コンシューマ向けサービスで使われている 認証認可仕様とデジタル署名 / saloff1-ritou

658c29959d8a9fd352afa440a5813137?s=47 ritou
June 19, 2019

コンシューマ向けサービスで使われている 認証認可仕様とデジタル署名 / saloff1-ritou

658c29959d8a9fd352afa440a5813137?s=128

ritou

June 19, 2019
Tweet

Transcript

  1. 2.

    ͍ͱ͏Γΐ͏ • (ג)ϛΫγΟ ΤϯδχΞ - Identity / Platform • OpenID

    ϑΝ΢ϯσʔγϣϯɾδϟύϯ ΤόϯδΣϦετ(2߸ػ) • Blog : ritou.hatenablog.com • Twitter : @ritou (ळాͷೣ) • ˌidcon, #iddance !2
  2. 6.

    OAuth 2.0 RFC 6749/6750 (2012/10~) • RFC 6749 : τʔΫϯϕʔεͷϦιʔεΞΫηεͷ͘͠Έ

    • ొ৔ਓ෺͸Client, Server, Resource Owner ͷ3ऀ • Client͕Resource OwnerͷύεϫʔυͳͲΛѻΘͳ͍(※) • RFC 6750 : Bearer TokenͰAPIΞΫηε͢Δํ๏ • ΞΫηετʔΫϯͷऔಘํ๏ • ΞΫηετʔΫϯΛ༻͍ͨAPIΞΫηεํ๏ !6
  3. 9.

    Կ͕ߦΘΕͨͷ͔ʁ !9 3FTPVSDF0XOFS $MJFOU 4FSWFS  *OTUBHSBN࿈ܞΛ ༗ޮԽ͢Δ *OTUBHSBNͷը૾ ΁ͷΞΫηεݖݶΛཁٻ

    ΞΫηε͕ڐՄ͞Εͨ͜ͱΛ௨஌ ̏ ͸ͯͳϒϩάʹΑΔ *OTUBHSBNͷը૾΁ͷΞΫηεΛ Ϣʔβʔ͕ڐՄ
  4. 11.
  5. 12.

    OAuth 2.0ͷτʔΫϯͱ༻్ !12 • Access Token - APIΞΫηε • Refresh

    Token - Access Tokenߋ৽ • Authorization Code - Access Token / Refresh Tokenऔಘ
  6. 13.

    ͍ΘΏΔOAuthೝূ (OAuth as a Authentication) !13 • OAuth 2.0ͰϓϩϑΟʔϧAPI͔ΒϢʔβʔࣝผࢠ Λऔಘ͠ɺೝূػೳʹར༻

    • ౷Ұ͞Ε͍ͯͳ͍ϓϩϑΟʔϧAPI • Native ApplicationͱόοΫΤϯυαʔόʔؒͷΞΫηετʔ ΫϯͷϋϯυϦϯά
  7. 14.

    OpenID Connect (2014/2~) !14 • ʮʙͰϩάΠϯʯ(ID࿈ܞ)ͷͨΊͷ࢓༷ • OAuth 2.0Λ֦ு •

    ID Token - ೝূΠϕϯτͷ৘ใΛ΍ΓऔΓ • Userinfo Endpoint - ඪ४తͳϓϩϑΟʔϧAPI • Self-Issued OP - ୺຤্Ͱಈ࡞͢ΔOpenID Provider
  8. 15.

    !15

  9. 16.

    OpenID Connect - ID Token !16 • ೝূΠϕϯτͷ৘ใΛ֨ೲ • JSON

    Web Signatureܗࣜ • ϢʔβʔɺRPɺೝূཁٻͷ৘ใΛ֨ೲ • OP͕࣋ͭൿີ伴Ͱॺ໊ • RP͸ެ։伴ͰݕূՄೳ
  10. 17.

