OpenID Connect入門 #openid #technight

1.

2.

3.

4.

5.

6.

7.

8.

9.

用語説明 OAuth2.0 Client Authorization Server Resource Owner Authorization Request Authorization Response OpenID Connect Relying Part(RP) OpenID Provider(OP) Identity Provider(IdP) End-User Authentication Request Authentication Response Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 9

10.

用語説明 OAuth2.0 Client Authorization Server Resource Owner Authorization Request Authorization Response OpenID Connect Relying Part(RP) OpenID Provider(OP) Identity Provider(IdP) End-User Authentication Request Authentication Response Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 10

11.

12.

13.

14.

15.

OPに登録しているEnd-Userの属性情報をRPへ連携補完なし連絡用メールアドレスパスワードパスワードを表示郵便番号生年月日名前性別男性女性その他回答しない補完あり [email protected] パスワードパスワードを表示 000-0000 1970/01/01 矢風太郎性別男性女性その他回答しない Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 15

16.

17.

18.

19.

OpenID Connect仕様 OpenID Connect Core 1.0 incorporating errata set 1 Abstract OpenID Connect 1.0 は, OAuth 2.0 プロトコルの上にシンプルなアイデンティティレイヤーを付与したものである。このプロトコルは Client が Authorization Server の認証結果に基づいて End-User のアイデンティティを検証可能にする。また同時に End-User の必要最低限のプロフィール情報を、相互運用可能かつ RESTFUL な形で取得することも可能にする。この仕様は, OpenID Connect の主要な機能である OAuth 2.0 上で End-User の情報伝達のために Claim を用いる認証機能を定義する。この仕様はまた, OpenID Connect を利用するための Security, Privacy Considerations を説明する。 Table of Contents 1. Introduction 1.1. Requirements Notation and Conventions 1.2. Terminology 1.3. Overview 2. ID Token 3. Authentication 3.1. Authentication using the Authorization Code Flow 3.1.1. Authorization Code Flow Steps 3.1.2. Authorization Endpoint 3.1.2.1. Authentication Request 3.1.2.2. Authentication Request Validation 3.1.2.3. Authorization Server Authenticates End-User 3.1.2.4. Authorization Server Obtains End-User Consent/Authorization 3.1.2.5. Successful Authentication Response 3.1.2.6. Authentication Error Response 3.1.2.7. Authentication Response Validation http://openid-foundation-japan.github.io/openid-connect-core-1_0ja.html OpenID Connect Core 1.0 incorporating errata set 1 Abstract OpenID Connect 1.0 is a simple identity layer on top of the OAuth 2.0 protocol. It enables Clients to verify the identity of the End-User based on the authentication performed by an Authorization Server, as well as to obtain basic profile information about the End-User in an interoperable and REST-like manner. This specification defines the core OpenID Connect functionality: authentication built on top of OAuth 2.0 and the use of Claims to communicate information about the End-User. It also describes the security and privacy considerations for using OpenID Connect. Table of Contents 1. Introduction 1.1. Requirements Notation and Conventions 1.2. Terminology 1.3. Overview 2. ID Token 3. Authentication 3.1. Authentication using the Authorization Code Flow 3.1.1. Authorization Code Flow Steps 3.1.2. Authorization Endpoint 3.1.2.1. Authentication Request 3.1.2.2. Authentication Request Validation 3.1.2.3. Authorization Server Authenticates End-User 3.1.2.4. Authorization Server Obtains End-User Consent/Authorization 3.1.2.5. Successful Authentication Response 3.1.2.6. Authentication Error Response 3.1.2.7. Authentication Response Validation https://openid.net/specs/openid-connect-core-1_0.html Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 19

20.

21.

22.

OpenID Connectをとりまく仕様 OpenID Connect Protocol Suite 4 Feb 2014 http://openid.net/connect Core Minimal Discovery Dynamic Client Registration Dynamic Session Management Form Post Response Mode Complete Underpinnings OAuth 2.0 Core OAuth 2.0 Bearer OAuth 2.0 Assertions OAuth 2.0 JWT Profile OAuth 2.0 Responses JWT JWS JWE JWK JWA WebFinger 引用 https://openid.net/connect/ Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 22

23.

OpenID Connectをとりまく仕様 OpenID Connect Protocol Suite 4 Feb 2014 http://openid.net/connect Core Minimal Discovery Dynamic Client Registration Dynamic Session Management Form Post Response Mode Complete Underpinnings OAuth 2.0 Core OAuth 2.0 Bearer OAuth 2.0 Assertions OAuth 2.0 JWT Profile OAuth 2.0 Responses JWT JWS JWE JWK JWA WebFinger 引用 https://openid.net/connect/ Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 23

24.

OpenID Certification • OpenID Connectを実装した事業者に対して標準仕様に適合しているかどうかをテスト • テストに合格するとOpenID Foundation からOpenID Certified Markが付与 • OP用とRP用の両方存在 Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 24

25.

OpenID Certification VMware Workspace ONE 18-Apr- 2018 18-Apr- 2018 18-Apr- 2018 WidasConcepts cidaas 2.0 11-Apr- 2018 19-Apr- 2018 16-Apr- 2018 11-Apr- 2018 Matias Woloski Auth0 6-Feb- 2016 8-Feb- 2016 WSO2 Identity Server 5.4.0 15-Jan- 2018 15-Jan- 2018 20-Jul- 2018 20-Jul- 2018 Yahoo! Japan Yahoo! ID Federation v2 7-Dec- 2016 7-Dec- 2016 7-Dec- 2016 7-Dec- 2016 引用 https://openid.net/certification/ Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 25

26.

まとめ • OpenID Connect=認可 + 認証+属性取得 • シングルサインオン・属性情報補完 • OpenID Connect仕様 • CoreとRFC6749,RFC6750,RFC7519を押さえておくと • ID TokenとUserInfo Endpointがメイン • OpenID Certification • テストを通過すれば仕様に準拠した証が発行 Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 26

27.

