"Backend Engineer’s meetup ~マイクロサービスにおける認証認可基盤~"の発表資料です。 https://connpass.com/event/142624/
ϚΠΫϩαʔϏεͷ෦௨৴ʹ͓͚Δೝূʹ͍ͭͯ@pospome
View Slide
໊લ: pospomeಡΈํ: ϙεϙϝTwitter: @pospomeઐ:ɹΞϓϦέʔγϣϯΞʔΩςΫνϟɹ࣮ύλʔϯͱ͔DDDͱ͔͕ಘҙͰ͢
ϝϧϖΠೝূج൫νʔϜϝϧΧϦɺϝϧϖΠʹ͓͚ΔೝূೝՄΛ։ൃɺӡ༻͢ΔͨΊͷνʔϜ
ೝূج൫νʔϜʹ͍ͭͯϒϩάॻ͖·ͨ͠https://www.pospome.work/entry/2019/06/12/125841
ݱঢ়ɾϢʔβʔΞΧϯτཧͱϩάΠϯॲཧͦΕͧΕͷνʔϜʹ͍ͤͯΔɻɾϝϧΧϦɺϝϧϖΠͷैۀһͷཧʢೖࣾɺୀ৬ʣOktaʹΑΔπʔϧͷSSOཧ͍ͯ͠ͳ͍ɻ͍ΘΏΔࣾITͷΑ͏ͳ͜ͱ͍ͯ͠ͳ͍ɻɾηΩϡϦςΟ໘ʹؔͯ͠ηΩϡϦςΟνʔϜͱ૬ஊ͍ͯ͠ΔɻɾͦΕҎ֎ͷೝূೝՄҰ௨Γೝূج൫νʔϜ͕୲͍ͯ͠Δɻ
۩ମతʹԿΛ͍ͯ͠Δͷ͔?ɾ֎෦ʹରͯ͠OIDCͳͲͷೝՄͷΈΛఏڙ͢Δɻɾ෦ͷϚΠΫϩαʔϏεؒ௨৴ͷೝূͷΈΛఏڙ͢Δɻ
ࠓ͢ͷ͜Εɾ֎෦ʹରͯ͠OIDCͳͲͷೝՄͷΈΛఏڙ͢Δɻɾ෦ͷϚΠΫϩαʔϏεؒ௨৴ͷೝূͷΈΛఏڙ͢Δɻ
ݱঢ়ͷγεςϜΞʔΩςΫνϟͱϦΫΤετϑϩʔϝϧΧϦΞϓϦύʔτφʔαΠτ3rd PartyGatewayAuthorityServiceXxxServiceYyyServiceMercari API2nd Party
ೝূج൫νʔϜAuthorityServiceͱ͍͏ϚΠΫϩαʔϏεΛ։ൃɾӡ༻͓ͯ͠ΓɺҎԼΛఏڙ͍ͯ͠Δɾ֎෦ʹର͢ΔOIDCͳͲͷೝՄͷΈɾ෦ͷϚΠΫϩαʔϏεؒ௨৴ͷೝূͷΈ
ΫϥΠΞϯτ͔ΒͷϦΫΤετϑϩʔେ͖͚ͯ͘2ͭϝϧΧϦΞϓϦύʔτφʔαΠτ3rd PartyGatewayAuthorityServiceXxxServiceYyyServiceMercari API2nd Party
1.ϝϧΧϦAPIΛར༻͢ΔύλʔϯϝϧΧϦΞϓϦύʔτφʔαΠτ3rd PartyGatewayAuthorityServiceXxxServiceYyyServiceMercari API2nd Party
2.ϚΠΫϩαʔϏεΛར༻͢ΔύλʔϯϝϧΧϦΞϓϦύʔτφʔαΠτ3rd PartyGatewayAuthorityServiceXxxServiceYyyServiceMercari API2nd Party
AuthorityServiceϦΫΤετΛड͚ͯ۩ମతʹԿΛ͍ͯ͠Δͷ͔?ϝϧΧϦΞϓϦύʔτφʔαΠτ3rd PartyGatewayAuthorityServiceXxxServiceYyyServiceMercari API2nd Party
AuthorityServiceԿΛ͍ͯ͠Δͷ͔?1.֎෦͔ΒͷϦΫΤετͷݕূ2.෦௨৴ʹར༻͢Δ෦௨৴༻τʔΫϯͷੜ
