[B! security][oauth] griefworkerã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

griefworker id:griefworker

securityã¨oauthã«é–¢ã™ã‚‹griefworkerã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

JWTã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å…¥é–€
SECCON Beginners Live 2023ã€ŒJWTã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å…¥é–€ã€ã®ç™ºè¡¨è³‡æ–™ã§ã™ã€‚
griefworker 2023/09/04
security

jwt

oauth
ãƒªãƒ³ã‚¯
OAuth 2.0 / OIDC ã‚’ç†è§£ã™ã‚‹ä¸Šã§é‡è¦ãª3ã¤ã®æŠ€è¡“ä»•æ§˜
2020å¹´3æœˆ17æ—¥ã€æ ªå¼ä¼šç¤¾AuthleteãŒä¸»å‚¬ã™ã‚‹ã€ŒOAuth & OIDC å‹‰å¼·ä¼š ãƒªã‚¿ãƒ¼ãƒ³ã‚ºã€å…¥é–€ç·¨ã€‘ã€ãŒé–‹å‚¬ã€‚åŒç¤¾ã®å…±åŒå‰µæ¥è€…ã§ã‚ã‚Šã€ãƒ—ãƒã‚°ãƒ©ãƒžãƒ¼å…¼ä»£è¡¨å–ç· å½¹ã§ã‚‚ã‚ã‚‹å·å´Žè²´å½¦æ°ãŒã€OAuth 2.0 / OIDCã®ä»•æ§˜ã«ã¤ã„ã¦è§£èª¬ã—ã¾ã—ãŸã€‚ å†’é ã¯ã€OAuth 2.0ã®æ¦‚å¿µã‚„èªå¯ãƒ»èªè¨¼ã¾ã§ã®æµã‚Œã¨ã€ãã‚Œã‚’ç†è§£ã™ã‚‹ä¸Šã§é¿ã‘ã¦ã¯é€šã‚Œãªã„3ã¤ã®æŠ€è¡“ä»•æ§˜ï¼ˆJWSãƒ»JWEãƒ»JWTï¼‰ã«ã¤ã„ã¦ã®è§£èª¬ã§ã™ã€‚ OAuth 2.0ã¨ã¯ å·å´Žè²´å½¦æ°ï¼šæ ªå¼ä¼šç¤¾Authleteã®å·å´Žã§ã™ã€‚æœ¬æ—¥ã¯ã€ŒOAuthã¨OpenID Connectã®å…¥é–€ç·¨ã€ã¨ã„ã†ã“ã¨ã§ã‚ªãƒ³ãƒ©ã‚¤ãƒ³å‹‰å¼·ä¼šã‚’é–‹å‚¬ã—ã¾ã™ã®ã§ã€ã‚ˆã‚ã—ããŠé¡˜ã„ã—ã¾ã™ã€‚æœ€åˆã«OAuth 2.0ã®æ¦‚è¦ã®èª¬æ˜Žã‹ã‚‰ã§ã™ã€‚ ãƒ–ãƒã‚°ã«æ›¸ã„ã¦ã‚ã‚‹å†…å®¹ã¨ä¸€ç·’ãªã‚“ã§ã™ãŒã€ã¾ãšãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ãƒ‡ãƒ¼ã‚¿ãŒã‚ã‚Šã¾ã™ã€‚ã“ã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ãƒ‡ãƒ¼ã‚¿ã‚’ç®¡ç†ã™ã‚‹ã®ãŒã€ãƒªã‚½ãƒ¼ã‚¹ã‚µãƒ¼ãƒãƒ¼ã§ã™ã€‚ã“ã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ãƒ‡
griefworker 2020/05/13
oauth