28.

29.

30.

31.

Authentication Request GET /authorize? response_type=code &scope=openid%20profile%20email &client_id=s6BhdRkqt3 &state=af0ifjsldkj &nonce=n-oS6_WzA2Mj &redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb HTTP/1.1 Host: server.example.com Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 31

32.

Authentication Request GET /authorize? response_type=code &scope=openid%20profile%20email &client_id=s6BhdRkqt3 &state=af0ifjsldkj &nonce=n-oS6_WzA2Mj &redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb HTTP/1.1 Host: server.example.com openid必須 Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 32

33.

Authentication Request GET /authorize? response_type=code &scope=openid%20profile%20email &client_id=s6BhdRkqt3 &state=af0ifjsldkj &nonce=n-oS6_WzA2Mj &redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb HTTP/1.1 Host: server.example.com UserInfo Endpointで取得したい属性情報を指定 Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 33

34.

Authentication Request GET /authorize? response_type=code &scope=openid%20profile%20email &client_id=s6BhdRkqt3 &state=af0ifjsldkj &nonce=n-oS6_WzA2Mj &redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb HTTP/1.1 Host: server.example.com CSRF対策のランダム文字列セッションに紐づけて保存 Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 34

35.

Authentication Request GET /authorize? response_type=code &scope=openid%20profile &client_id=s6BhdRkqt3 &state=af0ifjsldkj &nonce=n-oS6_WzA2Mj &redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb HTTP/1.1 Host: server.example.com リプレイアタック対策のランダム文字列セッションに紐づけて保存 Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 35

36.

Authentication Request GET /authorize? response_type=code &scope=openid%20profile%20email &client_id=s6BhdRkqt3 &state=af0ifjsldkj &nonce=n-oS6_WzA2Mj &redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb HTTP/1.1 Host: server.example.com redirect_uriが必須 Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 36

37.

38.

39.

Authentication Response HTTP/1.1 302 Found Location: https://client.example.org/cb? 認可コードがクエリパラメータに付与 code=SplxlOBeZQQyBYS6WxSbIA &state=af0ifjsldkj Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 39

40.

Authentication Response HTTP/1.1 302 Found Location: https://client.example.org/cb? リクエスト時に保存したstate値と一致するか検証 code=SplxlOBeZQQyBYS6WxSbIA &state=af0ifjsldkj Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 40

41.

42.

Token Request POST /token HTTP/1.1 Host: server.example.com Content-Type: application/x-www-form-urlencoded Authorization: Basic cZzCaGRSa3F0MzpNWDfmQmF0M2JW Basic認証でクライアント認証 grant_type=authorization_code &code=SplxlOBeZQQyBYS6WxSbIA &redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 42

43.

Token Request POST /token HTTP/1.1 Host: server.example.com Content-Type: application/x-www-form-urlencoded Authorization: Basic cZzCaGRSa3F0MzpNWDfmQmF0M2JW 先ほど受け取った Authorization Codeを指定 grant_type=authorization_code &code=SplxlOBeZQQyBYS6WxSbIA &redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 43

44.

45.

[beta]

Token Response
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store
Pragma: no-cache
{
"access_token": "SIAV32hkKG",
"token_type": "Bearer",
"refresh_token": "8xLOxBtZp8",
"expires_in": 3600,
"id_token":
"eyJhbGciOiJSUzI1NiIsImtpZCI6IjFhOWdkayJ9.ewogImlzcyI6ICJodHRwOi8vc2VyZXIuZXhhbXBsZS5jb20iLAogInN1YiI6ICIyNDgyODk3NjEwMDEiLAogImF1ZCI6ICJzNmJoZFJrcXQzIiwKICJub25jZSI6ICJuLW9TNl9XekEyTWoiLAogImV4cCI6IDEzMTEyODE5NzAsCiAiaWF0IjogMTMxMTI4MDk3MAp9.AkfQ.ggW8hZ1EuVLuxNuuIJKX_V8a_OMXzR0EHR9R6jg
dqrOOF4daGU96Sr_P6q Jp6IcmD3HP99Obi1PRs-cwh3LO-
p146waJ8IhehcwL7F09JdijmbQkvPeB2T9CJNqeGpe-
gccMg4vfKjkM8FcGvnzZUN4_KSP0aAp1tOJ1zZwgjxqGByKHiOtX7TpdQyHE5lcMiKPXfEIQILVq0pc_E2
DzL7emopWoaoZTF_m0_N0YzFC6g6EJbOEoRoSK
K5hoDalrcvRYLSrQAZZkflyuVCyixeOv9GfNQC3_osjzw2PAithfubEEBLuVVk4
XUVrWOLrLl0nx7RkKU8NXNHq-rvKMzqg"
}
Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 45

46.

[beta]

Token Response
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store
Pragma: no-cache
{
"access_token": "SIAV32hkKG",
"token_type": "Bearer",
"refresh_token": "8xLOxBtZp8",
"expires_in": 3600,
"id_token":
"eyJhbGciOiJSUzI1NiIsImtpZCI6IjFhOWdkayJ9.ewogImlzcyI6ICJodHRwOi8vc2VyZXIuZXhhbXBsZS5jb20iLAogInN1YiI6ICIyNDgyODk3NjEwMDEiLAogImF1ZCI6ICJzNmJoZFJrcXQzIiwKICJub25jZSI6ICJuLW9TNl9XekEyTWoiLAogImV4cCI6IDEzMTEyODE5NzAsCiAiaWF0IjogMTMxMTI4MDk3MAp9.AkfQ.ggW8hZ1EuVLuxNuuIJKX_V8a_OMXzR0EHR9R6jg
dqrOOF4daGU96Sr_P6q Jp6IcmD3HP99Obi1PRs-cwh3LO-
p146waJ8IhehcwL7F09JdijmbQkvPeB2T9CJNqeGpe-
gccMg4vfKjkM8FcGvnzZUN4_KSP0aAp1tOJ1zZwgjxqGByKHiOtX7TpdQyHE5lcMiKPXfEIQILVq0pc_E2
DzL7emopWoaoZTF_m0_N0YzFC6g6EJbOEoRoSK
K5hoDalrcvRYLSrQAZZkflyuVCyixeOv9GfNQC3_osjzw2PAithfubEEBLuVVk4
XUVrWOLrLl0nx7RkKU8NXNHq-rvKMzqg"
}
ID Tokenを
取得・検証
Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 46

47.