ɾࡶʹݴ͏ͱϦΫΤετ͕࣋ͭΞΫηετʔΫϯͱ͔Λݕূ͍ͯ͠ΔɻɾશͯͷϦΫΤετΛAuthorityService͕ݕূͰ͖ΔΘ͚Ͱͳ͍ɻɾϦΫΤετͷݕূ͕ՄೳͳϚΠΫϩαʔϏεʹݕূͯ͠Β͏ɻɾݕূ͕ෆཁͳϦΫΤετݕূ͠ͳ͍ɻɾ֤ϚΠΫϩαʔϏεݕূࡁΈͷϦΫΤετΛड͚औΔɻGatewayAuthorityServiceAaaService BbbService Mercari APIϝϧΧϦΞϓϦύʔτφʔαΠτ3rd Party2nd Party
ɾAuthorityService֎෦͔ΒͷϦΫΤετΛݕূͨ͋͠ͱʹɺ෦༻௨৴τʔΫϯΛੜͯ͠Gatewayʹฦ͍ͯ͠ΔɻɾGateway෦༻௨৴τʔΫϯΛ༩ͨ͠ϦΫΤετΛ֤ϚΠΫϩαʔϏεʹྲྀ͢ɻGatewayAuthorityServiceAaaService BbbService Mercari APIϝϧΧϦΞϓϦύʔτφʔαΠτ3rd Party2nd PartyXxxService෦௨৴༻τʔΫϯΛฦ͢෦௨৴༻τʔΫϯΛ༩ͨ͠ϦΫΤετ
ɾϚΠΫϩαʔϏεؒͷ௨৴ʹ෦௨৴༻τʔΫϯΛར༻͢Δɻɾ෦௨৴༻τʔΫϯ֎෦͔ΒͷϦΫΤετʹར༻͢ΔτʔΫϯͱผͷͷɻɾ֤ϚΠΫϩαʔϏε෦௨৴༻τʔΫϯΛݕূ͢ΔɻϝϧΧϦΞϓϦύʔτφʔαΠτ GatewayAuthorityServiceXxxServiceYyyServiceMercari APIZzzService WwwService3rd Party2nd Party
͜ͷ෦௨৴༻τʔΫϯ͕ϚΠΫϩαʔϏεؒͷ௨৴Λࢧ͍͑ͯΔ
1ϦΫΤετ1τʔΫϯɾAuthorityService1ϦΫΤετ͝ͱʹ1ͭͷτʔΫϯΛੜ͢Δɻɾ֤ϚΠΫϩαʔϏεϦΫΤετͷτʔΫϯΛݕূ͢Δɻ
֤ϚΠΫϩαʔϏε͕ݕূ͢ΔτʔΫϯಉ͡ͷϝϧΧϦΞϓϦύʔτφʔαΠτ GatewayAuthorityServiceXxxServiceYyyServiceMercari APIZzzService WwwService3rd Party2nd Party
෦τʔΫϯJWTΛ࠾༻ɾ֤ϚΠΫϩαʔϏεAuthorityService͕ఏڙ͢Δެ։伴Λऔಘ͠ɺτʔΫϯΛݕূ͢Δɻɾ֤ϚΠΫϩαʔϏεެ։伴ΛΩϟογϡ͢ΔͷͰɺτʔΫϯΛݕূ͢ΔͨΊʹAuthorityServiceʹΞΫηε͢Δඞཁͳ͍ɻɾҙͷΛ࣋ͨͤΔ͜ͱ͕Ͱ͖Δɻ
෦τʔΫϯ༻ͷSDKΛఏڙɾೝূج൫νʔϜ͕ఏڙ͍ͯ͠ΔSDKGoݴޠͷΈɾ֤ϚΠΫϩαʔϏεͰಉ͡ϩδοΫΛॻ͘ඞཁͳ͍
෦τʔΫϯ༻ͷSDK͕ఏڙ͢Δػೳɾ෦τʔΫϯΛݕূ͢ΔgRPCͷintercepter&HTTPͷmiddlewareΛఏڙɾ෦τʔΫϯͷ֤ΫϨʔϜΛ͍͍ײ͡ʹऔಘ͢Δ͜ͱ͕Ͱ͖ΔΈɾgoroutineΛ্ཱͪ͛ͯఆظతʹެ։伴Λऔಘ͠ɺSDK෦ʹΩϟογϡ͢ΔΈΛఏڙ