openid

jwt

security
ãƒªãƒ³ã‚¯
JWT+RDBã‚’ç”¨ã„ãŸOAuth 2.0 ãƒã‚¤ãƒ–ãƒªãƒƒãƒ‰åž‹ãƒˆãƒ¼ã‚¯ãƒ³ã®å®Ÿè£…ä¾‹ - r-weblife
ãŠã¯ã‚ˆã†ã”ã–ã„ã¾ã™ã€ritouã§ã™ã€‚ (âš ï¸èªå¯ã‚¤ãƒ™ãƒ³ãƒˆã®è˜åˆ¥åã®ã‚ãŸã‚Šã€ã¡ã‚‡ã£ã¨è¦‹ç›´ã—ã¾ã—ãŸï¼æœ€åˆã«è¦‹ã¦ã„ãŸã ã„ãŸæ–¹ã¯ã‚‚ã†ä¸€å›žã©ã†ãžï¼) å‰å›žã€ãƒã‚¤ãƒ–ãƒªãƒƒãƒ‰åž‹ã¨å‘¼ã°ã‚Œã‚‹ OAuth 2.0 ã®ãƒˆãƒ¼ã‚¯ãƒ³å®Ÿè£…ã«ã¤ã„ã¦æ›¸ãã¾ã—ãŸã€‚ ritou.hatena blog.com ãã®ç¶šãã¨ã—ã¦ JWT(JWS) + RDBã§ã§ãã‚‹å®Ÿè£…ä¾‹ã‚’ç´¹ä»‹ã—ã¾ã™ã€‚ ç†è§£ã™ã‚‹ã«ã¯ãã‚Œãªã‚Šã® OAuth 2.0 ã«é–¢ã™ã‚‹çŸ¥è˜ãŒå¿…è¦ã«ãªã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ãŒã€ã‚ˆã‹ã£ãŸã‚‰å‚è€ƒã«ã—ã¦ã¿ã¦ãã ã•ã„ã€‚ ä½•ã‚’è€ƒãˆãŸã®ã‹ OAuth 2.0ã®Refresh Token, Access Tokenã‚’è€ƒãˆã¾ã™ã€‚ è¦ä»¶ã‹ã‚‰æ•´ç†ã—ã¾ã—ã‚‡ã†ã€‚ è¦ä»¶ çµæ§‹ã‚ã‚Šã¾ã™ãŒã€æœ€ä½Žé™ã® OAuth 2.0 ã® Authorization Server ã‚’å®Ÿè£…ã—ã‚ˆã†ã¨æ€ã£ãŸã‚‰ã“ã‚Œãã‚‰ã„ã¯ã‚„ã‚‰ãªã„ã¨ã„ã‘ãªã„ã§ã—ã‚‡ã†ã€‚ RFC6750 ã§å®šç¾©ã•ã‚Œã¦ã„ã‚‹ Bear
griefworker 2020/05/08
jwt

oauth

security
ãƒªãƒ³ã‚¯
OAuth 2.0 ã®å‹‰å¼·ã®ãŸã‚ã«èªå¯ã‚µãƒ¼ãƒãƒ¼ã‚’è‡ªä½œã™ã‚‹ - Qiita
é€†ã«ã€RFC 6749 ä»¥å¤–ã§å®šç¾©ã•ã‚Œã¦ã„ã‚‹èªå¯ãƒ•ãƒãƒ¼ã‚’ã‚µãƒãƒ¼ãƒˆã™ã‚‹å ´åˆã€æ–°ãŸã«åˆ¥ã®ã‚¨ãƒ³ãƒ‰ãƒã‚¤ãƒ³ãƒˆã®å®Ÿè£…ãŒå¿…è¦ã«ãªã‚‹ã“ã¨ãŒã‚ã‚Šã¾ã™ã€‚ä¾‹ãˆã° CIBAï¼ˆClient Initiated Backchannel Authenticationï¼‰ã§ã¯**ãƒãƒƒã‚¯ãƒãƒ£ãƒãƒ«èªè¨¼ã‚¨ãƒ³ãƒ‰ãƒã‚¤ãƒ³ãƒˆï¼ˆbackchannel authentication endpointï¼‰ã€ãƒ‡ãƒã‚¤ã‚¹ãƒ•ãƒãƒ¼ï¼ˆRFC 8628ï¼‰ã§ã¯ãƒ‡ãƒã‚¤ã‚¹èªå¯ã‚¨ãƒ³ãƒ‰ãƒã‚¤ãƒ³ãƒˆ**ï¼ˆdevice authorization endpointï¼‰ã®å®Ÿè£…ãŒæ±‚ã‚ã‚‰ã‚Œã¾ã™ã€‚ ã“ã®è¨˜äº‹ã§ã¯ã€èªå¯ã‚¨ãƒ³ãƒ‰ãƒã‚¤ãƒ³ãƒˆã¨ãƒˆãƒ¼ã‚¯ãƒ³ã‚¨ãƒ³ãƒ‰ãƒã‚¤ãƒ³ãƒˆã‚’å®Ÿè£…ã—ã¾ã™ã€‚ã‚µãƒãƒ¼ãƒˆã™ã‚‹èªå¯ãƒ•ãƒãƒ¼ã¯èªå¯ã‚³ãƒ¼ãƒ‰ãƒ•ãƒãƒ¼ã®ã¿ã€ã‚µãƒãƒ¼ãƒˆã™ã‚‹ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãƒ»ã‚¿ã‚¤ãƒ—ã¯ãƒ‘ãƒ–ãƒªãƒƒã‚¯ã®ã¿ã¨ã—ã¾ã™ã€‚ 2. æ³¨æ„ç‚¹ ä¸‹è¨˜ã®ç†ç”±ã€ãŠã‚ˆã³æ›¸ã‹ã‚Œã¦ã„ãªã„ãã®ä»–ã®ç†ç”±ã«ã‚ˆã‚Šã€æœ¬å®Ÿè£…ã¯å•†ç”¨åˆ©ç”¨ã«ã¯é©ã—ã¦ã„ã¾ã›ã‚“ã€‚ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
griefworker 2019/10/29
oauth

