Upgrade to Pro — share decks privately, control downloads, hide ads and more …

認証認可

yosi
August 09, 2022

 認証認可

yosi

August 09, 2022
Tweet

More Decks by yosi

Other Decks in Programming

Transcript

  1. ೝূɾೝՄ
    2021/7/2(ۚ)ɹদా޾య

    View Slide

  2. ࠓճ࣮ࡍʹௐ΂ͯΈͯ,,,
    • ·ͣɺೝূೝՄͷ࿩͸Ԟ͕ਂ͍ʂʂʂ


    • ௐ΂͍ͯ͘͏ͪʹOAuth΍OpenID ConnectͳͲ৭ʑग़ͯ͘Δ


    • ೝূೝՄʁϩάΠϯͷ͜ͱ΍Ζʁ,,

    View Slide

  3. ೝূͱೝՄʹ͍ͭͯ
    ೝূɹ(Authentication)
    • ௨৴ͷ૬ख͕୭(Կ)Ͱ͋Δ͜ͱ͔Λ֬ೝ͢Δ͜ͱ


    • ੒Γࡁ·͠Ͱͳ͍͜ͱΛ֬ೝ͢Δ͜ͱ
    ೝՄɹ(Authorization)
    • ಛఆͷ৚݅ʹରͯ͠ɺϦιʔεΞΫηεݖݶΛ༩͑Δ͜ͱ

    → ݖݶΛ༩͑Δ͜ͱ

    View Slide

  4. ೝূͱೝՄ HTTP statusͷ࿩
    ೝূɹ(Authentication)
    • 401 Unauthorized —ɹೝূͷࣦഊ


    • ʮ͓·͑୭ͩΑʯ
    ݴ༿͸ࣅͯΔ͚Ͳผͷ֓೦!
    ೝՄɹ(Authorization)
    • 403 Forbidden — ೝՄͷෆ଍


    • ʮཧղͨ͠ɺ͕ͩஅΔʯ

    View Slide

  5. ೝূͷ࿩
    ೝূɹ(Authentication)
    • ௨৴૬खͷID(ଐੑ)ΛͳΓ͢·͠Ͱ͸ͳ͍͜ͱΛ֬৴͢Δ͜ͱ
    ೝূཁૉ ݱ࣮ͷੈք ిࢠͷੈք
    ͋ͳͨ͸ͩΕʁ إɺ੠ɺॺ໊ච੻ ੜମೝূ(ࢦ໲ɺ੠໲ೝূ)
    ԿΛ΋ͬͯΔͷʁ ҹؑɺ਎෼ূ໌ॻɺΧʔυ
    ɹܞଳి࿩,ిࢠূ໌ॻ,

    ηΩϡϦςΟʔτʔΫϯ
    ͋ͳͨ͸ͩΕʁ ߹ݴ༿ ύεϫʔυ

    View Slide

  6. 伴(key) ৣ(lock)

    View Slide

  7. ೝՄ ͷ࿩
    ೝՄɹ(Authorization)
    • ୭͔ʹ 伴Λ౉͢͜ͱɻ
    • ྫ͑͹৐ं݊


    • ੾ූΛ࣋ͬͯೖΕ͹ɺిंʹ৐ΕΔɻͳ͚Ε͹৐Εͳ͍ɻ
    • ೝՄʹ਎ݩ֬ೝ͸ඞਢͰ͸ͳ͍

    伴΍੾ූ͔Βʮ୭͔ʯ͸Θ͔Βͳ͍

    View Slide

  8. 1.Ϣʔβʔʹʮ伴(key)ʯΛ༩͑Δɻ
    2.Ϧιʔεʹʮৣ(lock)ʯΛ͔͚Δɻ
    3.ΞΫηε࣌ʹ伴Λ࢖ͬͯղৣ͢Δɻ
    ϙϦγʔఆٛ
    ϙϦγʔࢪߦ

    View Slide

  9. ΞΫηετʔΫϯ
    ɾೝূࡁΈϢʔβʔΛࣝผ͢ΔͨΊͷจࣈྻɻ


    ɾτʔΫϯɾɾɾʮূڌʯʮ͠Δ͠ʯʮ৅௃ʯ

    View Slide

  10. ೝূͱೝՄ ͷີ݁߹ͷ࿩
    ೝূɹ(Authentication)ɹͱɹೝՄɹ(Authorization)
    ɾ૬ख͸A͞Μͩʂ ͔ͩΒΞΫηεڐՄ


    ɾ૬ख͸A͞ΜͰͳ͍! ΞΫηε͸ڐՄ͞Εͳ͍

    ɾΞΫηε͕ڐՄ͞Εͨɺͭ·ΓA͞Μ(!?)


    ɾΞΫηε͕ڐՄ͞Εͳ͔ͬͨɺͭ·ΓA͞ΜͰͳ͍
    →͜ͷ༷ʹೝূͱೝՄͷɺٯɾཪɾରۮ͕ग़ͯ͘Δɻ

    View Slide

  11. ೝূͱೝՄ ͷ࿩
    • ೝূʹجͮ͘ೝՄ

    ͜Ε͕ଟ͘ͷਓ͕ߟ͑Δύλʔϯɻ

    ྫʣӡస໔ڐॻͳͲ͕͍͍ྫɻ

    • ೝՄʹجͮ͘ೝূ(!?)

    ྫ) ͜ͷਓ͸A͞ΜͷՈͷ伴Λ࣋ͬͯΔ͔ΒɺA͞ΜͩͶ

    →͜Εͷߟ͕͑OAuthೝূͷߟ͑ʹͭͳ͕Δɻ

    View Slide