End-User RP OP UserInfo Endpoint Start Authentication Request Login・Consent Authentication Response Token Request Token Response UserInfo Request Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 47

48.

49.

50.

End-User RP OP UserInfo Endpoint Start Authentication Request Login・Consent Authentication Response Token Request Token Response UserInfo Request UserInfo Response Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 50

51.

[beta]

UserInfo Response
HTTP/1.1 200 OK
Content-Type: application/json
{
"sub": "248289761001",
"name": "Jane Doe",
"given_name": "Jane",
"family_name": "Doe",
"preferred_username": "j.doe",
"picture": "http://example.com/janedoe/me.jpg",
"email": "[email protected]",
"email_verified": true
}
Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 51

52.

[beta]

UserInfo Response
HTTP/1.1 200 OK
Content-Type: application/json
{
"sub": "248289761001",
"name": "Jane Doe",
"given_name": "Jane",
"family_name": "Doe",
"preferred_username": "j.doe",
"picture": "http://example.com/janedoe/me.jpg",
"email": "[email protected]",
"email_verified": true
}
openid
Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 52

53.

[beta]

UserInfo Response
HTTP/1.1 200 OK
Content-Type: application/json
{
"sub": "248289761001",
"name": "Jane Doe",
"given_name": "Jane",
"family_name": "Doe",
"preferred_username": "j.doe",
"picture": "http://example.com/janedoe/me.jpg",
"email": "[email protected]",
"email_verified": true
}
profile
Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 53

54.

[beta]

UserInfo Response
HTTP/1.1 200 OK
Content-Type: application/json
{
"sub": "248289761001",
"name": "Jane Doe",
"given_name": "Jane",
"family_name": "Doe",
"preferred_username": "j.doe",
"picture": "http://example.com/janedoe/me.jpg",
"email": "[email protected]",
"email_verified": true
}
email
Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 54

55.

まとめ • Authentication Request • scopeにopenid必須 • redirect_uri必須 • nonceが任意で追加 • Authentication Response • 変更なし • Token Request • 変更なし • Token Response • ID Tokenが追加、ID Tokenの検証が必要 • UserInfo Request • アクセストークンを乗せてリクエスト • UserInfo Response • scopeに応じた属性情報が取得可能 Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 55

56.

57.

ID Token eyJhbGciOiJSUzI1NiIsImtpZCI6IjFhOWdkayJ9.ewogImlzcyI6ICJodHRwOi8vc2VyZXIuZXhhbXBsZS5jb20iLAogInN1YiI6ICIyNDgyODk3NjEwMDEiLAogImF1ZCI6ICJzNmJoZFJrcXQzIiwKICJub25jZSI6ICJuLW9TNl9XekEyTWoiLAogImV4cCI6IDEzMTEyODE5NzAsCiAiaWF0IjogMTMxMTI4MDk3MAp9.AkfQ.ggW8hZ1EuVLuxNuuIJKX_V8a_OMXzR0EHR9R6jg dqrOOF4daGU96Sr_P6q Jp6IcmD3HP99Obi1PRs-cwh3LO- p146waJ8IhehcwL7F09JdijmbQkvPeB2T9CJNqeGpe- gccMg4vfKjkM8FcGvnzZUN4_KSP0aAp1tOJ1zZwgjxqGByKHiOtX7TpdQyHE5lcMiKPXfEIQILVq0pc_E2 DzL7emopWoaoZTF_m0_N0YzFC6g6EJbOEoRoSK K5hoDalrcvRYLSrQAZZkflyuVCyixeOv9GfNQC3_osjzw2PAithfubEEBLuVVk4 XUVrWOLrLl0nx7RkKU8NXNHq-rvKMzqg Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 57

58.

ID Token eyJhbGciOiJSUzI1NiIsImtpZCI6IjFhOWdkayJ9.ewogImlzcyI6ICJodHRwOi8vc2VyZXIuZXhhbXBsZS5jb20iLAogInN1YiI6ICIyNDgyODk3NjEwMDEiLAogImF1ZCI6ICJzNmJoZFJrcXQzIiwKICJub25jZSI6ICJuLW9TNl9XekEyTWoiLAogImV4cCI6IDEzMTEyODE5NzAsCiAiaWF0IjogMTMxMTI4MDk3MAp9.AkfQ.ggW8hZ1EuVLuxNuuIJKX_V8a_OMXzR0EHR9R6jg dqrOOF4daGU96Sr_P6q Jp6IcmD3HP99Obi1PRs-cwh3LO- p146waJ8IhehcwL7F09JdijmbQkvPeB2T9CJNqeGpe- gccMg4vfKjkM8FcGvnzZUN4_KSP0aAp1tOJ1zZwgjxqGByKHiOtX7TpdQyHE5lcMiKPXfEIQILVq0pc_E2 DzL7emopWoaoZTF_m0_N0YzFC6g6EJbOEoRoSK K5hoDalrcvRYLSrQAZZkflyuVCyixeOv9GfNQC3_osjzw2PAithfubEEBLuVVk4 XUVrWOLrLl0nx7RkKU8NXNHq-rvKMzqg JWT Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 58

59.

60.

