マネーフォワードの認証基盤のこれまでとこれから

by nhosoya

Slide 1

Slide 1 text

ϚωʔϑΥϫʔυͷ ೝূج൫ͷ͜Ε·Ͱ ͱ͜Ε͔Β גࣜձࣾϚωʔϑΥϫʔυ @nhosoya ࡉ୩௚थ 2023-01-19

Slide 2

Slide 2 text

@nhosoya ʢࡉ୩௚थʣ גࣜձࣾϚωʔϑΥϫʔυ IDαʔϏε։ൃ෦ 2015 - ϚωʔϑΥϫʔυMEͷ։ൃ ʢAndroid/Rails/EMͬΆ͍ͳʹ͔ʣ 2018 - ݱࡏ ೝূج൫ͷ։ൃ <- ࠓ೔͸͜ͷ࿩ 2

Slide 3

Slide 3 text

ϚωʔϑΥϫʔυͷαʔϏε 3

Slide 4

Slide 4 text

͜͜ʹςΩετ͕ೖΓ·͢͜͜ʹςΩετ͕ ͜͜ʹςΩετ͕ೖΓ·͢͜͜ʹςΩετ͕ ͜͜ʹςΩετ͕ೖΓ·͢͜͜ʹςΩετ͕ ͜͜ʹςΩετ͕ೖΓ·͢͜͜ʹςΩετ͕ 4

Slide 5

Slide 5 text

1ͭͷIDͰ͢΂ͯͷαʔϏεΛར༻Մೳ 31T *E1 01 5

Slide 6

Slide 6 text

౰વɺ࠷ॳ͔Β͜͏ͳ͍ͬͯͨΘ͚Ͱ͸ͳ͍ 6

Slide 7

Slide 7 text

2012೥ ϚωʔϑΥϫʔυ ME ϦϦʔε 7

Slide 8

Slide 8 text

1App 1DBͷγϯϓϧͳߏ੒ - ΞΧ΢ϯτ(ID/PW) - ۚ༥ػؔͳͲ͔Βऔಘͨ͠৘ใ - ͳͲͳͲ 8

Slide 9

Slide 9 text

2013೥ Ϋϥ΢υձܭɾ֬ఆਃࠂ ϦϦʔε 9

Slide 10

Slide 10 text

Ոܭ฽ͷσʔλΛ֬ఆਃࠂͰ΋׆༻͍ͨ͠ 10

Slide 11

Slide 11 text

ڞ༗͞ΕΔσʔλϕʔε - ۚ༥ػؔͳͲ͔Βऔಘͨ͠৘ใ - Ոܭ฽αʔϏεͷΈ͕ར༻͢Δ σʔλ - ΞΧ΢ϯτ৘ใ (ID/PW) - ձܭɾ֬ఆਃࠂαʔϏεͷΈ͕ ར༻͢Δσʔλ 11

Slide 12

Slide 12 text

2014೥ Ϋϥ΢υ੥ٻॻ 2015೥ Ϋϥ΢υڅ༩ Ϋϥ΢υϚΠφϯόʔ 2016೥ Ϋϥ΢υܦඅ 12

Slide 13

Slide 13 text

ਐΉີ݁߹ - ΞΧ΢ϯτ৘ใ (ID/PW) - ۚ༥ػؔͳͲ͔Βऔಘͨ͠৘ใ - Ոܭ฽αʔϏεͷΈ͕ར༻͢Δ σʔλ - ϚωʔϑΥʔϫʔυΫϥ΢υͷ αʔϏε͕ڞ௨Ͱར༻͢Δσʔλ 13

Slide 14

Slide 14 text

͜ͷͱ͖ͳʹ͕ى͖͍͔ͯͨ සൃ͢Δো֐ ɾDBͷੑೳ໰୊ ɾεϩʔΫΤϦҰൃͰ શαʔϏε͕ো֐ʹͳΔ ɾڞ༗ϥΠϒϥϦͰޓ׵ੑ Λอͭඞཁ͕͋Δ ɾΫϥ΢υαʔϏεΛ࢖͑ ͳ͍ ɾӨڹ͕શαʔϏεʹٴͿ ͷͰख͕ग़ͮ͠Β͍ ɾಉҰIDͰ͋Δ͜ͱΛ׆͔ ͤͳ͍ ։ൃ΁ͷ੍໿ ਐԽ͠ͳ͍ೝূ 14

