OAuth2ã§å®å šãã€ã·ãŒã ã¬ã¹ãªãŠãŒã¶ãŒèªèšŒãå®çŸãOAuth2ã®å®è£ æ¹æ³ã詳现ã«è§£èª¬ããäžçäžã®éçºè åãã«æŠå¿µãã¯ãŒã¯ãããŒãå®è·µçãªèæ ®äºé ãæäŸããŸãã
OAuth2ã®å®è£ ïŒå æ¬çãªç¬¬äžè èªèšŒã¬ã€ã
仿¥ã®çžäºæ¥ç¶ãããããžã¿ã«ç°å¢ã«ãããŠãã·ãŒã ã¬ã¹ã§å®å šãªãŠãŒã¶ãŒèªèšŒã¯æéèŠèª²é¡ã§ããOAuth2ã¯ã第äžè ã¢ããªã±ãŒã·ã§ã³ããŠãŒã¶ãŒã®è³æ Œæ å ±ãå ¬éããããšãªããå¥ã®ãµãŒãã¹äžã®ãŠãŒã¶ãŒãªãœãŒã¹ã«ã¢ã¯ã»ã¹ã§ããããã«ããããã®æ¥çæšæºãããã³ã«ãšããŠç»å ŽããŸããããã®å æ¬çãªã¬ã€ãã§ã¯ãOAuth2ã®å®è£ ã®è€éããæãäžãããã®åŒ·åãªèªå¯ãã¬ãŒã ã¯ãŒã¯ãã¢ããªã±ãŒã·ã§ã³ã«çµ±åããããã«å¿ èŠãªç¥èãšå®è·µçãªã¬ã€ãã³ã¹ãéçºè ã«æäŸããŸãã
OAuth2ãšã¯ïŒ
OAuth2 (Open Authorization) ã¯ã第äžè ã¢ããªã±ãŒã·ã§ã³ãããŠãŒã¶ãŒã®æ¿èªã調æŽãããã第äžè ã¢ããªã±ãŒã·ã§ã³èªèº«ãã¢ã¯ã»ã¹ã§ããããã«ããããšã§ããŠãŒã¶ãŒã«ä»£ãã£ãŠHTTPãµãŒãã¹ãžã®éå®çãªã¢ã¯ã»ã¹ãååŸã§ããããã«ããèªå¯ãã¬ãŒã ã¯ãŒã¯ã§ããOAuth2ã¯ããŠã§ãã¢ããªã±ãŒã·ã§ã³ããã¹ã¯ãããã¢ããªã±ãŒã·ã§ã³ãæºåž¯é»è©±ããªãã³ã°ã«ãŒã ããã€ã¹ãªã©ã®ç¹å®ã®èªå¯ãããŒãæäŸãã€ã€ãã¯ã©ã€ã¢ã³ãéçºè ã®ã·ã³ãã«ãã«çŠç¹ãåœãŠãŠããŸãã
ãã¬ãŒããŒãã³ã°ã®ãããªãã®ã§ããããªãã¯è»ã®ã㌠(è³æ Œæ å ±) ãä¿¡é Œã§ãããã¬ãŒ (第äžè ã¢ããªã±ãŒã·ã§ã³) ã«æž¡ãã圌ããããªãã®è» (ãªãœãŒã¹ãžã®ã¢ã¯ã»ã¹) ãé§è»ã§ããããã«ããŸããããªãã¯çŽæ¥ãããªãã®è»ã«ããä»ã®ãã¹ãŠã®ãã®ãžã®ã¢ã¯ã»ã¹ã圌ãã«äžããå¿ èŠã¯ãããŸãããããªãã¯ã³ã³ãããŒã«ãä¿æããåžžã«ããŒãåãæ»ãããšãã§ããŸã (ã¢ã¯ã»ã¹ãåãæ¶ãããšãã§ããŸã)ã
OAuth2ã®éèŠãªæŠå¿µ
OAuth2ã®ã³ã¢ã³ã³ã»ãããçè§£ããããšã¯ãå®è£ ãæåãããããã«äžå¯æ¬ ã§ãã
- ãªãœãŒã¹ææè ïŒä¿è·ããããªãœãŒã¹ãžã®ã¢ã¯ã»ã¹ãèš±å¯ã§ãããšã³ãã£ãã£ãéåžžãããã¯ãšã³ããŠãŒã¶ãŒã§ãã
- ãªãœãŒã¹ãµãŒããŒïŒä¿è·ããããªãœãŒã¹ããã¹ããããµãŒããŒãã¢ã¯ã»ã¹ ããŒã¯ã³ã䜿çšããŠä¿è·ããããªãœãŒã¹ãªã¯ãšã¹ããåãå ¥ããå¿çããŸãã
- ã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ïŒãªãœãŒã¹ææè ã代衚ããŠä¿è·ããããªãœãŒã¹ãžã®ã¢ã¯ã»ã¹ããªã¯ãšã¹ãããã¢ããªã±ãŒã·ã§ã³ãããã¯ãWebã¢ããªã±ãŒã·ã§ã³ãã¢ãã€ã«ã¢ããªããŸãã¯ãã¹ã¯ãããã¢ããªã±ãŒã·ã§ã³ã®å¯èœæ§ããããŸãã
- èªå¯ãµãŒããŒïŒãªãœãŒã¹ææè ãæ£åžžã«èªèšŒãããã®èªå¯ãååŸããåŸãã¢ã¯ã»ã¹ ããŒã¯ã³ãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã«çºè¡ãããµãŒããŒã