ID Token eyJhbGciOiJSUzI1NiIsImtpZCI6IjFhOWdkayJ9.ewogImlzcyI6ICJodHRwOi8vc2VyZXIuZXhhbXBsZS5jb20iLAogInN1YiI6ICIyNDgyODk3NjEwMDEiLAogImF1ZCI6ICJzNmJoZFJrcXQzIiwKICJub25jZSI6ICJuLW9TNl9XekEyTWoiLAogImV4cCI6IDEzMTEyODE5NzAsCiAiaWF0IjogMTMxMTI4MDk3MAp9.AkfQ.ggW8hZ1EuVLuxNuuIJKX_V8a_OMXzR0EHR9R6jg dqrOOF4daGU96Sr_P6q Jp6IcmD3HP99Obi1PRs-cwh3LO- p146waJ8IhehcwL7F09JdijmbQkvPeB2T9CJNqeGpe- gccMg4vfKjkM8FcGvnzZUN4_KSP0aAp1tOJ1zZwgjxqGByKHiOtX7TpdQyHE5lcMiKPXfEIQILVq0pc_E2 DzL7emopWoaoZTF_m0_N0YzFC6g6EJbOEoRoSK K5hoDalrcvRYLSrQAZZkflyuVCyixeOv9GfNQC3_osjzw2PAithfubEEBLuVVk4 XUVrWOLrLl0nx7RkKU8NXNHq-rvKMzqg Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 60

61.

[beta]

JWTのデコード
JWT
Debugger
Libraries
Introduction
Ask
Get a T-shirt!
Crafted by
Auth0
Encoded
PASTE A TOKEN HERE
eyJhbGciOiJSUzI1NiIsImtpZCI6IjFhOWdkayJ9.ewogImlzcyI6ICJodHRwOi8vc2VyZXIuZXhhbXBsZS5jb20iLAogInN1YiI6ICIyNDgyODk3NjEwMDEiLAogImF1ZCI6ICJzNmJoZFJrcXQzIiwKICJub25jZSI6ICJuLW9TNl9XekEyTWoiLAogImV4cCI6IDEzMTEyODE5NzAsCiAiaWF0IjogMTMxMTI4MDk3MAp9.AkfQ.ggW8hZ1EuVLuxNuuIJKX_V8a_OMXzR0EHR9R6jg
dqrOOF4daGU96Sr_P6q Jp6IcmD3HP99Obi1PRs-cwh3LO-
p146waJ8IhehcwL7F09JdijmbQkvPeB2T9CJNqeGpe-
gccMg4vfKjkM8FcGvnzZUN4_KSP0aAp1tOJ1zZwgjxqGByKHiOtX7TpdQyHE5lcMiKPXfEIQILVq0pc_E2
DzL7emopWoaoZTF_m0_N0YzFC6g6EJbOEoRoSK
K5hoDalrcvRYLSrQAZZkflyuVCyixeOv9GfNQC3_osjzw2PAithfubEEBLuVVk4
XUVrWOLrLl0nx7RkKU8NXNHq-rvKMzqg
Decoded
EDIT THE PAYLOAD AND SECRET
HEADER: ALGORITHM & TOKEN TYPE
{
"alg": "RS256",
"kid": "1e9gdk7"
}
PAYLOAD: DATA
{
"iss": "http://server.example.com",
"sub": "248289761001",
"aud": "s6BhdRkqt3",
"nonce": "n-oS6_WzA2Mj",
"exp": 1311281970,
"iat": 1311280970
}
VERIFY SIGNATURE
RSASHA256(
base64UrlEncode(header) + "." +
base64UrlEncode(payload),
https://jwt.io
Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 61

62.

[beta]

JWTのデコード
JWT
Debugger
Libraries
Introduction
Ask
Get a T-shirt!
Crafted by
Auth0
Encoded
PASTE A TOKEN HERE
eyJhbGciOiJSUzI1NiIsImtpZCI6IjFhOWdkayJ9.ewogImlzcyI6ICJodHRwOi8vc2VyZXIuZXhhbXBsZS5jb20iLAogInN1YiI6ICIyNDgyODk3NjEwMDEiLAogImF1ZCI6ICJzNmJoZFJrcXQzIiwKICJub25jZSI6ICJuLW9TNl9XekEyTWoiLAogImV4cCI6IDEzMTEyODE5NzAsCiAiaWF0IjogMTMxMTI4MDk3MAp9.AkfQ.ggW8hZ1EuVLuxNuuIJKX_V8a_OMXzR0EHR9R6jg
dqrOOF4daGU96Sr_P6q Jp6IcmD3HP99Obi1PRs-cwh3LO-
p146waJ8IhehcwL7F09JdijmbQkvPeB2T9CJNqeGpe-
gccMg4vfKjkM8FcGvnzZUN4_KSP0aAp1tOJ1zZwgjxqGByKHiOtX7TpdQyHE5lcMiKPXfEIQILVq0pc_E2
DzL7emopWoaoZTF_m0_N0YzFC6g6EJbOEoRoSK
K5hoDalrcvRYLSrQAZZkflyuVCyixeOv9GfNQC3_osjzw2PAithfubEEBLuVVk4
XUVrWOLrLl0nx7RkKU8NXNHq-rvKMzqg
Decoded
EDIT THE PAYLOAD AND SECRET
HEADER: ALGORITHM & TOKEN TYPE
{
"alg": "RS256",
"kid": "1e9gdk7"
}
PAYLOAD: DATA
{
"iss": "http://server.example.com",
"sub": "248289761001",
"aud": "s6BhdRkqt3",
"nonce": "n-oS6_WzA2Mj",
"exp": 1311281970,
"iat": 1311280970
}
VERIFY SIGNATURE
RSASHA256(
base64UrlEncode(header) + "." +
base64UrlEncode(payload),
https://jwt.io
ヘッダには署名に関する情報
Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 62

63.

