[B! èªè¨¼] NetPenguinã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

NetPenguin id:NetPenguin

èªè¨¼ã«é–¢ã™ã‚‹NetPenguinã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (4)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Keycloak
Single-Sign On Users authenticate with Keycloak rather than individual applications. This means that your applications don't have to deal with login forms, authenticating users, and storing users. Once logged-in to Keycloak, users don't have to login again to access a different application. This also applies to logout. Keycloak provides single-sign out, which means users only have to logout once t
NetPenguin 2019/09/27
IdP

keycloak

openid

SAML

èªè¨¼
ãƒªãƒ³ã‚¯
WebAuthnã§ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãƒ¬ã‚¹ãªã‚µã‚¤ãƒˆã‚’ä½œã‚‹ã€‚å®‰å…¨ãªã‚ªãƒ³ãƒ©ã‚¤ãƒ³èªè¨¼ã‚’å°Žå…¥ã™ã‚‹FIDOã®åŸºæœ¬ - ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢Hubï½œWebã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®ã‚ãƒ£ãƒªã‚¢ã‚’è€ƒãˆã‚‹ï¼
WebAuthnã§ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãƒ¬ã‚¹ãªã‚µã‚¤ãƒˆã‚’ä½œã‚‹ã€‚å®‰å…¨ãªã‚ªãƒ³ãƒ©ã‚¤ãƒ³èªè¨¼ã‚’å°Žå…¥ã™ã‚‹FIDOã®åŸºæœ¬ FIDOï¼ˆFastÂ IDentityÂ Onlineï¼‰ã¨ã¯ã€å…¬é–‹éµèªè¨¼æ–¹å¼ã‚’å¿œç”¨ã—ã€ã‚ªãƒ³ãƒ©ã‚¤ãƒ³çµŒç”±ã§èªè¨¼ã‚’è¡Œã†ä»•çµ„ã¿ã§ã™ã€‚ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰èªè¨¼ã®å®‰å…¨æ€§ã¯é™ç•ŒãŒæŒ‡æ‘˜ã•ã‚Œã‚‹ãªã‹ã€Webã‚µã‚¤ãƒˆã«ãŠã„ã¦ã‚‚ç”Ÿä½“èªè¨¼ãªã©ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãƒ¬ã‚¹ãªä»•çµ„ã¿ã‚’å°Žå…¥ã™ã‚‹ä¼æ¥ãŒå¢—ãˆã¦ãŠã‚Šã€ã“ã®FIDOã‚„WebAuthnã«æ³¨ç›®ãŒé›†ã¾ã£ã¦ã„ã¾ã™ã€‚Capyæ ªå¼ä¼šç¤¾ã§æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«é–¢ã™ã‚‹ç ”ç©¶é–‹ç™ºã‚„åˆ†æžãªã©ã«æºã‚ã‚‹ã€æ¾æœ¬æ‚¦å®œã•ã‚“ã®è§£èª¬ã§ã™ã€‚ ã“ã‚“ã«ã¡ã¯ã€æ¾æœ¬æ‚¦å®œï¼ˆ@ym405nmï¼‰ã§ã™ã€‚ FIDOï¼ˆãµãã„ã©ï¼‰ã«é–¢ã—ã¦ã¯ã€æ˜¨å¹´ï¼ˆ2018å¹´ï¼‰ã‹ã‚‰å¤šãã®ãƒ¡ãƒ‡ã‚£ã‚¢ã‚„æŠ€è¡“ãƒ–ãƒã‚°ã§å–ã‚Šä¸Šã’ã‚‰ã‚Œã€å°Žå…¥ã™ã‚‹Webã‚µã‚¤ãƒˆã‚‚å¢—ãˆã¦ã„ã¾ã™ã€‚ FIDO2ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã«ãŠã„ã¦è©±é¡Œã«ãªã£ãŸWebAuthnï¼ˆWeb Authentication APIï¼‰ã«ã¤ã„ã¦ã‚‚ã€ä¸»ãªW
NetPenguin 2019/08/14
èªè¨¼

