuerImpl(new MD5Generator()); String authCode = oAuthIssuer.authorizationCode(); authorization-server/src/main/java/com/example/authorizationserver/web/controller/ApprovalController.java

Slide 59

Slide 59 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ᶆೝՄʙᶇೝՄίʔυൃߦʴϦμΠϨΫτ 59 // ΫϥΠΞϯτͷऔಘ Client client = clientService.getClient(clientId); // ೝՄίʔυͱϦιʔεΦʔφʔΛϗϧμʔʹอଘ authorizationCodeHolder.addResourceOwner( authCode, resourceOwner); authorizationCodeHolder.addClient(authCode, client); // Ϩεϙϯεͷ࡞੒ OAuthResponse oAuthResponse = OAuthASResponse .authorizationResponse(httpServletRequest, 302) .setCode(authCode) // ೝՄίʔυ .setParam(“state”, state) // state .location(client.getRedirectUri()) // redirect_uri .buildQueryMessage(); // ΫϥΠΞϯτͷϦμΠϨΫτΤϯυϙΠϯτʹϦμΠϨΫτ return Response.status(oAuthResponse.getResponseStatus()) .location(URI.create(oAuthResponse.getLocationUri())) .build(); } authorization-server/src/main/java/com/example/authorizationserver/web/controller/ApprovalController.java

Slide 60

Slide 60 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ᶆೝՄʙᶇೝՄίʔυൃߦʴϦμΠϨΫτ 60 ▸ ೝՄαʔόʔ͔Β8FCϒϥ΢β΁ͷϨεϙϯε ▸ ΫϥΠΞϯτͷϦμΠϨΫτΤϯυϙΠϯτ΁ϦμΠ ϨΫτ 302 FOUND Location: https://localhost:8081/api/redirect? code=876c4b7339cd3a3bd416a0772fdbf8af&state=xyz ೝՄίʔυ

Slide 61

Slide 61 text

Slide 62

Slide 62 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ᶈೝՄίʔυʙᶉΞΫηετʔΫϯ ▸ 8FCϒϥ΢β͕ɺΫϥΠΞϯτͷϦμΠϨΫτ ΤϯυϙΠϯτʹϦΫΤετ 62 GET https://localhost:8081/api/redirect? code=876c4b7339cd3a3bd416a0772fdbf8af&state=xyz ೝՄίʔυ

Slide 63

Slide 63 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ᶈೝՄίʔυʙᶉΞΫηετʔΫϯ ▸ ΫϥΠΞϯτͷϦμΠϨΫτΤϯυϙΠϯτͷίʔυ 63 @GET @Controller public String redirect(@QueryParam("code") String authCode) { // τʔΫϯΤϯυϙΠϯτ΁ͷϦΫΤετͷੜ੒ OAuthClientRequest oAuthClientRequest = OAuthClientRequest .tokenLocation("https://localhost:8888/api/token") .setClientId("readwriteclient") .setClientSecret("password") .setRedirectURI("https://localhost:8081/api/redirect") .setCode(authCode) .setGrantType(GrantType.AUTHORIZATION_CODE) .buildBodyMessage(); // BASICೝূϔομʔΛ෇Ճ oAuthClientRequest.addHeader(HttpHeaders.AUTHORIZATION, Constants.AUTH_HEADER_VALUE); readwrite-client/src/main/java/com/example/readwriteclient/web/controller/RedirectController.java

Slide 64

Slide 64 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ᶈೝՄίʔυʙᶉΞΫηετʔΫϯ 64 // τʔΫϯΤϯυϙΠϯτʹϦΫΤετͯ͠ɺΞΫηετʔΫϯΛऔಘ OAuthClient oAuthClient = new OAuthClient( new URLConnectionClient()); OAuthJSONAccessTokenResponse oAuthAccessTokenResponse = oAuthClient.accessToken(oAuthClientRequest); String accessToken = oAuthAccessTokenResponse.getAccessToken(); // ηογϣϯείʔϓͳϗϧμʔʹΞΫηετʔΫϯΛอଘ accessTokenHolder.setAccessToken(accessToken); // Ұཡը໘ʹϦμΠϨΫτ return "redirect:/todo/index"; } readwrite-client/src/main/java/com/example/readwriteclient/web/controller/RedirectController.java