ෳछྨͷIDΛѻ͑ΔSubjectIDɾ෦τʔΫϯSubjectIDͱ͍͏IDΛ࣋ͭɻɾෳछྨͷIDΛ࣋ͭͷͰͦΕΒΛ1ͭͷIDମܥͰѻ͑ΔΑ͏ʹͨ͠ΈɻɾSubjectIDจࣈྻͰ͋ΓɺType෦ͱValue෦Ͱߏ͞ΕΔɻex. mercari_app:100, partner_site:aaaɾ֤ϚΠΫϩαʔϏεType, ValueʹΑͬͯϦΫΤετͷόϦσʔγϣϯ͕ՄೳʹͳΔɻ
ϚΠΫϩαʔϏεؒͷΞΫηε੍ޚɾϚΠΫϩαʔϏεؒͷ௨৴෦௨৴Ͱ͋Δ͕ɺͦΕΛશʹ৴༻͢ΔͷͰͳ͘ɺదͳΞΫηε੍ޚඞཁʹͳΔɻɾྫ͑ʮܾࡁͱ͍͏ϢʔεέʔεͰTransactionServiceʹͷΈΞΫηεͰ͖Δʯͱ͔ɻɾ࣮ϛεૢ࡞ϛεʹΑΔຊདྷҙਤ͠ͳ͍ΞΫηεΛ͙ɻ
෦είʔϓͱɾΠϝʔδͱͯ͠OIDCͱ͔Ͱར༻͢ΔೝՄείʔϓͷ෦௨৴൛ɻɾϚΠΫϩαʔϏεؒͷΞΫηεΛ੍ޚ͢ΔͨΊͷΈɻɾ෦τʔΫϯ෦είʔϓΛ࣋ͭɻ
෦είʔϓ֤ϚΠΫϩαʔϏε͕࣋ͭϦιʔεʹରͯ͠ఆٛ͢Δɻྫ͑UserService͕Userͱ͍͏ϦιʔεΛ͍࣋ͬͯͨͱ͢Δͱɺ”user”ͱ͍͏෦είʔϓΛఆٛ͢Δɻ͜ΕʹΑΓɺUserServiceͷUserͱ͍͏ϦιʔεʹΞΫηε͢Δʹɺ”user”ͱ͍͏෦είʔϓΛ͍࣋ͬͯΔ෦τʔΫϯ͕ඞཁʹͳΔϝϧΧϦΞϓϦύʔτφʔαΠτ3rd PartyGatewayAuthorityServiceUserServiceMercari APIinternal_scope=“user”
ݱࡏɺ෦είʔϓ3rd Party͔ΒͷϦΫΤετʹରͯ͠ͷΈར༻͍ͯ͠Δɻཧ༝ͱͯ͠3rd Partyʹఏڙ͢ΔΞΫηετʔΫϯʹೝՄείʔϓ͕ඥ͍͍ͮͯΔ͔Βɻˎ3rd Partyʹఏڙ͢ΔΞΫηετʔΫϯʹඥͮ͘ೝՄείʔϓΛ֎෦είʔϓͱݺͼ·͢ɻϝϧΧϦΞϓϦύʔτφʔαΠτ3rd PartyGatewayAuthorityServiceUserServiceMercari APIexternal_scope=“user”
֎෦είʔϓΛͦͷ··෦είʔϓʹηοτ͢Δ͜ͱ͕Ͱ͖ΔɻϝϧΧϦΞϓϦύʔτφʔαΠτ3rd PartyGatewayAuthorityServiceUserServiceMercari APIinternal_scope=“user”external_scope=“user”external_scopeͷΛ෦είʔϓͱͯ͠෦τʔΫϯʹηοτ͢Δ
֎෦είʔϓͱ෦είʔϓ͕Ұக͍ͯ͠ͳ͍߹͕͋ΔϝϧΧϦΞϓϦύʔτφʔαΠτ3rd PartyGatewayAuthorityServiceTransactionServiceMercari APIexternal_scope=“transaction”internal_scope=“transaction”UserServiceinternal_scope=“transaction”
֎෦ΫϥΠΞϯτͷೝՄείʔϓ͕૿͑Δͨͼʹ֤ϚΠΫϩαʔϏεड͚ೖΕՄೳͳείʔϓΛ૿͞ͳ͚ΕͳΒͳ͍ϝϧΧϦΞϓϦύʔτφʔαΠτ3rd PartyGatewayAuthorityServiceListingServiceMercari APIexternal_scope=“listing”internal_scope=“listing”UserServiceinternal_scope=“listing”internal_scope=“transaction”internal_scope=“user”