    OAuth 2.0/OIDC஀ੜޙͷมԽ !17 • Ϣʔεέʔε • Client : Web App

    -> Native App(Hybrid) -> Single Page App etc… • Server : monolith -> microservices • ྖҬ • SNS࿈ܞɺιʔγϟϧϩάΠϯ -> ܾࡁɺۚ༥ɺϔϧεέΞ جຊػೳ͚ͩͰ͸ཁ͕݅ຬͨͤͳ͍৔߹΋
  11. 18.

    !18

  12. 19.

    Security Considerations • RFCs • 6819 : OAuth 2.0 Threat

    Model and Security Considerations • 8252 : OAuth 2.0 for Native Apps • Draft • OAuth 2.0 Security Best Current Practice • OAuth 2.0 for Browser-Based Apps !19
  13. 20.

    Financial-grade API (FAPI) • ΦϯϥΠϯͷۚ༥αʔϏεʹ͓͚ΔOAuth 2.0/OIDC ͷ࣮૷ΨΠυϥΠϯ • Part 1:

    Read-Only API Security Profile - ࢀরܥ • Part 2: Read and Write API Security Profile - ߋ৽ܥ • Client Initiated Backchannel Authentication Profile (CIBA) - Client؀ڥͱೝূσόΠεͷ෼཭ !20
  14. 25.

    WebAuthn !25 • FIDO2 : WebΞϓϦέʔγϣϯ͔Β΋FIDO • WebAuthn (Web Authentication

    API) • FIDOΛར༻͢ΔαʔϏε͕ݺͼग़͢JavaScript API • CTAP • ηΩϡϦςΟΩʔͱ΍ΓͱΓ͢ΔͨΊͷ࢓༷ɺϒϥ΢β͕࣮૷
  15. 26.

    WebAuthn - ొ৔ਓ෺ !26 • Relying Party : WebΞϓϦ •

    Authenticator : ηΩϡϦςΟΩʔɺσόΠε • Client : Webϒϥ΢β
  16. 27.

    WebAuthn - ొ࿥ϑϩʔ !27 1. ొ࿥༻ύϥϝʔλ࡞੒
 (RP৘ใ,Ϣʔβʔ৘ใ, ϩʔΧϧೝূͷ༗ແͳͲ) 3. Authenticator/Platform

    ͷػೳΛݺͼग़͢ 2. JS APIͷݺͼग़͠ 4.ϩʔΧϧೝূ 伴ϖΞੜ੒ ॺ໊࡞੒ 5. ৽͍͠ެ։伴ͱॺ໊ 6. JS API͔Βͷ໭Γ஋ 7.֤छݕূ ެ։伴ͷอଘ Authenticator (SecurityKey etc…) Client (ϒϥ΢β) Relying Party
  17. 28.

    WebAuthn - ೝূϑϩʔ !28 1. ೝূ༻ύϥϝʔλ࡞੒
 (ެ։伴৘ใ,ϩʔΧϧೝ ূͷ༗ແͳͲ) 3. Authenticator/Platform

    ͷػೳΛݺͼग़͢ 2. JS APIͷݺͼग़͠ 4.ϩʔΧϧೝূ ॺ໊࡞੒ 5. ॺ໊ 6. JS API͔Βͷ໭Γ஋ 7.֤छݕূ ೝূ׬ྃॲཧ Authenticator (SecurityKey etc…) Client (ϒϥ΢β) Relying Party
  18. 31.

    FIDOͷϑΟογϯά଱ੑ !31 ϑΟογϯάϝʔϧɺ ϝοηʔδ ϑΟογϯάαΠτ ʢFYBNQMFJOGPʣ ਖ਼نͷαΠτ FYBNQMFDPN *%ύεϫʔυ 

    Ξαʔγϣϯ ॺ໊ͳͲ औಘͨ͠ *%ύεϫʔυ  Ξαʔγϣϯ !31 PSJHJO୯ҐͰ伴ϖΞΛ ੜ੒͍ͯ͠ΔͷͰ ϑΟογϯάαΠτʹ ϩάΠϯͰ͖ͳ͍ ϑΟογϯάαΠτ޲͚ͷ ΞαʔγϣϯΛਖ਼نͷαΠτʹ ૹͬͯ΋ݕূࣦഊ͢Δ