[beta]

JWTのデコード
JWT
Debugger
Libraries
Introduction
Ask
Get a T-shirt!
Crafted by
Auth0
Encoded
PASTE A TOKEN HERE
eyJhbGciOiJSUzI1NiIsImtpZCI6IjFhOWdkayJ9.ewogImlzcyI6ICJodHRwOi8vc2VyZXIuZXhhbXBsZS5jb20iLAogInN1YiI6ICIyNDgyODk3NjEwMDEiLAogImF1ZCI6ICJzNmJoZFJrcXQzIiwKICJub25jZSI6ICJuLW9TNl9XekEyTWoiLAogImV4cCI6IDEzMTEyODE5NzAsCiAiaWF0IjogMTMxMTI4MDk3MAp9.AkfQ.ggW8hZ1EuVLuxNuuIJKX_V8a_OMXzR0EHR9R6jg
dqrOOF4daGU96Sr_P6q Jp6IcmD3HP99Obi1PRs-cwh3LO-
p146waJ8IhehcwL7F09JdijmbQkvPeB2T9CJNqeGpe-
gccMg4vfKjkM8FcGvnzZUN4_KSP0aAp1tOJ1zZwgjxqGByKHiOtX7TpdQyHE5lcMiKPXfEIQILVq0pc_E2
DzL7emopWoaoZTF_m0_N0YzFC6g6EJbOEoRoSK
K5hoDalrcvRYLSrQAZZkflyuVCyixeOv9GfNQC3_osjzw2PAithfubEEBLuVVk4
XUVrWOLrLl0nx7RkKU8NXNHq-rvKMzqg
Decoded
EDIT THE PAYLOAD AND SECRET
HEADER: ALGORITHM & TOKEN TYPE
{
"alg": "RS256",
"kid": "1e9gdk7"
}
PAYLOAD: DATA
{
"iss": "http://server.example.com",
"sub": "248289761001",
"aud": "s6BhdRkqt3",
"nonce": "n-oS6_WzA2Mj",
"exp": 1311281970,
"iat": 1311280970
}
VERIFY SIGNATURE
RSASHA256(
base64UrlEncode(header) + "." +
base64UrlEncode(payload),
https://jwt.io
ヘッダには署名に関する情報
{
"alg": "RS256",
"kid": "1e9gdk7"
}
Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 63

64.

[beta]

JWTのデコード
JWT
Debugger
Libraries
Introduction
Ask
Get a T-shirt!
Crafted by
Auth0
Encoded
PASTE A TOKEN HERE
eyJhbGciOiJSUzI1NiIsImtpZCI6IjFhOWdkayJ9.ewogImlzcyI6ICJodHRwOi8vc2VyZXIuZXhhbXBsZS5jb20iLAogInN1YiI6ICIyNDgyODk3NjEwMDEiLAogImF1ZCI6ICJzNmJoZFJrcXQzIiwKICJub25jZSI6ICJuLW9TNl9XekEyTWoiLAogImV4cCI6IDEzMTEyODE5NzAsCiAiaWF0IjogMTMxMTI4MDk3MAp9.AkfQ.ggW8hZ1EuVLuxNuuIJKX_V8a_OMXzR0EHR9R6jg
dqrOOF4daGU96Sr_P6q Jp6IcmD3HP99Obi1PRs-cwh3LO-
p146waJ8IhehcwL7F09JdijmbQkvPeB2T9CJNqeGpe-
gccMg4vfKjkM8FcGvnzZUN4_KSP0aAp1tOJ1zZwgjxqGByKHiOtX7TpdQyHE5lcMiKPXfEIQILVq0pc_E2
DzL7emopWoaoZTF_m0_N0YzFC6g6EJbOEoRoSK
K5hoDalrcvRYLSrQAZZkflyuVCyixeOv9GfNQC3_osjzw2PAithfubEEBLuVVk4
XUVrWOLrLl0nx7RkKU8NXNHq-rvKMzqg
Decoded
EDIT THE PAYLOAD AND SECRET
HEADER: ALGORITHM & TOKEN TYPE
{
"alg": "RS256",
"kid": "1e9gdk7"
}
PAYLOAD: DATA
{
"iss": "http://server.example.com",
"sub": "248289761001",
"aud": "s6BhdRkqt3",
"nonce": "n-oS6_WzA2Mj",
"exp": 1311281970,
"iat": 1311280970
}
VERIFY SIGNATURE
RSASHA256(
base64UrlEncode(header) + "." +
base64UrlEncode(payload),
https://jwt.io
ペイロードにはClaimが含まれる
Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 64

65.

[beta]

JWTのデコード
JWT
Debugger
Libraries
Introduction
Ask
Get a T-shirt!
Crafted by
Auth0
Encoded
PASTE A TOKEN HERE
eyJhbGciOiJSUzI1NiIsImtpZCI6IjFhOWdkayJ9.ewogImlzcyI6ICJodHRwOi8vc2VyZXIuZXhhbXBsZS5jb20iLAogInN1YiI6ICIyNDgyODk3NjEwMDEiLAogImF1ZCI6ICJzNmJoZFJrcXQzIiwKICJub25jZSI6ICJuLW9TNl9XekEyTWoiLAogImV4cCI6IDEzMTEyODE5NzAsCiAiaWF0IjogMTMxMTI4MDk3MAp9.AkfQ.ggW8hZ1EuVLuxNuuIJKX_V8a_OMXzR0EHR9R6jg
dqrOOF4daGU96Sr_P6q Jp6IcmD3HP99Obi1PRs-cwh3LO-
p146waJ8IhehcwL7F09JdijmbQkvPeB2T9CJNqeGpe-
gccMg4vfKjkM8FcGvnzZUN4_KSP0aAp1tOJ1zZwgjxqGByKHiOtX7TpdQyHE5lcMiKPXfEIQILVq0pc_E2
DzL7emopWoaoZTF_m0_N0YzFC6g6EJbOEoRoSK
K5hoDalrcvRYLSrQAZZkflyuVCyixeOv9GfNQC3_osjzw2PAithfubEEBLuVVk4
XUVrWOLrLl0nx7RkKU8NXNHq-rvKMzqg
Issuer
トークンの発行者
{
"iss": "http://serer.example.com",
"sub": "248289761001",
"aud": "s68hdRkqt3",
"nonce": "n-oS6_WzA2Mj",
"exp": 1311281970,
"iat": 1311280970
}
https://jwt.io
Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 65

66.

