ID連携入門 (実習編) - Security Camp 2016
•
3 likes•1,715 views
The document discusses OAuth and OpenID Connect protocols. It provides diagrams illustrating the flows of OAuth authorization code grant, implicit grant and hybrid grant flows. It also compares OAuth and OpenID Connect, noting that OpenID Connect builds upon OAuth by adding an identity layer. Key aspects of OpenID Connect like ID tokens and their claims are outlined. Examples of OAuth and OpenID Connect implementations are provided at the end.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to ID連携入門 (実習編) - Security Camp 2016
Similar to ID連携入門 (実習編) - Security Camp 2016 (20)
More from Nov Matake
More from Nov Matake (20)
Recently uploaded
Recently uploaded (19)
ID連携入門 (実習編) - Security Camp 2016
- 3. Definition of “Federation” in NIST SP 800-63-3 “A process that allows for the conveyance of identity and authentication information across a set of networked systems.” https://pages.nist.gov/800-63-3/
- 4. Definition of “Federation” in NIST SP 800-63-3 “ Identity ” https://openid-foundation-japan.github.io/800-63-3/index.ja.html
- 5. Login / Sign-up Request an Assertion Authentication Event Issue an Assertion Request Attributes AttributesWelcome, Nov! Verify the Assertion
- 6. Login / Sign-up Request an Assertion Authentication Event Issue an Artifact Send the Artifact Request Attributes AttributesWelcome, Nov! Assertion
- 7. Login / Sign-up Request an Assertion Authentication Event Issue an Assertion w/ Attributes Verify the Assertion Welcome, Nov!
- 8. SAML (Security Assertion Markup Language) OpenID Connect
- 9. OpenID Connect ~ OAuth 2.0 + Identity Layer ~
- 11. OAuth !! Twitter API, Facebook API, GitHub API etc.
- 13. OAuth Server Resource Owner OAuth Client Resource Owner
- 14. Login / Sign-up Request an Access Token Authentication Event Issue an Authorization Code Send the Code Request Attributes AttributesWelcome, Nov! Access Token
- 16. Login / Sign-up Request an Access Token Authentication Event Issue an Authorization Code Send the Code Request Attributes AttributesWelcome, Nov! Access Token
- 18. Login / Sign-up Request an Access Token Authentication Event Issue an Authorization Code Send the Code Request Attributes AttributesWelcome, Nov! Access Token
- 20. Login / Sign-up Request an Access Token Authentication Event Issue an Authorization Code Send the Code Request Attributes AttributesWelcome, Nov! Access Token
- 23. Login / Sign-up Request an Access Token Authentication Event Issue an Authorization Code Send the Code Request Attributes AttributesWelcome, Nov! Access Token
- 27. Login / Sign-up Request an Access Token Authentication Event Issue an Access Token Request Attributes AttributesWelcome, Nov! response_type=token
- 28. Login / Sign-up Request an Access Token Authentication Event Issue an Access Token + Code Request Attributes AttributesWelcome, Nov! Code Access Token Code ?? App Backend response_type=code+token
- 29. Code Flow • “response_type=code” • Token Endpoint • • Access Token User Agent • ( ) Client • Access Token
- 30. Implicit Flow • “response_type=token” • Token Endpoint • • Access Token User Agent • Client (client_secret ) • End-User (Client ) Access Token
- 31. Hybrid Flow • “response_type=code+token” • Token Endpoint Access Token Token Endpoint Access Token • • Implicit Flow Access Token Code Flow Access Token
- 37. (SSL/TLS etc.) …
- 39. • RFC 6749 - OAuth 2.0 Core • RFC 6750 - OAuth 2.0 Bearer Token Usage • RFC 6819 - OAuth 2.0 Threat Model • RFC 7519 - JSON Web Token • RFC 7636 - OAuth 2.0 PKCE (Proof Key for Code Exchange) • RFC 7800 - OAuth 2.0 PoP Token (Proof of Possession)
- 40. • RFC 6749 - OAuth 2.0 Core • RFC 6750 - OAuth 2.0 Bearer Token Usage • RFC 6819 - OAuth 2.0 Threat Model • RFC 7519 - JSON Web Token • RFC 7636 - OAuth 2.0 PKCE (Proof Key for Code Exchange) • RFC 7800 - OAuth 2.0 PoP Token (Proof of Possession) [ ] http://openid-foundation-japan.github.io
- 41. OpenID Connect ~ OAuth 2.0 + Identity Layer ~
- 42. Login / Sign-up Request an Access Token Authentication Event Issue an Authorization Code Send the Code Request Attributes AttributesWelcome, Nov! Access Token + ID Token
- 50. • iss (issuer) • (ID Provider) • sub (subject) • • aud (audience) • Client • exp / iat (expires_at / issued_at) •
- 51. • auth_time • ( Authentication Event ) • nonce • Authorization Request Token Response • at_hash • Access Token • c_hash • Authorization Code
- 54. CSRF
- 55. Login / Sign-up Request an Access Token Authentication Event Issue an Authorization Code Send the Code Request Attributes AttributesWelcome, Nov! Access Token (+ ID Token) response_type=code
- 56. Login / Sign-up Request an Access Token Authentication Event Issue an Authorization Code Send the Code Request Attributes AttributesWelcome, Nov! Access Token (+ ID Token) response_type=code
- 57. Login / Sign-up Request an Access Token Authentication Event Issue an Authorization Code Send the Code Request Attributes AttributesWelcome, Nov! Access Token (+ ID Token) response_type=code
- 59. Code
- 60. Login / Sign-up Request an Access Token Authentication Event Issue an Authorization Code Send the Code Request Attributes AttributesWelcome, Nov! Access Token (+ ID Token) response_type=code
- 62. Token
- 63. Login / Sign-up Request an Access Token Authentication Event Issue an Access Token Welcome, Nov! Token Attributes Token Session App Backend response_type=token
- 67. OAuth … • • • OAuth … • state • OpenID Connect (max_age etc.) • Token • nonce • ( ) • ID Token aud, sub, auth_time etc. • OAuth API (Token Introspection)
- 69. OpenID Connect ~ OAuth 2.0 + Identity Layer ~
- 71. • RFC 6749 - OAuth 2.0 Core • RFC 6750 - OAuth 2.0 Bearer Token Usage • RFC 6819 - OAuth 2.0 Threat Model • RFC 7519 - JSON Web Token • RFC 7636 - OAuth 2.0 PKCE (Proof Key for Code Exchange) • RFC 7800 - OAuth 2.0 PoP Token (Proof of Possession)