- ã¢ã¯ã»ã¹ããŒã¯ã³ïŒãªãœãŒã¹ææè ããã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã«ä»äžãããèªå¯ã衚ãè³æ Œæ å ±ãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã¯ããªãœãŒã¹ãµãŒããŒäžã®ä¿è·ããããªãœãŒã¹ã«ã¢ã¯ã»ã¹ããããã«äœ¿çšããŸããéåžžãã¢ã¯ã»ã¹ããŒã¯ã³ã«ã¯æå¹æéãéãããŠããŸãã
- ãªãã¬ãã·ã¥ããŒã¯ã³ïŒãªãœãŒã¹ææè ã«ã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ãåæ¿èªããŠãããããšãªããæ°ããã¢ã¯ã»ã¹ããŒã¯ã³ãååŸããããã«äœ¿çšãããè³æ Œæ å ±ãéåžžããªãã¬ãã·ã¥ããŒã¯ã³ã¯é·æéæå¹ã§ãããå®å šã«ä¿ç®¡ããå¿ èŠããããŸãã
- ã¹ã³ãŒãïŒã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã«ä»äžãããç¹å®ã®æš©éãå®çŸ©ããŸããããšãã°ãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã«ã¯ããŠãŒã¶ãŒã®ãããã¡ã€ã«ãžã®èªã¿åãå°çšã¢ã¯ã»ã¹ãèš±å¯ãããå ŽåããããŸããã倿Žããæ©èœã¯èš±å¯ãããŸããã
OAuth2 ã°ã©ã³ãã¿ã€ã
OAuth2ã¯ãç¹å®ã®ãŠãŒã¹ã±ãŒã¹ãšã»ãã¥ãªãã£èŠä»¶ã«åãããŠèª¿æŽããããããã€ãã®ã°ã©ã³ãã¿ã€ããå®çŸ©ããŠããŸããå®å šã§ãŠãŒã¶ãŒãã¬ã³ããªãŒãªèªèšŒãšã¯ã¹ããªãšã³ã¹ã確ä¿ããã«ã¯ãé©åãªã°ã©ã³ãã¿ã€ããéžæããããšãäžå¯æ¬ ã§ãã
1. èªå¯ã³ãŒãã°ã©ã³ã
èªå¯ã³ãŒãã°ã©ã³ãã¯ãWebã¢ããªã±ãŒã·ã§ã³ã§æãäžè¬çã«äœ¿çšãããæšå¥šãããã°ã©ã³ãã¿ã€ãã§ããã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ããããªãœãŒã¹ææè ã®ãã©ãŠã¶ãŒã«å ¬éãããããšã®ãªããè€æ°ã¹ãããã®ããã»ã¹ã䌎ããŸããæ©å¯æ§ã®é«ãã¯ã©ã€ã¢ã³ãïŒã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ããã®æ©å¯æ§ãç¶æã§ããã¯ã©ã€ã¢ã³ãïŒã§ã®äœ¿çšãç®çãšããŠããŸããç°¡ç¥åããå èš³ã¯æ¬¡ã®ãšããã§ãã
- ã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã¯ããªãœãŒã¹ææè ãèªå¯ãµãŒããŒã«ãªãã€ã¬ã¯ãããŸãã
- ãªãœãŒã¹ææè ã¯èªå¯ãµãŒããŒã§èªèšŒããã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ãžã®èš±å¯ãä»äžããŸãã
- èªå¯ãµãŒããŒã¯ãèªå¯ã³ãŒããšãšãã«ãªãœãŒã¹ææè ãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã«ãªãã€ã¬ã¯ãããŸãã
- ã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã¯ãèªå¯ã³ãŒããã¢ã¯ã»ã¹ããŒã¯ã³ãšãªãã¬ãã·ã¥ããŒã¯ã³ãšäº€æããŸãã
- ã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã¯ãã¢ã¯ã»ã¹ããŒã¯ã³ã䜿çšããŠããªãœãŒã¹ãµãŒããŒäžã®ä¿è·ããããªãœãŒã¹ã«ã¢ã¯ã»ã¹ããŸãã