[beta]

JWTのデコード
JWT
Debugger
Libraries
Introduction
Ask
Get a T-shirt!
Crafted by
Auth0
Encoded
PASTE A TOKEN HERE
eyJhbGciOiJSUzI1NiIsImtpZCI6IjFhOWdkayJ9.ewogImlzcyI6ICJodHRwOi8vc2VyZXIuZXhhbXBsZS5jb20iLAogInN1YiI6ICIyNDgyODk3NjEwMDEiLAogImF1ZCI6ICJzNmJoZFJrcXQzIiwKICJub25jZSI6ICJuLW9TNl9XekEyTWoiLAogImV4cCI6IDEzMTEyODE5NzAsCiAiaWF0IjogMTMxMTI4MDk3MAp9.AkfQ.ggW8hZ1EuVLuxNuuIJKX_V8a_OMXzR0EHR9R6jg
dqrOOF4daGU96Sr_P6q Jp6IcmD3HP99Obi1PRs-cwh3LO-
p146waJ8IhehcwL7F09JdijmbQkvPeB2T9CJNqeGpe-
gccMg4vfKjkM8FcGvnzZUN4_KSP0aAp1tOJ1zZwgjxqGByKHiOtX7TpdQyHE5lcMiKPXfEIQILVq0pc_E2
DzL7emopWoaoZTF_m0_N0YzFC6g6EJbOEoRoSK
K5hoDalrcvRYLSrQAZZkflyuVCyixeOv9GfNQC3_osjzw2PAithfubEEBLuVVk4
XUVrWOLrLl0nx7RkKU8NXNHq-rvKMzqg
Subject
ユーザー識別子
{
"iss": "http://serer.example.com",
"sub": "248289761001",
"aud": "s68hdRkqt3",
"nonce": "n-oS6_WzA2Mj",
"exp": 1311281970,
"iat": 1311280970
}
https://jwt.io
Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 66

67.

[beta]

JWTのデコード
JWT
Debugger
Libraries
Introduction
Ask
Get a T-shirt!
Crafted by
Auth0
Encoded
PASTE A TOKEN HERE
eyJhbGciOiJSUzI1NiIsImtpZCI6IjFhOWdkayJ9.ewogImlzcyI6ICJodHRwOi8vc2VyZXIuZXhhbXBsZS5jb20iLAogInN1YiI6ICIyNDgyODk3NjEwMDEiLAogImF1ZCI6ICJzNmJoZFJrcXQzIiwKICJub25jZSI6ICJuLW9TNl9XekEyTWoiLAogImV4cCI6IDEzMTEyODE5NzAsCiAiaWF0IjogMTMxMTI4MDk3MAp9.AkfQ.ggW8hZ1EuVLuxNuuIJKX_V8a_OMXzR0EHR9R6jg
dqrOOF4daGU96Sr_P6q Jp6IcmD3HP99Obi1PRs-cwh3LO-
p146waJ8IhehcwL7F09JdijmbQkvPeB2T9CJNqeGpe-
gccMg4vfKjkM8FcGvnzZUN4_KSP0aAp1tOJ1zZwgjxqGByKHiOtX7TpdQyHE5lcMiKPXfEIQILVq0pc_E2
DzL7emopWoaoZTF_m0_N0YzFC6g6EJbOEoRoSK
K5hoDalrcvRYLSrQAZZkflyuVCyixeOv9GfNQC3_osjzw2PAithfubEEBLuVVk4
XUVrWOLrLl0nx7RkKU8NXNHq-rvKMzqg
Audience
Client ID
トークンの発行対象
{
"iss": "htt...",
"sub": "2482897...",
"aud": "s68hdRkqt3",
"nonce": "n-oS6_WzA2Mj",
"exp": 1311281970,
"iat": 1311280970
}
https://jwt.io
Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 67

68.

[beta]

JWTのデコード
JWT
Debugger
Libraries
Introduction
Ask
Get a T-shirt!
Crafted by
Auth0
Encoded
PASTE A TOKEN HERE
eyJhbGciOiJSUzI1NiIsImtpZCI6IjFhOWdkayJ9.ewogImlzcyI6ICJodHRwOi8vc2VyZXIuZXhhbXBsZS5jb20iLAogInN1YiI6ICIyNDgyODk3NjEwMDEiLAogImF1ZCI6ICJzNmJoZFJrcXQzIiwKICJub25jZSI6ICJuLW9TNl9XekEyTWoiLAogImV4cCI6IDEzMTEyODE5NzAsCiAiaWF0IjogMTMxMTI4MDk3MAp9.AkfQ.ggW8hZ1EuVLuxNuuIJKX_V8a_OMXzR0EHR9R6jg
dqrOOF4daGU96Sr_P6q Jp6IcmD3HP99Obi1PRs-cwh3LO-
p146waJ8IhehcwL7F09JdijmbQkvPeB2T9CJNqeGpe-
gccMg4vfKjkM8FcGvnzZUN4_KSP0aAp1tOJ1zZwgjxqGByKHiOtX7TpdQyHE5lcMiKPXfEIQILVq0pc_E2
DzL7emopWoaoZTF_m0_N0YzFC6g6EJbOEoRoSK
K5hoDalrcvRYLSrQAZZkflyuVCyixeOv9GfNQC3_osjzw2PAithfubEEBLuVVk4
XUVrWOLrLl0nx7RkKU8NXNHq-rvKMzqg
リプレイアタック
対策のランダム値
{
"iss": "htt...",
"sub": "2482897...",
"aud": "s68hdRk...",
"nonce": "n-oS6_WzA2Mj",
"exp": 1311281970,
"iat": 1311280970
}
https://jwt.io
Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 68

69.

