コンシューマ向けサービスで使われている 認証認可仕様とデジタル署名 / saloff1-ritou

Transcript

1. ίϯγϡʔϚ޲͚αʔϏεͰ࢖ΘΕ͍ͯΔ ೝূೝՄ࢓༷ͱσδλϧॺ໊ ͍ͱ͏
   Γΐ͏
   !SJUPV
   
   αϧΦϑ
   
   ॺ໊ϒλ໺࿠͸ೝূઌഐͷເΛݟͳ͍
   

2. ͍ͱ͏Γΐ͏ • (ג)ϛΫγΟ ΤϯδχΞ - Identity / Platform • OpenID

   ϑΝ΢ϯσʔγϣϯɾδϟύϯ ΤόϯδΣϦετ(2߸ػ) • Blog : ritou.hatenablog.com • Twitter : @ritou (ळాͷೣ) • ˌidcon, #iddance !2

3. ຊ೔ͷ಺༰ • ೝূपΓͰ࢖ΘΕ͍ͯΔ/͜Ε͔Β࢖ΘΕͦ͏ͳ࢓༷ Λ঺հ • σδλϧॺ໊ͷ࢖ΘΕͲ͜Ζʢ͞ΘΓ͚ͩʣ !3

4. ೝূೝՄपΓͷΩʔϫʔυ • OAuth 2.0 & OpenID Connect • WebAuthn /

   FIDO !4

5. OAuth 2.0 & OpenID Connect

6. OAuth 2.0 RFC 6749/6750 (2012/10~) • RFC 6749 : τʔΫϯϕʔεͷϦιʔεΞΫηεͷ͘͠Έ

   • ొ৔ਓ෺͸Client, Server, Resource Owner ͷ3ऀ • Client͕Resource OwnerͷύεϫʔυͳͲΛѻΘͳ͍(※) • RFC 6750 : Bearer TokenͰAPIΞΫηε͢Δํ๏ • ΞΫηετʔΫϯͷऔಘํ๏ • ΞΫηετʔΫϯΛ༻͍ͨAPIΞΫηεํ๏ !6

7. OAuth 2.0ར༻ྫ ͸ͯͳϒϩάͷInstagram࿈ܞ !7

8. OAuth 2.0ར༻ྫ ͸ͯͳϒϩάͷInstagram࿈ܞ !8

9. Կ͕ߦΘΕͨͷ͔ʁ !9 3FTPVSDF
   0XOFS $MJFOU 4FSWFS  *OTUBHSBN࿈ܞΛ ༗ޮԽ͢Δ 
   *OTUBHSBN
   ͷը૾ ΁ͷΞΫηεݖݶΛཁٻ

   
   ΞΫηε͕ڐՄ͞Εͨ͜ͱΛ௨஌ ̏ 
   ͸ͯͳϒϩάʹΑΔ *OTUBHSBNͷը૾΁ͷΞΫηεΛ Ϣʔβʔ͕ڐՄ

10. !10 IUUQTUXJUUFSDPNLVSB@MBCTUBUVT "VUIPSJ[BUJPO
    $PEF
    'MPX *NQMJDJU
    'MPX

11. None

12. OAuth 2.0ͷτʔΫϯͱ༻్ !12 • Access Token - APIΞΫηε • Refresh

    Token - Access Tokenߋ৽ • Authorization Code - Access Token / Refresh Tokenऔಘ

13. ͍ΘΏΔOAuthೝূ (OAuth as a Authentication) !13 • OAuth 2.0ͰϓϩϑΟʔϧAPI͔ΒϢʔβʔࣝผࢠ Λऔಘ͠ɺೝূػೳʹར༻