Slide 15

Slide 15 text

2018೥ ೝূج൫ͷ։ൃ։࢝ 15

Slide 16

Slide 16 text

Ͳ͏ղܾ͢Δ DB΁ͷґଘΛ ݮΒ͢ WebAPI ͷΈͰ ΍ΓऔΓ ิॿͰ͸ͳ͘ ҕৡͯ͠΋Β͏ 16

Slide 17

Slide 17 text

*%τʔΫϯͷऔಘͱݕূ ೝূ 17

Slide 18

Slide 18 text

OpenID Connect ͷϝϦοτ • ඪ४࢓༷Ͱ͋Δ • ηΩϡϦςΟݒ೦͕গͳ͍ • OSS͕ར༻Ͱ͖ΔʢΫϥΠΞϯτࢹ఺ʣ • RESTful ͳ Web API ͷΈͰͷ΍ΓऔΓ • ݴޠɺΠϯϑϥͱ΋ʹαʔϏεଆ΁ͷ੍໿͕ͳ͍ • IdP ଆͷ։ൃͷΈͰೝূڧԽ͕Մೳ • ೝূॲཧࣗମ͸ IdP ଆͷυϝΠϯͷΈͰߦΘΕΔ 18

Slide 19

Slide 19 text

େมͩͬͨ͜ͱ • ࢓༷ͷཧղɾղऍ͕೉͍͠ • Ͳ͏࡞Δ͔ • طଘαʔϏεͷ IdP ରԠ 19

Slide 20

Slide 20 text

࢓༷ͷཧղɾղऍ͕೉͍͠ • ؔ࿈࢓༷͕ଟ͍… • Φϓγϣφϧ͕ଟ͍… • IdP Λ࡞ΔͨΊʹඞཁͳ࢓༷͕͢΂ͯࡌ͍ͬͯΔΘ͚Ͱ͸ͳ͍ → OpenID Foundation Japan ΁ͷ૬ஊ → ΤΩεύʔτͰ͋Δ @nov ͞ΜΛٕज़ސ໰ͱܴͯ͑͠Δʢͷͪೖࣾʣ 20

Slide 21

Slide 21 text

ࣗ࡞ / IDaaS / Managed • طଘσʔλͷҠߦཁ݅ • ϕϯμʔϩοΫΠϯ΁ͷෆ҆ • ྉۚʹݟ߹͏ͷ͔ → OSSϥΠϒϥϦΛ࢖ͬͯࣗ࡞ ʢݸਓతʹ͸ΊͪΌͪ͘Όྑ͍ܦݧʹͳͬͨɻ4೥͘Β͍େ͖ͳ໰୊΋ͳ͘ӡ༻Ͱ͖͍ͯΔɻ ͚Ͳ͔ͳΓ੒ޭόΠΞεɻຊ౰ʹθϩ͔Β΍ΔͳΒ IDaaS ࢖ͬͯΈ͍ͨɻʣ 21

Slide 22

Slide 22 text

طଘαʔϏεͷ IdP ରԠ • ঢ়گ • ։ൃ։࢝࣌఺Ͱ7ͭͷαʔϏε͕ӡ༻த • ৽ن2αʔϏεʢIdP ར༻લఏͰ։ൃʣϦϦʔεؒۙ • ϏοάόϯϦϦʔε͸ૣʑʹఘΊΔ • IdP ͕ڞ௨DB Λར༻͢Δ͜ͱͰޓ׵ੑΛอͭ͜ͱʹͨ͠ 22