[beta]

JWTのデコード
JWT
Debugger
Libraries
Introduction
Ask
Get a T-shirt!
Crafted by
Auth0
Encoded
PASTE A TOKEN HERE
eyJhbGciOiJSUzI1NiIsImtpZCI6IjFhOWdkayJ9.ewogImlzcyI6ICJodHRwOi8vc2VyZXIuZXhhbXBsZS5jb20iLAogInN1YiI6ICIyNDgyODk3NjEwMDEiLAogImF1ZCI6ICJzNmJoZFJrcXQzIiwKICJub25jZSI6ICJuLW9TNl9XekEyTWoiLAogImV4cCI6IDEzMTEyODE5NzAsCiAiaWF0IjogMTMxMTI4MDk3MAp9.AkfQ.ggW8hZ1EuVLuxNuuIJKX_V8a_OMXzR0EHR9R6jg
dqrOOF4daGU96Sr_P6q Jp6IcmD3HP99Obi1PRs-cwh3LO-
p146waJ8IhehcwL7F09JdijmbQkvPeB2T9CJNqeGpe-
gccMg4vfKjkM8FcGvnzZUN4_KSP0aAp1tOJ1zZwgjxqGByKHiOtX7TpdQyHE5lcMiKPXfEIQILVq0pc_E2
DzL7emopWoaoZTF_m0_N0YzFC6g6EJbOEoRoSK
K5hoDalrcvRYLSrQAZZkflyuVCyixeOv9GfNQC3_osjzw2PAithfubEEBLuVVk4
XUVrWOLrLl0nx7RkKU8NXNHq-rvKMzqg
トークンの有効期限
{
"iss": "http://serer.example.com",
"sub": "248289761001",
"aud": "s68hdRkqt3",
"nonce": "n-oS6_WzA2Mj",
"exp": 1311281970,
"iat": 1311280970
}
https://jwt.io
Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 69

70.

[beta]

JWTのデコード
JWT
Debugger
Libraries
Introduction
Ask
Get a T-shirt!
Crafted by
Auth0
Encoded
PASTE A TOKEN HERE
eyJhbGciOiJSUzI1NiIsImtpZCI6IjFhOWdkayJ9.ewogImlzcyI6ICJodHRwOi8vc2VyZXIuZXhhbXBsZS5jb20iLAogInN1YiI6ICIyNDgyODk3NjEwMDEiLAogImF1ZCI6ICJzNmJoZFJrcXQzIiwKICJub25jZSI6ICJuLW9TNl9XekEyTWoiLAogImV4cCI6IDEzMTEyODE5NzAsCiAiaWF0IjogMTMxMTI4MDk3MAp9.AkfQ.ggW8hZ1EuVLuxNuuIJKX_V8a_OMXzR0EHR9R6jg
dqrOOF4daGU96Sr_P6q Jp6IcmD3HP99Obi1PRs-cwh3LO-
p146waJ8IhehcwL7F09JdijmbQkvPeB2T9CJNqeGpe-
gccMg4vfKjkM8FcGvnzZUN4_KSP0aAp1tOJ1zZwgjxqGByKHiOtX7TpdQyHE5lcMiKPXfEIQILVq0pc_E2
DzL7emopWoaoZTF_m0_N0YzFC6g6EJbOEoRoSK
K5hoDalrcvRYLSrQAZZkflyuVCyixeOv9GfNQC3_osjzw2PAithfubEEBLuVVk4
XUVrWOLrLl0nx7RkKU8NXNHq-rvKMzqg
トークン発行時の
タイムスタンプ
{
"iss": "http://serer.example.com",
"sub": "248289761001",
"aud": "s68hdRkqt3",
"nonce": "n-oS6_WzA2Mj",
"exp": 1311281970,
"iat": 1311280970
}
https://jwt.io
Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 70

71.

[beta]

JWTのデコード
JWT
Debugger
Libraries
Introduction
Ask
Get a T-shirt!
Crafted by
Auth0
Encoded
PASTE A TOKEN HERE
eyJhbGciOiJSUzI1NiIsImtpZCI6IjFhOWdkayJ9.ewogImlzcyI6ICJodHRwOi8vc2VyZXIuZXhhbXBsZS5jb20iLAogInN1YiI6ICIyNDgyODk3NjEwMDEiLAogImF1ZCI6ICJzNmJoZFJrcXQzIiwKICJub25jZSI6ICJuLW9TNl9XekEyTWoiLAogImV4cCI6IDEzMTEyODE5NzAsCiAiaWF0IjogMTMxMTI4MDk3MAp9.AkfQ.ggW8hZ1EuVLuxNuuIJKX_V8a_OMXzR0EHR9R6jg
dqrOOF4daGU96Sr_P6q Jp6IcmD3HP99Obi1PRs-cwh3LO-
p146waJ8IhehcwL7F09JdijmbQkvPeB2T9CJNqeGpe-
gccMg4vfKjkM8FcGvnzZUN4_KSP0aAp1tOJ1zZwgjxqGByKHiOtX7TpdQyHE5lcMiKPXfEIQILVq0pc_E2
DzL7emopWoaoZTF_m0_N0YzFC6g6EJbOEoRoSK
K5hoDalrcvRYLSrQAZZkflyuVCyixeOv9GfNQC3_osjzw2PAithfubEEBLuVVk4
XUVrWOLrLl0nx7RkKU8NXNHq-rvKMzqg
Decoded
EDIT THE PAYLOAD AND SECRET
HEADER: ALGORITHM & TOKEN TYPE
{
"alg": "RS256",
"kid": "1e9gdk7"
}
PAYLOAD: DATA
{
"iss": "http://server.example.com",
"sub": "248289761001",
"aud": "s6BhdRkqt3",
"nonce": "n-oS6_WzA2Mj",
"exp": 1311281970,
"iat": 1311280970
}
VERIFY SIGNATURE
RSASHA256(
base64UrlEncode(header) + "." +
base64UrlEncode(payload),
https://jwt.io
署名
Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 71

72.