FIDO

WebAuthn
ãƒªãƒ³ã‚¯
OAuth 2.0 + OpenID Connect ã®ãƒ•ãƒ«ã‚¹ã‚¯ãƒ©ãƒƒãƒå®Ÿè£…è€…ãŒçŸ¥è¦‹ã‚’èªžã‚‹
èªè¨¼ã¯å˜ç´”ãªæ¦‚å¿µã§ã€åˆ¥ã®è¨€è‘‰ã§è¨€ãˆã°æœ¬äººç¢ºèªã§ã™ã€‚Web ã‚µã‚¤ãƒˆã«ãŠã‘ã‚‹æœ¬äººç¢ºèªã®æœ€ã‚‚ä¸€èˆ¬çš„ãªæ–¹æ³•ã¯ ID ã¨ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®çµ„ã‚’æç¤ºã—ã¦ã‚‚ã‚‰ã†ã“ã¨ã§ã™ãŒã€æŒ‡ç´‹ã‚„è™¹å½©ãªã©ã®ç”Ÿä½“æƒ…å ±ã‚’ç”¨ã„ãŸæœ¬äººç¢ºèªæ–¹æ³•ã‚‚ã‚ã‚Šãˆã¾ã™ã€‚ã©ã®ã‚ˆã†ãªç¢ºèªæ–¹æ³•ã ã¨ã—ã¦ã‚‚ (ãƒ¯ãƒ³ã‚¿ã‚¤ãƒ ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’ä½¿ã£ãŸã‚Šã€2-way èªè¨¼ã ã£ãŸã‚Šã—ã¦ã‚‚)ã€èªè¨¼ã¨ã¯ã€èª°ãªã®ã‹ã‚’ç‰¹å®šã™ã‚‹ãŸã‚ã®å‡¦ç†ã§ã™ã€‚é–‹ç™ºè€…ã®è¨€è‘‰ã§ã“ã‚Œã‚’è¡¨ç¾ã™ã‚‹ã¨ã€ã€Œèªè¨¼ã¨ã¯ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ä¸€æ„è˜åˆ¥åã‚’ç‰¹å®šã™ã‚‹å‡¦ç†ã€ã¨è¨€ãˆã¾ã™ã€‚ ä¸€æ–¹ã€èªå¯ã®ã»ã†ã¯ã€ã€Œèª°ãŒã€ã€ã€Œèª°ã«ã€ã€ã€Œä½•ã®æ¨©é™ã‚’ã€ã€ã¨ã„ã†ä¸‰ã¤ã®è¦ç´ ãŒå‡ºã¦ãã‚‹ãŸã‚ã€è¤‡é›‘ã«ãªã‚Šã¾ã™ã€‚åŠ ãˆã¦ã€è©±ã‚’ã‚„ã‚„ã“ã—ãã—ã¦ã„ã‚‹ã®ã¯ã€ã“ã®ä¸‰ã¤ã®è¦ç´ ã®ã†ã¡ã€ã€Œèª°ãŒã€ã‚’æ±ºã‚ã‚‹å‡¦ç†ãŒã€Œèªè¨¼å‡¦ç†ã€ã§ã‚ã‚‹ã¨ã„ã†ç‚¹ã§ã™ã€‚ã™ãªã‚ã¡ã€èªå¯å‡¦ç†ã«ã¯ãã®ä¸€éƒ¨ã¨ã—ã¦èªè¨¼å‡¦ç†ãŒå«ã¾ã‚Œã¦ã„ã‚‹ãŸã‚ã€è©±ãŒã‚„ã‚„ã“ã—ããªã£ã¦ã„ã‚‹ã®ã§ã™ã€‚ èªå¯ã®ä¸‰è¦ç´ ã‚’ã‚‚ã†å°‘ã—ç¾å ´ã«è¿‘ã„è¨€è‘‰ã§è¡¨
NetPenguin 2017/06/01
OpenID Connect

openid

OAuth

oauth2

èªè¨¼
ãƒªãƒ³ã‚¯
ãƒ¢ãƒã‚¤ãƒ«ã‚¢ãƒ—ãƒªã®ãƒ¦ãƒ¼ã‚¶èªè¨¼æ–¹æ³•ã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã¿ãŸ - Qiita
è¿½è¨˜ (2018-10-08) 4å¹´ä»¥ä¸Šå‰ã«æ›¸ã„ãŸè¨˜äº‹ã§ã™ãŒã€Access Token ã¨ã—ã¦ JWT ã‚’åˆ©ç”¨ã™ã‚‹ã“ã¨ã¯éžæŽ¨å¥¨ãªã‚ˆã†ãªã®ã§ã€ãŠè©«ã³ã—ã¦ä¿®æ£è‡´ã—ã¾ã™ã€‚ å‚è€ƒ: ã©ã†ã—ã¦ãƒªã‚¹ã‚¯ã‚¢ã‚»ã‚¹ãƒ¡ãƒ³ãƒˆã›ãšã« JWT ã‚’ã‚»ãƒƒã‚·ãƒ§ãƒ³ã«ä½¿ã£ã¡ã‚ƒã†ã‚ã‘ï¼Ÿ æ¦‚è¦ ã¿ã‚“ãªã‚„ã£ã¦ã‚‹ã¯ãšãªã‚“ã ã‘ã©ã€ã‚ã¾ã‚Šã¾ã¨ã¾ã£ãŸæƒ…å ±ãŒãªã‹ã£ãŸã®ã§æ›¸ã„ã¦ã¿ã¾ã™ã€‚èªè¨¼å‘¨ã‚Šã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’æ°—ã«ã—ã¦ã€ã¿ã‚“ãªæ›¸ããŸãŒã‚‰ãªã„ã®ã‹ãªï¼Ÿãã‚Œã¨ã‚‚ç§ã®èª¿ã¹æ–¹ãŒæ‚ªã‹ã£ãŸã ã‘ï¼Ÿãƒžã‚µã‚«ãƒªãŠå¾…ã¡ã—ã¦ã¾ã™ã€‚ èªè¨¼ã®åŸºæœ¬æ–¹é‡ +--------+ +--------+ | | | | | |----(1) Credential ------------>| | | | | | | |<---(2) Access Token -----------| | | | | | | Client | | Server | | | | | | |----(3)
NetPenguin 2016/06/27
OAuth

OAuth2

èªè¨¼
ãƒªãƒ³ã‚¯
1