äŸïŒãŠãŒã¶ãŒãGoogleãã©ã€ãã¢ã«ãŠã³ãããµãŒãããŒãã£ã®ããã¥ã¡ã³ãç·šéã¢ããªã±ãŒã·ã§ã³ã«æ¥ç¶ããããšèããŠããŸããã¢ããªã±ãŒã·ã§ã³ã¯ããŠãŒã¶ãŒãGoogleã®èªèšŒããŒãžã«ãªãã€ã¬ã¯ãããããã§ãã°ã€ã³ããŠãã¢ããªã±ãŒã·ã§ã³ã«Googleãã©ã€ããã¡ã€ã«ãžã®ã¢ã¯ã»ã¹èš±å¯ãäžããŸããæ¬¡ã«ãGoogleã¯ãã¢ããªã±ãŒã·ã§ã³ãèªå¯ã³ãŒããšãšãã«ã¢ããªã±ãŒã·ã§ã³ã«ãªãã€ã¬ã¯ãããŸããã¢ããªã±ãŒã·ã§ã³ã¯ããããã¢ã¯ã»ã¹ããŒã¯ã³ãšãªãã¬ãã·ã¥ããŒã¯ã³ãšäº€æããŸãã
2. ã€ã³ããªã·ããã°ã©ã³ã
ã€ã³ããªã·ããã°ã©ã³ãã¯ãã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå®å šã«ä¿ç®¡ã§ããªãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ïŒWebãã©ãŠã¶ãŒã§å®è¡ãããã·ã³ã°ã«ããŒãžã¢ããªã±ãŒã·ã§ã³ (SPA) ããã€ãã£ãã¢ãã€ã«ã¢ããªã±ãŒã·ã§ã³ãªã©ïŒåãã«èšèšããããèªå¯ã³ãŒãã°ã©ã³ãã®ç°¡ç¥åãããããŒãžã§ã³ã§ãããã®ã°ã©ã³ãã¿ã€ãã§ã¯ããªãœãŒã¹ææè ãèªå¯ãµãŒããŒã§èªèšŒããåŸãã¢ã¯ã»ã¹ããŒã¯ã³ãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã«çŽæ¥è¿ãããŸãããã ããã¢ã¯ã»ã¹ããŒã¯ã³ã®ååã®ãªã¹ã¯ããããããèªå¯ã³ãŒãã°ã©ã³ããããå®å šæ§ãäœããšèããããŠããŸãã
éèŠãªãç¥ããïŒã€ã³ããªã·ããã°ã©ã³ãã¯ãçŸåšã§ã¯å»æ¢ããããã®ãšèŠãªãããŠããŸããã»ãã¥ãªãã£ã®ãã¹ããã©ã¯ãã£ã¹ã§ã¯ãSPAããã€ãã£ãã¢ããªã§ãã£ãŠãã代ããã«PKCE (Proof Key for Code Exchange) ã䜿çšããèªå¯ã³ãŒãã°ã©ã³ãã䜿çšããããšãæšå¥šããŠããŸãã
3. ãªãœãŒã¹ææè ãã¹ã¯ãŒãè³æ Œæ å ±ã°ã©ã³ã
ãªãœãŒã¹ææè ãã¹ã¯ãŒãè³æ Œæ å ±ã°ã©ã³ãã䜿çšãããšãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã¯ããªãœãŒã¹ææè ã®ãŠãŒã¶ãŒåãšãã¹ã¯ãŒããèªå¯ãµãŒããŒã«çŽæ¥æäŸããããšã«ãããã¢ã¯ã»ã¹ããŒã¯ã³ãååŸã§ããŸãããã®ã°ã©ã³ãã¿ã€ãã¯ãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ãé«åºŠã«ä¿¡é ŒããããªãœãŒã¹ææè ãšã®çŽæ¥çãªé¢ä¿ãããå Žåã«ã®ã¿äœ¿çšããå¿ èŠããããŸããè³æ Œæ å ±ãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ãšçŽæ¥å ±æããããšã«é¢é£ããã»ãã¥ãªãã£ãªã¹ã¯ããããããäžè¬çã«ã¯æšå¥šãããŠããŸããã
äŸïŒéè¡ãéçºãããã¡ãŒã¹ãããŒãã£ã¢ãã€ã«ã¢ããªã±ãŒã·ã§ã³ã¯ããã®ã°ã©ã³ãã¿ã€ãã䜿çšããŠããŠãŒã¶ãŒãã¢ã«ãŠã³ãã«ã¢ã¯ã»ã¹ã§ããããã«ããããšãã§ããŸãããã ãããµãŒãããŒãã£ã¢ããªã±ãŒã·ã§ã³ã¯ãäžè¬çã«ãã®ã°ã©ã³ãã¿ã€ããé¿ããå¿ èŠããããŸãã
4. ã¯ã©ã€ã¢ã³ãè³æ Œæ å ±ã°ã©ã³ã
ã¯ã©ã€ã¢ã³ãè³æ Œæ å ±ã°ã©ã³ãã䜿çšãããšãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã¯ããªãœãŒã¹ææè ã代衚ããã®ã§ã¯ãªããç¬èªã®è³æ Œæ å ± (ã¯ã©ã€ã¢ã³ãIDãšã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãã) ã䜿çšããŠã¢ã¯ã»ã¹ããŒã¯ã³ãååŸã§ããŸãããã®ã°ã©ã³ãã¿ã€ãã¯ããµãŒããŒééä¿¡ããŸãã¯ã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ãçŽæ¥ææãããªãœãŒã¹ã«ã¢ã¯ã»ã¹ããå¿ èŠãããå Žåã«äžè¬çã«äœ¿çšãããŸãã