Slide 65

Slide 65 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ᶈೝՄίʔυʙᶉΞΫηετʔΫϯ ▸ τʔΫϯΤϯυϙΠϯτ΁ͷϦΫΤετ಺༰ ▸ ΫϥΠΞϯτˠೝՄαʔόʔ 65 POST /api/token Host: localhost:8888 Authorization: Basic cmVhZHdyaXRlY2xpZW50OnBhc3N3b3Jk Content-Type: application/x-www-form-urlencoded grant_type=authorization_code&code=876c4b7339cd3a3bd416 a0772fdbf8af&redirect_uri=https%3A%2F%2Flocalhost%3A808 1%2Fapi%2Fredirect

Slide 66

Slide 66 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ᶈೝՄίʔυʙᶉΞΫηετʔΫϯ ▸ τʔΫϯΤϯυϙΠϯτͷίʔυ 66 @POST @Produces(MediaType.APPLICATION_JSON) public Response token( @Context HttpServletRequest httpServletRequest) { // τʔΫϯϦΫΤετʹඞཁͳύϥϝʔλΛνΣοΫ OAuthTokenRequest oauthRequest = new OAuthTokenRequest(httpServletRequest); …(தུ)… // ΞΫηετʔΫϯͱϦϑϨογϡτʔΫϯൃߦ OAuthIssuer oAuthIssuer = new OAuthIssuerImpl(new MD5Generator()); String accessToken = oAuthIssuer.accessToken(); String refreshToken = oAuthIssuer.refreshToken(); authorization-server/src/main/java/com/example/authorizationserver/web/controller/TokenController.java

Slide 67

Slide 67 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ᶈೝՄίʔυʙᶉΞΫηετʔΫϯ 67 // Ϩεϙϯε͢ΔJSONͷ࡞੒ OAuthResponse oAuthResponse = OAuthASResponse .tokenResponse(Response.Status.OK.getStatusCode()) .setAccessToken(accessToken) .setExpiresIn("3600") .setRefreshToken(refreshToken) .buildJSONMessage(); ɹ// ΫϥΠΞϯτʹ200 OKͰϨεϙϯε return Response.ok(oAuthResponse.getBody()) .build(); authorization-server/src/main/java/com/example/authorizationserver/web/controller/TokenController.java

Slide 68

Slide 68 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ᶈೝՄίʔυʙᶉΞΫηετʔΫϯ ▸ τʔΫϯΤϯυϙΠϯτ͔Βͷ+40/Ϩεϙϯε ▸ ೝՄαʔόʔˠΫϥΠΞϯτ 68 200 OK {"access_token":"ffb085abdadf4235c33aa0f042a4f5eb","ref resh_token":"b1669b4c5fdc984f9bd5252bc2f50f52","expires _in":3600} ΞΫηετʔΫϯ ̏̔෼ܦաʁ

Slide 69

Slide 69 text

Slide 70

Slide 70 text

Slide 71

Slide 71 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ᶃϦΫΤετ ʙᶄϦιʔεʹΞΫηεXJUIΞΫηετʔΫϯ 71 ೝՄαʔόʔ ΫϥΠΞϯτ Ϧιʔε  Φʔφʔ Web  ϒϥ΢β ੥ٻॻ࡞੒  ࢿྉ༣ૹ Ϧιʔε  αʔόʔ ᶃϦΫΤετ ᶅΞΫηε  ɹτʔΫϯ  ɹݕূ ᶆϢʔβʔ৘ใ΍είʔϓ ᶈϨεϙϯε ᶉϨεϙϯε ᶇείʔϓΛ  ɹνΣοΫ ᶄϦιʔεʹΞΫηε  with ΞΫηετʔΫϯ