Slide 23

Slide 23 text

ཧ૝͸DBͷڞ༗͕ͳ͍ੈք 23

Slide 24

Slide 24 text

IdP͕ڞ༗DBʹ৘ใΛಉظ͢Δ 24

Slide 25

Slide 25 text

2018೥12݄ ೝূج൫ͷϦϦʔε 25

Slide 26

Slide 26 text

ଓ͘৽نαʔϏε 2020೥ ϚωʔϑΥϫʔυ ͓ۚͷ૬ஊ ϚωʔϑΥϫʔυ Ϋϥ΢υձܭPlus ϚωʔϑΥϫʔυ ࣾձอݥ ϚωʔϑΥϫʔυ ։ۀಧ 2021೥ ϚωʔϑΥϫʔυ Ϋϥ΢υ࠴຿ࢧ෷ ϚωʔϑΥϫʔυ Ϋϥ΢υܖ໿ ϚωʔϑΥϫʔυ Ϋϥ΢υ੥ٻॻPlus ϚωʔϑΥϫʔυ Ϋϥ΢υݻఆࢿ࢈ ϚωʔϑΥϫʔυ Ϋϥ΢υਓࣄ؅ཧ ϚωʔϑΥϫʔυ Ϋϥ΢υ೥຤ௐ੔ ϚωʔϑΥϫʔυ IT؅ཧΫϥ΢υ ϚωʔϑΥϫʔυ Pay for Business 26

Slide 27

Slide 27 text

1ͭͷIDͰ͢΂ͯͷαʔϏεΛར༻Մೳ 27

Slide 28

Slide 28 text

ϦϦʔε͔ͯ͠ΒԿ΍ͬͯͨͷʁ 28

Slide 29

Slide 29 text

1. طଘαʔϏεͷҠߦαϙʔτ ɹɾશαʔϏε͕৐ͬͨͷ͸2020೥͘Β͍ 29

Slide 30

Slide 30 text

2. ೝূڧԽ ɹɾ2FA (TOTP/SMS) ɹɾSign in with Apple ɹɾϩάΠϯ௨஌ ɹɾύεϫʔυϙϦγʔมߋ ɹɾύεϫʔυڧ౓ϝʔλʔ ɹɾWebAuthn/Passkey 30

Slide 31

Slide 31 text

3. UX޲্ɺCVR޲্ ɹɾલճͷϩάΠϯํ๏ͷهԱ ɹɾαʔϏεؒͷSSO ɹɾB2C/B2B ʹ߹ΘͤͨΧελϚΠζ ɹɾݸผͷ RP ʹ߹ΘͤͨΧελϚΠζ 31

Slide 32

Slide 32 text

4. ΤϯλʔϓϥΠζରԠ ɹɾ૊৫؅ཧΞΧ΢ϯτ ɹɾSAML 32

Slide 33

Slide 33 text

5. ͦͷଞݸผχʔζ΁ͷରԠ ɹɾi18nʢӳޠʣ 33

Slide 34

Slide 34 text

6. IDج൫ࣗମͷΞʔΩςΫνϟվળ ɹɾSakura -> AWS ɹɾk8s 34

Slide 35

Slide 35 text

ࠓޙͳʹ΍͍͔ͬͯ͘ 35

Slide 36

Slide 36 text

WebAuthn/Passkey ΁ͷνϟϨϯδ ɹɾ࣮૷ࡁΈ͕ͩར༻ଅਐ͸͍ͯ͠ͳ͍ ɹɾAutofill ͷಋೖ ɹɾద੾ͳλΠϛϯάͰͷొ࿥΁ͷ༠ಋ ɹɾ”ύεϫʔυϨε” ͷఏڙ 36

Slide 37

Slide 37 text

ΞΧ΢ϯτϦΧόϦͷվળ 37

Slide 38

Slide 38 text

αʔϏεͷಛੑ΍ίϯςΩετʹ߹Θͤͨ ॊೈͳೝূͷఏڙ 38

Slide 39

Slide 39 text

ୀձ·ΘΓͷ Bad UX վળ ɹɾαʔϏεͷୀձͱIdPͷୀձͷѻ͍ ɹɾҰՕॴͰશ෦ୀձ͍͕ͤͨ͞… 39

Slide 40

Slide 40 text

άϧʔϓձࣾͷαʔϏεͱͷID౷߹ 40

Slide 41

Slide 41 text

3rd Party ΁ͷ։์ 41

Slide 42

Slide 42 text

Pull ͔Β Publish (Push) ΁ RISCͷΑ͏ͳ΍ΓํͰ https://openid.net/specs/openid-risc-profile-specification-1_0.html https://developers.google.com/identity/protocols/risc 42

Slide 43

Slide 43 text

ϚϧνΞΧ΢ϯτɺϚϧνηογϣϯ ͜Μͳݴ༿͕͋Δ͔Θ͔ΒΜ͚ͲɺGoogle Έ͍ͨʹ੾Γସ͑ ݸਓͱձࣾͰΞΧ΢ϯτΛ࢖͍෼͚Δਓ޲͚ 43