äŸïŒã¯ã©ãŠããããã€ããŒãããµãŒããŒã¡ããªãã¯ã«ã¢ã¯ã»ã¹ããå¿ èŠãããç£èŠã¢ããªã±ãŒã·ã§ã³ã¯ããã®ã°ã©ã³ãã¿ã€ãã䜿çšã§ããŸãã
5. ãªãã¬ãã·ã¥ããŒã¯ã³ã°ã©ã³ã
ãªãã¬ãã·ã¥ããŒã¯ã³ã°ã©ã³ãã䜿çšãããšãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã¯ããªãã¬ãã·ã¥ããŒã¯ã³ã䜿çšããŠæ°ããã¢ã¯ã»ã¹ããŒã¯ã³ãååŸã§ããŸããããã«ãããã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã¯ããªãœãŒã¹ææè ã«ã¢ããªã±ãŒã·ã§ã³ãåæ¿èªããŠãããããšãªããä¿è·ããããªãœãŒã¹ãžã®ã¢ã¯ã»ã¹ãç¶æã§ããŸãããªãã¬ãã·ã¥ããŒã¯ã³ã¯ãæ°ããã¢ã¯ã»ã¹ããŒã¯ã³ãšããªãã·ã§ã³ã§æ°ãããªãã¬ãã·ã¥ããŒã¯ã³ãšäº€æãããŸããå€ãã¢ã¯ã»ã¹ããŒã¯ã³ã¯ç¡å¹ã«ãªããŸãã
OAuth2ã®å®è£ ïŒã¹ããããã€ã¹ãããã¬ã€ã
OAuth2ã®å®è£ ã«ã¯ãããã€ãã®éèŠãªæé ãå«ãŸããŸãã
1. ã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã®ç»é²
æåã®æé ã¯ãèªå¯ãµãŒããŒã«ã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ãç»é²ããããšã§ããããã«ã¯éåžžãã¢ããªã±ãŒã·ã§ã³åã説æããªãã€ã¬ã¯ãURI (èªå¯ãµãŒããŒãèªèšŒåŸã«ãªãœãŒã¹ææè ããªãã€ã¬ã¯ãããå Žæ)ãããã³å¿ èŠãªã°ã©ã³ãã¿ã€ããªã©ã®æ å ±ãæäŸããããšãå«ãŸããŸããèªå¯ãµãŒããŒã¯ãã¯ã©ã€ã¢ã³ãIDãšã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããçºè¡ããŸããããã¯ãã¢ããªã±ãŒã·ã§ã³ãèå¥ããŠèªèšŒããããã«äœ¿çšãããŸãã
äŸïŒGoogleã®OAuth2ãµãŒãã¹ã«ã¢ããªã±ãŒã·ã§ã³ãç»é²ããéã¯ããªãã€ã¬ã¯ãURIãæäŸããå¿ èŠããããŸããããã¯ãã¢ããªã±ãŒã·ã§ã³ãèªå¯ã³ãŒããåä¿¡ããããã«äœ¿çšããURIãšäžèŽããå¿ èŠããããŸãããŸããã¢ããªã±ãŒã·ã§ã³ãå¿ èŠãšããã¹ã³ãŒãïŒGoogleãã©ã€ããGmailãžã®ã¢ã¯ã»ã¹ãªã©ïŒãæå®ããå¿ èŠããããŸãã
2. èªå¯ãããŒã®éå§
æ¬¡ã®æé ã¯ãèªå¯ãããŒãéå§ããããšã§ããããã«ã¯ããªãœãŒã¹ææè ãèªå¯ãµãŒããŒã®èªå¯ãšã³ããã€ã³ãã«ãªãã€ã¬ã¯ãããããšãå«ãŸããŸããèªå¯ãšã³ããã€ã³ãã«ã¯ãéåžžãæ¬¡ã®ãã©ã¡ãŒã¿ãŒãå¿ èŠã§ãã
client_idïŒèªå¯ãµãŒããŒãçºè¡ããã¯ã©ã€ã¢ã³ãIDãredirect_uriïŒèªå¯ãµãŒããŒãèªèšŒåŸã«ãªãœãŒã¹ææè ããªãã€ã¬ã¯ãããURIãresponse_typeïŒèªå¯ãµãŒããŒããã®äºæãããå¿çã®ã¿ã€ã (äŸ: èªå¯ã³ãŒãã°ã©ã³ãã®å Žåã¯code)ãscopeïŒå¿ èŠãªã¢ã¯ã»ã¹ã®ã¹ã³ãŒããstateïŒã¯ãã¹ãµã€ããªã¯ãšã¹ããã©ãŒãžã§ãª (CSRF) æ»æãé²ãããã«äœ¿çšããããªãã·ã§ã³ã®ãã©ã¡ãŒã¿ãŒã