Slide 72

Slide 72 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ᶃϦΫΤετ ʙᶄϦιʔεʹΞΫηεXJUIΞΫηετʔΫϯ ▸ ΫϥΠΞϯτ͔ΒϦιʔεαʔόʔʹϦΫΤετ ▸ ΞΫηετʔΫϯΛ"VUIPSJ[BUJPOϔομʔʹ෇Ճ 72 GET /api/v1/todos Authorization : Bearer ffb085abdadf4235c33aa0f042a4f5eb ΞΫηετʔΫϯ

Slide 73

Slide 73 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 73 ೝՄαʔόʔ ΫϥΠΞϯτ Ϧιʔε  Φʔφʔ Web  ϒϥ΢β ੥ٻॻ࡞੒  ࢿྉ༣ૹ Ϧιʔε  αʔόʔ ᶃϦΫΤετ ᶅΞΫηε  ɹτʔΫϯ  ɹݕূ ᶆϢʔβʔ৘ใ΍είʔϓ ᶈϨεϙϯε ᶉϨεϙϯε ᶇείʔϓΛ  ɹνΣοΫ ᶄϦιʔεʹΞΫηε  with ΞΫηετʔΫϯ ᶅΞΫηετʔΫϯݕূʙᶆϢʔβʔ৘ใ΍είʔϓ

Slide 74

Slide 74 text

Slide 75

Slide 75 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ᶅΞΫηετʔΫϯݕূʙᶆϢʔβʔ৘ใ΍είʔϓ ▸ "QBDIF0MUVͰ͸ɺϦιʔεαʔόʔ༻ͷ  αʔϒϨοτϑΟϧλʔ͕༻ҙ͞Ε͍ͯΔ 75 OAuthFilter org.apache.oltu.oauth2.rsfilter.OAuthFilter OAuthFilter /* resource-server/src/main/webapp/WEB-INF/web.xml

Slide 76

Slide 76 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ᶅΞΫηετʔΫϯݕূʙᶆϢʔβʔ৘ใ΍είʔϓ ▸ 0"VUI'JMUFS͔Βɺ0"VUI341SPWJEFS࣮૷Ϋ ϥε͕ݺ͹ΕΔ ▸ XFCYNMʹԼهͷఆ͕ٛඞཁ 76 oauth.rs.provider-class com.example.resourceserver.oauth.MyOAuthRSProvider resource-server/src/main/webapp/WEB-INF/web.xml

Slide 77

Slide 77 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ᶅΞΫηετʔΫϯݕূʙᶆϢʔβʔ৘ใ΍είʔϓ 77 public class MyOAuthRSProvider implements OAuthRSProvider { @Override public OAuthDecision validateRequest(String rsId, String accessToken, HttpServletRequest httpServletRequest) { // ೝՄαʔόʔ΁HTTPΞΫηεͯ͠ΞΫηετʔΫϯͷਖ਼౰ੑνΣοΫ MultivaluedHashMap formParams = …; formParams.putSingle("access_token", accessToken); Response response = ClientBuilder.newBuilder() .build() .target("https://localhost:8888/api/check_token") .request() .header("Content-Type", "application/x-www-form-urlencoded") .header("Authorization", Constants.AUTH_HEADER_VALUE) .post(Entity.form(formParams)); // ΞΫηετʔΫϯ͸ਖ਼౰ͳΒ͹200͕ฦͬͯ͘Δ if (response.getStatusInfo().equals(Response.Status.OK)) { // ໭Γ஋Λฦ͢ } resource-server/src/main/java/com/example/resourceserver/oauth/MyOAuthRSProvider.java

Slide 78

Slide 78 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ᶅΞΫηετʔΫϯݕূʙᶆϢʔβʔ৘ใ΍είʔϓ 78 ▸ ೝՄαʔόʔ͔ΒͷϨεϙϯε 200 OK Content-Type: application/json { “login_id” : “user1”, “client” : { “client_id” : “readwriteclient”, … “scope_types” : [“read”, “write”] } } είʔϓ৘ใ