    • ౷Ұ͞Ε͍ͯͳ͍ϓϩϑΟʔϧAPI • Native ApplicationͱόοΫΤϯυαʔόʔؒͷΞΫηετʔ ΫϯͷϋϯυϦϯά

14. OpenID Connect (2014/2~) !14 • ʮʙͰϩάΠϯʯ(ID࿈ܞ)ͷͨΊͷ࢓༷ • OAuth 2.0Λ֦ு •

    ID Token - ೝূΠϕϯτͷ৘ใΛ΍ΓऔΓ • Userinfo Endpoint - ඪ४తͳϓϩϑΟʔϧAPI • Self-Issued OP - ୺຤্Ͱಈ࡞͢ΔOpenID Provider

15. !15

16. OpenID Connect - ID Token !16 • ೝূΠϕϯτͷ৘ใΛ֨ೲ • JSON

    Web Signatureܗࣜ • ϢʔβʔɺRPɺೝূཁٻͷ৘ใΛ֨ೲ • OP͕࣋ͭൿີ伴Ͱॺ໊ • RP͸ެ։伴ͰݕূՄೳ

17. OAuth 2.0/OIDC஀ੜޙͷมԽ !17 • Ϣʔεέʔε • Client : Web App

    -> Native App(Hybrid) -> Single Page App etc… • Server : monolith -> microservices • ྖҬ • SNS࿈ܞɺιʔγϟϧϩάΠϯ -> ܾࡁɺۚ༥ɺϔϧεέΞ جຊػೳ͚ͩͰ͸ཁ͕݅ຬͨͤͳ͍৔߹΋

18. !18

19. Security Considerations • RFCs • 6819 : OAuth 2.0 Threat

    Model and Security Considerations • 8252 : OAuth 2.0 for Native Apps • Draft • OAuth 2.0 Security Best Current Practice • OAuth 2.0 for Browser-Based Apps !19

20. Financial-grade API (FAPI) • ΦϯϥΠϯͷۚ༥αʔϏεʹ͓͚ΔOAuth 2.0/OIDC ͷ࣮૷ΨΠυϥΠϯ • Part 1:

    Read-Only API Security Profile - ࢀরܥ • Part 2: Read and Write API Security Profile - ߋ৽ܥ • Client Initiated Backchannel Authentication Profile (CIBA) - Client؀ڥͱೝূσόΠεͷ෼཭ !20

21. OAuth/OIDCͱσδλϧॺ໊ • ίΞͳ࢓༷ • ID Tokenͷੜ੒ɺݕূ • ͦͷଞɺ֤छϦΫΤετ/ϨεϙϯεͷอޢʹJWSͳͲΛ ར༻͢Δ֦ு͕͋Δ •

    Clientೝূ • ೝূ(ೝՄཁٻ) !21

22. WebAuthn / FIDO Ϣʔβʔೝূͷ͓࿩

23. ύεϫʔυೝূ !23 • ཁ͕݅ຬͨ͞ΕΔͳΒ͹ࢸߴͷೝূํࣜ • هԱετϨʔδͷར༻ʹΑΔՄൖੑ • αʔϏε͝ͱʹҟͳΔɺਪଌࠔ೉ͳจࣈྻ • ϑΟογϯάରࡦ