äŸïŒãªãã€ã¬ã¯ãURIã¯æ¬¡ã®ããã«ãªããŸãïŒhttps://example.com/oauth2/callbackãstateãã©ã¡ãŒã¿ãŒã¯ãã¢ããªã±ãŒã·ã§ã³ãèªå¯ãµãŒããŒããã®å¿çãæ£åœã§ããããšãæ€èšŒããããã«äœ¿çšã§ããã©ã³ãã ã«çæãããæååã§ãã
3. èªå¯å¿çã®åŠç
ãªãœãŒã¹ææè ãèªå¯ãµãŒããŒã§èªèšŒããã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ãžã®èš±å¯ãä»äžãããšãèªå¯ãµãŒããŒã¯ãèªå¯ã³ãŒã (èªå¯ã³ãŒãã°ã©ã³ãã®å Žå) ãŸãã¯ã¢ã¯ã»ã¹ããŒã¯ã³ (ã€ã³ããªã·ããã°ã©ã³ãã®å Žå) ã®ããããã§ããªãœãŒã¹ææè ãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã®ãªãã€ã¬ã¯ãURIã«æ»ããŸããæ¬¡ã«ãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã¯ããã®å¿çãé©åã«åŠçããå¿ èŠããããŸãã
äŸïŒèªå¯ãµãŒããŒãèªå¯ã³ãŒããè¿ãå Žåãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã¯ãèªå¯ãµãŒããŒã®ããŒã¯ã³ãšã³ããã€ã³ãã«POSTãªã¯ãšã¹ããéä¿¡ããããšã«ãããã¢ã¯ã»ã¹ããŒã¯ã³ãšãªãã¬ãã·ã¥ããŒã¯ã³ãšäº€æããå¿ èŠããããŸããããŒã¯ã³ãšã³ããã€ã³ãã«ã¯ãéåžžãæ¬¡ã®ãã©ã¡ãŒã¿ãŒãå¿ èŠã§ãã
grant_typeïŒã°ã©ã³ãã¿ã€ã (äŸ:authorization_code)ãcodeïŒèªå¯ãµãŒããŒããåä¿¡ããèªå¯ã³ãŒããredirect_uriïŒèªå¯ãªã¯ãšã¹ãã§äœ¿çšãããã®ãšåããªãã€ã¬ã¯ãURIãclient_idïŒèªå¯ãµãŒããŒãçºè¡ããã¯ã©ã€ã¢ã³ãIDãclient_secretïŒèªå¯ãµãŒããŒãçºè¡ããã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãã (æ©å¯ã¯ã©ã€ã¢ã³ãã®å Žå)ã
4. ä¿è·ããããªãœãŒã¹ãžã®ã¢ã¯ã»ã¹
ã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ãã¢ã¯ã»ã¹ããŒã¯ã³ãååŸãããšãããã䜿çšããŠãªãœãŒã¹ãµãŒããŒäžã®ä¿è·ããããªãœãŒã¹ã«ã¢ã¯ã»ã¹ã§ããŸããã¢ã¯ã»ã¹ããŒã¯ã³ã¯éåžžãAuthorizationããããŒã®HTTPãªã¯ãšã¹ãã«å«ãŸããBearerã¹ããŒã ã䜿çšããŸãã
äŸïŒãœãŒã·ã£ã«ã¡ãã£ã¢ãã©ãããã©ãŒã ã§ãŠãŒã¶ãŒã®ãããã£ãŒã«ã«ã¢ã¯ã»ã¹ããã«ã¯ãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã¯æ¬¡ã®ãããªãªã¯ãšã¹ããè¡ãå¯èœæ§ããããŸãã
GET /api/v1/me HTTP/1.1
Host: api.example.com
Authorization: Bearer [access_token]
5. ããŒã¯ã³ã®æŽæ°ã®åŠç
ã¢ã¯ã»ã¹ããŒã¯ã³ã«ã¯éåžžãæå¹æéãéãããŠããŸããã¢ã¯ã»ã¹ããŒã¯ã³ã®æå¹æéãåãããšãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã¯ããªãã¬ãã·ã¥ããŒã¯ã³ã䜿çšããŠããªãœãŒã¹ææè ã«ã¢ããªã±ãŒã·ã§ã³ãåæ¿èªããŠãããããšãªããæ°ããã¢ã¯ã»ã¹ããŒã¯ã³ãååŸã§ããŸããã¢ã¯ã»ã¹ããŒã¯ã³ãæŽæ°ããã«ã¯ãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã¯ã次ã®ãã©ã¡ãŒã¿ãŒã䜿çšããŠèªå¯ãµãŒããŒã®ããŒã¯ã³ãšã³ããã€ã³ãã«POSTãªã¯ãšã¹ããè¡ããŸãã