Slide 79

Slide 79 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 79 ೝՄαʔόʔ ΫϥΠΞϯτ Ϧιʔε  Φʔφʔ Web  ϒϥ΢β ੥ٻॻ࡞੒  ࢿྉ༣ૹ Ϧιʔε  αʔόʔ ᶃϦΫΤετ ᶅΞΫηε  ɹτʔΫϯ  ɹݕূ ᶆϢʔβʔ৘ใ΍είʔϓ ᶈϨεϙϯε ᶉϨεϙϯε ᶇείʔϓΛ  ɹνΣοΫ ᶄϦιʔεʹΞΫηε  with ΞΫηετʔΫϯ ᶇείʔϓΛνΣοΫʙᶉϨεϙϯε

Slide 80

Slide 80 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ᶇείʔϓΛνΣοΫʙᶉϨεϙϯε ▸ Ϧιʔεαʔόʔͷίϯτϩʔϥʔϝιουʹ !3PMFT"MMPXFEͰείʔϓΛࢦఆ 80 @Path("/todos") public class TodoController { @RolesAllowed("read") @GET @Produces("application/json") public Response findAll() { … } @RolesAllowed("write") @POST @Consumes("application/json") public Response add(Todo todo) { … } } resource-server/src/main/java/com/example/resourceserver/web/controller/TodoController.java ̐̌෼ܦաʁ

Slide 81

Slide 81 text

Slide 82

Slide 82 text

Slide 83

Slide 83 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 0"VUI࢓༷ॻΑΓ ▸ ຊࢿྉͰະ঺հͷࣄ߲ ▸ ೝՄίʔυϦμΠϨΫτ63*ͷૢ࡞ ▸ ϑΟογϯάΞλοΫ ▸ ΫϩεαΠτϦΫΤετϑΥʔδΣϦ  ɾɾɾͳͲ ▸ ඞͣ࢓༷ॻΛνΣοΫ͠·͠ΐ͏ʂ ▸ IUUQTPQFOJEGPVOEBUJPOKBQBOHJUIVCJP SGDKBIUNMBODIPS 83

Slide 84

Slide 84 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ηΩϡϦςΟؔ࿈ͷ࢓༷ॻ ▸ 3'$0"VUI5ISFBU.PEFMBOE 4FDVSJUZ$POTJEFSBUJPOT ▸ IUUQXXXSGDFEJUPSPSHJOGPSGD ▸ 3'$0"VUI5PLFO3FWPDBUJPO ▸ IUUQPQFOJEGPVOEBUJPOKBQBOHJUIVCJP SGDKBIUNM 84

Slide 85

Slide 85 text

Slide 86

Slide 86 text

Slide 87

Slide 87 text

Slide 88

Slide 88 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 "QBDIF0MUV͸࢖͑Δ͔ʁ ▸ ͋͘·Ͱʮֶश༻ʯͱ͍͏ͷ͕ݸਓతͳײ૝ ▸ ػೳ͕࠷௿ݶͰੜ࢈ੑ͸͋·Γྑ͘ͳ͍ ▸ υΩϡϝϯτ͕গͳ͍ʴக໋తͳؒҧ͍ ▸ ͦͷଞͷηΩϡϦςΟࣄ߲͸͢΂ͯࣗݾ੹೚ ▸ جຊతʹ͸4QSJOH4FDVSJUZ0"VUI΍QBDKͳ ͲΛ࢖ͬͨ΄͏͕ྑ͍͔΋ 88

Slide 89

Slide 89 text

Slide 90

Slide 90 text

(C) CASAREAL, Inc. All rights reserved. #jjug_ccc #ccc_e5 ͞Βʹֶश͢ΔͨΊʹ ▸ 0"VUI࢓༷ॻ೔ຊޠ൛ ▸ IUUQTPQFOJEGPVOEBUJPOKBQBOHJUIVCJPSGDKBIUNM ▸ 0"VUIΛ͸͡ΊΑ͏ ▸ IUUQTXXXPSFJMMZDPKQCPPLT ▸ 0"VUIશϑϩʔͷਤղͱಈը ▸ IUUQRJJUBDPN5BLBIJLP,BXBTBLJJUFNTFCGBG ▸ ࠓߋฉ͚ͳ͍0"VUI ▸ IUUQTXXXTMJEFTIBSFOFUQIQITBPBVUI 90