security
ãƒªãƒ³ã‚¯
OAuth 2.0 + OpenID Connect ã®ãƒ•ãƒ«ã‚¹ã‚¯ãƒ©ãƒƒãƒå®Ÿè£…è€…ãŒçŸ¥è¦‹ã‚’èªžã‚‹
èªè¨¼ã¯å˜ç´”ãªæ¦‚å¿µã§ã€åˆ¥ã®è¨€è‘‰ã§è¨€ãˆã°æœ¬äººç¢ºèªã§ã™ã€‚Web ã‚µã‚¤ãƒˆã«ãŠã‘ã‚‹æœ¬äººç¢ºèªã®æœ€ã‚‚ä¸€èˆ¬çš„ãªæ–¹æ³•ã¯ ID ã¨ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®çµ„ã‚’æç¤ºã—ã¦ã‚‚ã‚‰ã†ã“ã¨ã§ã™ãŒã€æŒ‡ç´‹ã‚„è™¹å½©ãªã©ã®ç”Ÿä½“æƒ…å ±ã‚’ç”¨ã„ãŸæœ¬äººç¢ºèªæ–¹æ³•ã‚‚ã‚ã‚Šãˆã¾ã™ã€‚ã©ã®ã‚ˆã†ãªç¢ºèªæ–¹æ³•ã ã¨ã—ã¦ã‚‚ (ãƒ¯ãƒ³ã‚¿ã‚¤ãƒ ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’ä½¿ã£ãŸã‚Šã€2-way èªè¨¼ã ã£ãŸã‚Šã—ã¦ã‚‚)ã€èªè¨¼ã¨ã¯ã€èª°ãªã®ã‹ã‚’ç‰¹å®šã™ã‚‹ãŸã‚ã®å‡¦ç†ã§ã™ã€‚é–‹ç™ºè€…ã®è¨€è‘‰ã§ã“ã‚Œã‚’è¡¨ç¾ã™ã‚‹ã¨ã€ã€Œèªè¨¼ã¨ã¯ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ä¸€æ„è˜åˆ¥åã‚’ç‰¹å®šã™ã‚‹å‡¦ç†ã€ã¨è¨€ãˆã¾ã™ã€‚ ä¸€æ–¹ã€èªå¯ã®ã»ã†ã¯ã€ã€Œèª°ãŒã€ã€ã€Œèª°ã«ã€ã€ã€Œä½•ã®æ¨©é™ã‚’ã€ã€ã¨ã„ã†ä¸‰ã¤ã®è¦ç´ ãŒå‡ºã¦ãã‚‹ãŸã‚ã€è¤‡é›‘ã«ãªã‚Šã¾ã™ã€‚åŠ ãˆã¦ã€è©±ã‚’ã‚„ã‚„ã“ã—ãã—ã¦ã„ã‚‹ã®ã¯ã€ã“ã®ä¸‰ã¤ã®è¦ç´ ã®ã†ã¡ã€ã€Œèª°ãŒã€ã‚’æ±ºã‚ã‚‹å‡¦ç†ãŒã€Œèªè¨¼å‡¦ç†ã€ã§ã‚ã‚‹ã¨ã„ã†ç‚¹ã§ã™ã€‚ã™ãªã‚ã¡ã€èªå¯å‡¦ç†ã«ã¯ãã®ä¸€éƒ¨ã¨ã—ã¦èªè¨¼å‡¦ç†ãŒå«ã¾ã‚Œã¦ã„ã‚‹ãŸã‚ã€è©±ãŒã‚„ã‚„ã“ã—ããªã£ã¦ã„ã‚‹ã®ã§ã™ã€‚ èªå¯ã®ä¸‰è¦ç´ ã‚’ã‚‚ã†å°‘ã—ç¾å ´ã«è¿‘ã„è¨€è‘‰ã§è¡¨
griefworker 2017/03/31
oauth

security

openid
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
griefworker 2014/07/26
security

oauth
ãƒªãƒ³ã‚¯
1