grant_typeïŒã°ã©ã³ãã¿ã€ã (äŸ:refresh_token)ãrefresh_tokenïŒèªå¯ãµãŒããŒããåä¿¡ãããªãã¬ãã·ã¥ããŒã¯ã³ãclient_idïŒèªå¯ãµãŒããŒãçºè¡ããã¯ã©ã€ã¢ã³ãIDãclient_secretïŒèªå¯ãµãŒããŒãçºè¡ããã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãã (æ©å¯ã¯ã©ã€ã¢ã³ãã®å Žå)ã
ã»ãã¥ãªãã£ã«é¢ããèæ ®äºé
OAuth2ã¯åŒ·åãªèªå¯ãã¬ãŒã ã¯ãŒã¯ã§ããããŠãŒã¶ãŒããŒã¿ãä¿è·ããæ»æãé²ãããã«ãå®å šã«å®è£ ããããšãéèŠã§ãã以äžã«ãããã€ãã®äž»èŠãªã»ãã¥ãªãã£ã«é¢ããèæ ®äºé ã瀺ããŸãã
- HTTPSã®äœ¿çšïŒã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ãèªå¯ãµãŒããŒãããã³ãªãœãŒã¹ãµãŒããŒéã®ãã¹ãŠã®éä¿¡ã¯ãçèŽãé²ãããã«HTTPSã䜿çšããŠæå·åããå¿ èŠããããŸãã
- ãªãã€ã¬ã¯ãURIã®æ€èšŒïŒãªãã€ã¬ã¯ãURIãæ³šææ·±ãæ€èšŒããŠãèªå¯ã³ãŒãã€ã³ãžã§ã¯ã·ã§ã³æ»æãé²ããŸããç»é²ããããªãã€ã¬ã¯ãURIã®ã¿ãèš±å¯ããããããé©åã«ãã©ãŒããããããŠããããšã確èªããŠãã ããã
- ã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ããã®ä¿è·ïŒã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããæ©å¯ã«ä¿ã¡ãŸããã¯ã©ã€ã¢ã³ãåŽã®ã³ãŒãã«ä¿åããããæªæ¿èªã®åœäºè ã«å ¬éãããããªãã§ãã ããã
- ç¶æ
ãã©ã¡ãŒã¿ãŒã®å®è£
ïŒ
stateãã©ã¡ãŒã¿ãŒã䜿çšããŠãCSRFæ»æãé²ããŸãã - ã¢ã¯ã»ã¹ããŒã¯ã³ã®æ€èšŒïŒãªãœãŒã¹ãµãŒããŒã¯ãä¿è·ããããªãœãŒã¹ãžã®ã¢ã¯ã»ã¹ãèš±å¯ããåã«ãã¢ã¯ã»ã¹ããŒã¯ã³ãæ€èšŒããå¿ èŠããããŸããããã«ã¯éåžžãããŒã¯ã³ã®çœ²åãšæå¹æéã®æ€èšŒãå«ãŸããŸãã
- ã¹ã³ãŒãã®å®è£ ïŒã¹ã³ãŒãã䜿çšããŠãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã«ä»äžãããæš©éãå¶éããŸããå¿ èŠãªæå°éã®æš©éã®ã¿ãä»äžããŸãã
- ããŒã¯ã³ã®ä¿åïŒããŒã¯ã³ãå®å šã«ä¿åããŸãããã€ãã£ãã¢ããªã±ãŒã·ã§ã³ã®å Žåã¯ããªãã¬ãŒãã£ã³ã°ã·ã¹ãã ã®å®å šãªã¹ãã¬ãŒãžã¡ã«ããºã ã®äœ¿çšãæ€èšããŠãã ãããWebã¢ããªã±ãŒã·ã§ã³ã®å Žåã¯ãã»ãã¥ã¢ãªCookieãŸãã¯ãµãŒããŒåŽã®ã»ãã·ã§ã³ã䜿çšããŸãã
- PKCE (Proof Key for Code Exchange) ã®æ€èšïŒã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå®å šã«ä¿åã§ããªãã¢ããªã±ãŒã·ã§ã³ (SPAããã€ãã£ãã¢ããªãªã©) ã®å Žåã¯ãPKCEã䜿çšããŠãèªå¯ã³ãŒãã®ååã®ãªã¹ã¯ã軜æžããŸãã
OpenID Connect (OIDC)