73.

74.

75.

76.

まとめ • ID TokenとはJWTフォーマットのトークン • ID TokenにはOPによるEnd-Userの認証イベントに関するClaimを内包 • ID Tokenには署名が含まれるので改ざん検知が可能 • 全ての検証が通ればRPはEnd-Userの認証結果を受容 Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. 76

77.

78.

79.

80.

Member Type Description sub string Subject - Identifier for the End-User at the Issuer. name string End-User's full name in displayable form including all name parts, possibly including titles and suffixes, ordered according to the End-User's locale and preferences. given_name string Given name(s) or first name(s) of the End-User. Note that in some cultures, people can have multiple given names; all can be present, with the names being separated by space characters. family_name string Surname(s) or last name(s) of the End-User. Note that in some cultures, people can have multiple family names or no family name; all can be present, with the names being separated by space characters. middle_name string Middle name(s) of the End-User. Note that in some cultures, people can have multiple middle names; all can be present, with the names being separated by space characters. Also note that in some cultures, middle names are not used. nickname string Casual name of the End-User that may or may not be the same as the given_name. For instance, a nickname value of Mike might be returned alongside a given_name value of Michael. preferred_username string Shorthand name by which the End-User wishes to be referred to at the RP, such as janedoe or j.doe. This value MAY be any valid JSON string including special characters such as @, /, or whitespace. The RP MUST NOT rely upon this value being unique, as discussed in Section 5.7. profile string URL of the End-User's profile page. The contents of this Web page SHOULD be about the End-User. picture string URL of the End-User's profile picture. This URL MUST refer to an image file (for example, a PNG, JPEG, or GIF image file), rather than to a Web page containing an image. Note that this URL SHOULD specifically reference a photo of the End-User suitable for displaying when describing the End-User, rather than an arbitrary photo taken by the End-User. website string URL of the End-User's Web page or blog. This Web page SHOULD contain information published by the End-User or an organization that the End-User is affiliated with. email string End-User's preferred e-mail address. Its value MUST conform to the RFC 5322 [RFC5322] addr-spec syntax. The RP MUST NOT rely upon this value being unique, as discussed in Section 5.7. email_verified boolean True if the End-User's e-mail address has been verified; otherwise false. When this Claim Value is true, this means that the OP took affirmative steps to ensure that this e- mail address was controlled by the End-User at the time the verification was performed. The means by which an e-mail address is verified is context-specific, and dependent upon the trust framework or contractual agreements within which the parties are operating. gender string End-User's gender. Values defined by this specification are female and male. Other values MAY be used when neither of the defined values are applicable. birthdate string End-User's birthday, represented as an ISO 8601:2004 [ISO8601-2004] YYYY-MM-DD format. The year MAY be 0000, indicating that it is omitted. To represent only the year, YYYY format is allowed. Note that depending on the underlying platform's date related function, providing just year can result in varying month and day, so the implementers need to take this factor into account to correctly process the dates. zoneinfo string String from zoneinfo [zoneinfo] time zone database representing the End-User's time zone. For example, Europe/Paris or America/Los_Angeles. locale string End-User's locale, represented as a BCP47 [RFC5646] language tag. This is typically an ISO 639-1 Alpha-2 [ISO639-1] language code in lowercase and an ISO 3166-1 Alpha-2 [ISO3166-1] country code in uppercase, separated by a dash. For example, en-US or fr-CA. As a compatibility note, some implementations have used an underscore as the separator rather than a dash, for example, en_US; Relying Parties MAY choose to accept this locale syntax as well. phone_number string End-User's preferred telephone number. E.164 [E.164] is RECOMMENDED as the format of this Claim, for example, +1 (425) 555-1212 or +56 (2) 687 2400. If the phone number contains an extension, it is RECOMMENDED that the extension be represented using the RFC 3966 [RFC3966] extension syntax, for example, +1 (604) 555- 1234;ext=5678. phone_number_verified boolean True if the End-User's phone number has been verified; otherwise false. When this Claim Value is true, this means that the OP took affirmative steps to ensure that this phone number was controlled by the End-User at the time the verification was performed. The means by which a phone number is verified is context-specific, and dependent upon the trust framework or contractual agreements within which the parties are operating. When true, the phone_number Claim MUST be in E.164 format and any extensions MUST be represented in RFC 3966 format. address JSON object End-User's preferred postal address. The value of the address member is a JSON [RFC4627] structure containing some or all of the members defined in Section 5.1.1. updated_at string Time the End-User's information was last updated. Its value is a JSON number representing the number of seconds from 1970-01-01T0:0:0Z as measured in UTC until the date/time. Copyright (C) 2018 Yahoo Japan Corporation. All Rights Reserved. https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims

81.

82.

OpenID Connect入門 #openid #technight

Yahoo!デベロッパーネットワーク

関連スライド

深層学習による自然言語処理入門: word2vecからBERT, GPT-3まで

ゼロから始める転移学習

ヤフーにおける WebAuthn と Passkey の UX の紹介と考察 #idcon #fidcon

OpenID Connectとネイティブアプリを取り巻く仕様と動向 Yahoo! JAPANの取り組み #openid #openid_tokyo

運用業務とスクラムは本当に組み合わせにくいのか︖運用業務が大半を占めるプロダクト開発での試行錯誤

ヤフーのオンプレ機械学習基盤AIPFについて #ml_kubernetes

各ページのテキスト