ຊདྷ͋Δ͖࢟ϝϧΧϦΞϓϦύʔτφʔαΠτύʔτφʔGatewayAuthorityServiceTransactionServiceMercari APIexternal_scope=“transaction”internal_scope=“transaction”UserServiceinternal_scope=“user”
ͳͥ͜͏͍͏͕ى͜Δͷ͔?֎෦είʔϓˠϢʔεέʔεϕʔε෦είʔϓˠϦιʔεϕʔε
AuthorityServiceͰείʔϓಉ࢜ΛϚοϐϯά͢ΔςʔϒϧΛཧ͢Δ͜ͱͰղܾ͢Δ֎෦είʔϓ ෦είʔϓuser usertransaction transaction,userlisting listing,user
AuthorityServiceexternal_scope=“transaction”ʹରԠ͢Δinternal_scope=“transaction”ͱ”user”Λ෦είʔϓʹηοτ͢Δɻ͜ΕʹΑͬͯ෦τʔΫϯ͕TransactionServiceͱUserServiceʹΞΫηεͰ͖ΔΑ͏ʹͳΔɻϝϧΧϦΞϓϦύʔτφʔαΠτ3rd PartyGatewayAuthorityServiceTransactionServiceMercari APIexternal_scope=“transaction”internal_scope=“transaction”UserServiceinternal_scope=“user”external_scope=transaction↓internal_scope=“transaction”, “user”
ͦͷଞͷ෦௨৴༻τʔΫϯͷϝϦοτɾϚΠΫϩαʔϏε͕ѻ͏τʔΫϯΛ1छྨʹͰ͖Δɻɾ֎෦ͷΫϥΠΞϯτ͔ΒϚΠΫϩαʔϏεʹΞΫηε͞ΕΔ͜ͱΛ͙͜ͱ͕Ͱ͖ΔɻɾAuthorityServiceʹΑͬͯݕূࡁΈͷϦΫΤετͰ͋Δ͜ͱΛอূͰ͖Δɻɾ֎෦ͷΫϥΠΞϯτ͕࣋ͭΞΫηετʔΫϯΑΓ͍༗ޮظݶΛઃఆͰ͖Δɻ
ͪΌΜͱͰ͖ͯΔҹΛ͔࣋ͬͨ͠Ε·ͤΜ͕ɺ·ͩ·ͩ՝͋ΔͷͰҾ͖ଓ͖ؤு͍͖ͬͯ·͢ʢ´ɾωɾ`ʣ
͓ΘΓ
pospome
hk_shino
kobayang
takatsunobuhiro
riru
devopstaiwan
k_koheyi
lemon
gawa
miu_crescent
.png){kind=icon}
3playmarketing
gl_tsukasa
opeonikute
mongodb
trallard
ddemaree
smashingmag
rasmusluckow
keathley
carmenintech
soudai
wjessup
dotmariusz
maggiecrowley
tmm1