OpenID Connect (OIDC) ã¯ãOAuth2ã®äžã«æ§ç¯ãããèªèšŒã¬ã€ã€ãŒã§ããèªå¯ãµãŒããŒã«ãã£ãŠå®è¡ãããèªèšŒã«åºã¥ããŠãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ããªãœãŒã¹ææè ã® ID ãæ€èšŒããããã®æšæºåãããæ¹æ³ãããã³çžäºéçšå¯èœã§RESTã®ãããªæ¹æ³ã§ãªãœãŒã¹ææè ã«é¢ããåºæ¬çãªãããã¡ã€ã«æ å ±ãååŸããããã®æšæºåãããæ¹æ³ãæäŸããŸãã
OAuth2ã¯äž»ã«èªå¯ãã¬ãŒã ã¯ãŒã¯ã§ãããOIDCã¯èªèšŒã³ã³ããŒãã³ãã远å ãããªãœãŒã¹ãžã®ã¢ã¯ã»ã¹ãèªå¯ããã ãã§ãªãããŠãŒã¶ãŒã®IDãæ€èšŒããå¿ èŠããããŠãŒã¹ã±ãŒã¹ã«é©ããŠããŸããOIDCã¯ããŠãŒã¶ãŒã®IDã«é¢ããã¯ã¬ãŒã ãå«ãJSON Web Token (JWT) ã§ããIDããŒã¯ã³ã®æŠå¿µãå°å ¥ããŠããŸãã
OIDCãå®è£ ããå Žåãèªå¯ãµãŒããŒããã®å¿çã«ã¯ãã¢ã¯ã»ã¹ããŒã¯ã³ (ä¿è·ããããªãœãŒã¹ãžã®ã¢ã¯ã»ã¹çš) ãšIDããŒã¯ã³ (ãŠãŒã¶ãŒã®IDã®æ€èšŒçš) ã®äž¡æ¹ãå«ãŸããŸãã
OAuth2ãããã€ããŒã®éžæ
ç¬èªã®OAuth2èªå¯ãµãŒããŒãå®è£ ããããšãããµãŒãããŒãã£ãããã€ããŒã䜿çšããããšãã§ããŸããç¬èªã®èªå¯ãµãŒããŒãå®è£ ããããšã¯ãè€éã§æéããããå¯èœæ§ããããŸãããèªèšŒããã»ã¹ãå®å šã«å¶åŸ¡ã§ããŸãããµãŒãããŒãã£ãããã€ããŒã䜿çšããããšã¯ãå€ãã®å Žåãããç°¡åã§è²»çšå¯Ÿå¹æãé«ããªããŸãããèªèšŒã®ããã«ãµãŒãããŒãã£ã«äŸåããããšãæå³ããŸãã
äžè¬çãªOAuth2ãããã€ããŒã«ã¯ã次ã®ãããªãã®ããããŸãã
- Google Identity Platform
- Facebook Login
- Microsoft Azure Active Directory
- Auth0
- Okta
- Ping Identity
OAuth2ãããã€ããŒãéžæããéã«ã¯ã次ã®ãããªèŠçŽ ãèæ ®ããŠãã ããã
- äŸ¡æ Œèšå®
- æ©èœ
- ã»ãã¥ãªãã£
- ä¿¡é Œæ§
- çµ±åã®å®¹æã
- ã³ã³ãã©ã€ã¢ã³ã¹èŠä»¶ (äŸ: GDPRãCCPA)
- éçºè ãµããŒã
ããŸããŸãªç°å¢ã§ã®OAuth2
OAuth2ã¯ãWebã¢ããªã±ãŒã·ã§ã³ãã¢ãã€ã«ã¢ããªãããã¹ã¯ãããã¢ããªã±ãŒã·ã§ã³ãIoTããã€ã¹ãŸã§ãããŸããŸãªç°å¢ã§äœ¿çšãããŠããŸããç¹å®ã®å®è£ ã®è©³çްã¯ç°å¢ã«ãã£ãŠç°ãªãå ŽåããããŸãããã³ã¢ã³ã³ã»ãããšååã¯åããŸãŸã§ãã
Webã¢ããªã±ãŒã·ã§ã³
Webã¢ããªã±ãŒã·ã§ã³ã§ã¯ãOAuth2ã¯éåžžãããŒã¯ã³ã®äº€æãšã¹ãã¬ãŒãžãåŠçãããµãŒããŒåŽã®ã³ãŒãã䜿çšããŠãèªå¯ã³ãŒãã°ã©ã³ãã䜿çšããŠå®è£ ãããŸããã·ã³ã°ã«ããŒãžã¢ããªã±ãŒã·ã§ã³ (SPA) ã®å ŽåãPKCEã䜿çšããèªå¯ã³ãŒãã°ã©ã³ããæšå¥šãããã¢ãããŒãã§ãã
ã¢ãã€ã«ã¢ããªã±ãŒã·ã§ã³
ã¢ãã€ã«ã¢ããªã±ãŒã·ã§ã³ã§ã¯ãOAuth2ã¯éåžžãPKCEã䜿çšããèªå¯ã³ãŒãã°ã©ã³ãããŸãã¯OAuth2ãããã€ããŒãæäŸãããã€ãã£ãSDKã䜿çšããŠå®è£ ãããŸãããªãã¬ãŒãã£ã³ã°ã·ã¹ãã ã®å®å šãªã¹ãã¬ãŒãžã¡ã«ããºã ã䜿çšããŠãã¢ã¯ã»ã¹ããŒã¯ã³ãå®å šã«ä¿åããããšãéèŠã§ãã