    • ࿙Ӯηʔϑͳ؅ཧ • ݱঢ় : ཁ݅Λຬͨͤͳ͍Ϣʔβʔ/αʔϏε……

24. FIDO !24 • ϩʔΧϧೝূΛར༻ • ύεϫʔυΛૹΒͳ͍ • (ੜମೝূʹݶΒͣ)༷ʑͳೝূํࣜͱͷ૊Έ߹Θ͕ͤՄೳ • ެ։伴҉߸ํࣜ

    • ొ࿥ : ॺ໊ͱެ։伴৘ใΛૹ৴ • ೝূ : ॺ໊Λૹ৴

25. WebAuthn !25 • FIDO2 : WebΞϓϦέʔγϣϯ͔Β΋FIDO • WebAuthn (Web Authentication

    API) • FIDOΛར༻͢ΔαʔϏε͕ݺͼग़͢JavaScript API • CTAP • ηΩϡϦςΟΩʔͱ΍ΓͱΓ͢ΔͨΊͷ࢓༷ɺϒϥ΢β͕࣮૷

26. WebAuthn - ొ৔ਓ෺ !26 • Relying Party : WebΞϓϦ •

    Authenticator : ηΩϡϦςΟΩʔɺσόΠε • Client : Webϒϥ΢β

27. WebAuthn - ొ࿥ϑϩʔ !27 1. ొ࿥༻ύϥϝʔλ࡞੒
 (RP৘ใ,Ϣʔβʔ৘ใ, ϩʔΧϧೝূͷ༗ແͳͲ) 3. Authenticator/Platform

    ͷػೳΛݺͼग़͢ 2. JS APIͷݺͼग़͠ 4.ϩʔΧϧೝূ 伴ϖΞੜ੒ ॺ໊࡞੒ 5. ৽͍͠ެ։伴ͱॺ໊ 6. JS API͔Βͷ໭Γ஋ 7.֤छݕূ ެ։伴ͷอଘ Authenticator (SecurityKey etc…) Client (ϒϥ΢β) Relying Party

28. WebAuthn - ೝূϑϩʔ !28 1. ೝূ༻ύϥϝʔλ࡞੒
 (ެ։伴৘ใ,ϩʔΧϧೝ ূͷ༗ແͳͲ) 3. Authenticator/Platform

    ͷػೳΛݺͼग़͢ 2. JS APIͷݺͼग़͠ 4.ϩʔΧϧೝূ ॺ໊࡞੒ 5. ॺ໊ 6. JS API͔Βͷ໭Γ஋ 7.֤छݕূ ೝূ׬ྃॲཧ Authenticator (SecurityKey etc…) Client (ϒϥ΢β) Relying Party

29. FIDOͷϢʔεέʔε !29 • ύεϫʔυϨεͳೝূํࣜͱͯ͠ (ॴ࣋+ϩʔΧϧೝূ) • 2ஈ֊/2ཁૉ໨ͷೝূํࣜͱͯ͠ (ॴ࣋) • ॏཁͳॲཧͷલͷຊਓ֬ೝͱͯ͠

30. ̎ஈ֊(ཁૉ)ೝূͱϑΟογϯά !30 ϑΟογϯάϝʔϧɺ ϝοηʔδ ϑΟογϯάαΠτ ʢFYBNQMFJOGPʣ ਖ਼نͷαΠτ FYBNQMFDPN 
    *%ύεϫʔυ
    
    

    ϫϯλΠϜ
    ύεϫʔυ 
    औಘͨ͠
    *%ύεϫʔυ
    
    ϫϯλΠϜ
    ύεϫʔυ !30

31. FIDOͷϑΟογϯά଱ੑ !31 ϑΟογϯάϝʔϧɺ ϝοηʔδ ϑΟογϯάαΠτ ʢFYBNQMFJOGPʣ ਖ਼نͷαΠτ FYBNQMFDPN 
    *%ύεϫʔυ
    
    

    Ξαʔγϣϯ ॺ໊ͳͲ 
    औಘͨ͠
    *%ύεϫʔυ
    
    Ξαʔγϣϯ !31 PSJHJO୯ҐͰ伴ϖΞΛ
    ੜ੒͍ͯ͠ΔͷͰ
    ϑΟογϯάαΠτʹ
    ϩάΠϯͰ͖ͳ͍ ϑΟογϯάαΠτ޲͚ͷ
    ΞαʔγϣϯΛਖ਼نͷαΠτʹ ૹͬͯ΋ݕূࣦഊ͢Δ

32. WebAuthn/FIDOͱσδλϧॺ໊ !32 • ొ࿥/ೝূϑϩʔͷνϟϨϯδ/Ϩεϙϯεͷݕূ • ެ։伴৘ใΛ༻͍ͯॺ໊ݕূ • Authenticator ͷਅਖ਼ੑͷݕূ •

    ূ໌ॻνΣʔϯͷݕূ