ãã¹ã¯ãããã¢ããªã±ãŒã·ã§ã³
ãã¹ã¯ãããã¢ããªã±ãŒã·ã§ã³ã§ã¯ãOAuth2ã¯ãåã蟌ã¿ãã©ãŠã¶ãŒãŸãã¯ã·ã¹ãã ãã©ãŠã¶ãŒã䜿çšããèªå¯ã³ãŒãã°ã©ã³ãã䜿çšããŠå®è£ ã§ããŸããã¢ãã€ã«ã¢ããªã±ãŒã·ã§ã³ãšåæ§ã«ãã¢ã¯ã»ã¹ããŒã¯ã³ãå®å šã«ä¿åããããšãéèŠã§ãã
IoTããã€ã¹
IoTããã€ã¹ã§ã¯ããããã®ããã€ã¹ã®ãªãœãŒã¹ãšã»ãã¥ãªãã£ã®å¶çŽãéãããŠãããããOAuth2ã®å®è£ ãããå°é£ã«ãªãå¯èœæ§ããããŸããç¹å®ã®èŠä»¶ã«å¿ããŠãã¯ã©ã€ã¢ã³ãè³æ Œæ å ±ã°ã©ã³ããŸãã¯èªå¯ã³ãŒãã°ã©ã³ãã®ç°¡ç¥åãããããŒãžã§ã³ã䜿çšã§ããŸãã
äžè¬çãªOAuth2ã®åé¡ã®ãã©ãã«ã·ã¥ãŒãã£ã³ã°
OAuth2ãå®è£ ããããšã¯ãå Žåã«ãã£ãŠã¯å°é£ãªå ŽåããããŸãã以äžã«ãããã€ãã®äžè¬çãªåé¡ãšããããã®ãã©ãã«ã·ã¥ãŒãã£ã³ã°æ¹æ³ã瀺ããŸãã
- ç¡å¹ãªãªãã€ã¬ã¯ãURIïŒèªå¯ãµãŒããŒã«ç»é²ãããŠãããªãã€ã¬ã¯ãURIããèªå¯ãªã¯ãšã¹ãã§äœ¿çšãããŠããURIãšäžèŽããŠããããšã確èªããŠãã ããã
- ç¡å¹ãªã¯ã©ã€ã¢ã³ãIDãŸãã¯ã·ãŒã¯ã¬ããïŒã¯ã©ã€ã¢ã³ãIDãšã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããæ£ããããšãå確èªããŠãã ããã
- æªæ¿èªã®ã¹ã³ãŒãïŒãªã¯ãšã¹ããããã¹ã³ãŒããèªå¯ãµãŒããŒã§ãµããŒããããŠãããã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã«ãããã«ã¢ã¯ã»ã¹ããæš©éãä»äžãããŠããããšã確èªããŠãã ããã
- ã¢ã¯ã»ã¹ããŒã¯ã³ã®æå¹æéåãïŒãªãã¬ãã·ã¥ããŒã¯ã³ã䜿çšããŠãæ°ããã¢ã¯ã»ã¹ããŒã¯ã³ãååŸããŠãã ããã
- ããŒã¯ã³ã®æ€èšŒã«å€±æããŸããïŒãªãœãŒã¹ãµãŒããŒãã¢ã¯ã»ã¹ããŒã¯ã³ãé©åã«æ€èšŒããããã«æ§æãããŠããããšã確èªããŠãã ããã
- CORSãšã©ãŒïŒã¯ãã¹ãªãªãžã³ãªãœãŒã¹å ±æ (CORS) ãšã©ãŒãçºçããå Žåã¯ãèªå¯ãµãŒããŒãšãªãœãŒã¹ãµãŒããŒããã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã®ãªãªãžã³ããã®ãªã¯ãšã¹ããèš±å¯ããããã«é©åã«æ§æãããŠããããšã確èªããŠãã ããã
çµè«
OAuth2ã¯ãããŸããŸãªã¢ããªã±ãŒã·ã§ã³ã«å¯ŸããŠå®å šã§ã·ãŒã ã¬ã¹ãªãŠãŒã¶ãŒèªèšŒãå¯èœã«ããã匷åã§å€çšéã®èªå¯ãã¬ãŒã ã¯ãŒã¯ã§ããã³ã¢ã³ã³ã»ãããã°ã©ã³ãã¿ã€ããããã³ã»ãã¥ãªãã£ã«é¢ããèæ ®äºé ãçè§£ããããšã«ãããéçºè ã¯OAuth2ã广çã«å®è£ ããŠããŠãŒã¶ãŒããŒã¿ãä¿è·ããåªãããŠãŒã¶ãŒãšã¯ã¹ããªãšã³ã¹ãæäŸã§ããŸãã
ãã®ã¬ã€ãã§ã¯ãOAuth2ã®å®è£ ã«é¢ããå æ¬çãªæŠèŠã説æããŸãããè©³çŽ°ãªæ å ±ãšã¬ã€ãã³ã¹ã«ã€ããŠã¯ãå ¬åŒã®OAuth2仿§ãšãéžæããOAuth2ãããã€ããŒã®ããã¥ã¡ã³ããåç §ããŠãã ãããåžžã«ã»ãã¥ãªãã£ã®ãã¹ããã©ã¯ãã£ã¹ãåªå ããææ°ã®æšå¥šäºé ãåžžã«ææ¡ããŠããŠãŒã¶ãŒããŒã¿ã®æŽåæ§ãšæ©å¯æ§ã確ä¿ããŠãã ããã