Mobage Connect と Identity 関連技術への取り組み - OpenID Summit Tokyo 2015

Copyright (C) DeNA Co.,Ltd. All Rights Reserved.

Mobage Connect Identity

OpenID Summit 2015

November 10, 2015

Toru Yamaguchi Senior Architect Sub Business Unit Head Open Pla=orm Business Unit DeNA Co., Ltd.


! ( )

! HN @zigorou

!

!

!

! Mobage

2


! Mobage Connect (OpenID Server) CSRF Token JWT Access Token JWT Microservices Intent URI Scheme Browser Native App

! JWT Identity

3


CSRF Token JWT


4


CSRF (Cross Site Request Forgery)

! CSRF

! CSRF Token

5

()

1.

2.

3. CSRF

1. URL 2. Web

3.

Web

Web


CSRF Token

! Page A Page Token Cache Server ( memcached Redis ) Page Token Page B Cache

6

hIp://goo.gl/Wfvcz0


CSRF Token

! CSRF Token Cache Server

CSRF Token Cache Server CSRF

Token Cache Server eviction

CSRF Token CSRF Token

! JWT

7


CSRF Token JWT Claims

! /typ csrf_token /_ext /_ext/a Page Token id /_ext/t Tracking Cookie Hash /_ext/p hidden ()

8

() Mobage Connect CSRF Token


Cache ()

! JWT iat +

! Cache invalidate verified not verified

9

CSRF Token (JWT) ()

Cache invalidate JWT jU


Source AcMon DesMnaMon AcMon (1)

! CSRF Token /_ext/a sa1 da1 sa1 CSRF Token da2, da3 Reject

10

Source (sa1) Source (sa2)

Source (sa3)

Dest (da1) accept (sa1)


Dest (da3) accept (sa2, sa3)

Reject Reject


Source AcMon DesMnaMon AcMon (2)

! Action WAF Router

11

Source (sa1) Source (sa2)

Source (sa3)



Dest (da3) accept (sa2, sa3)


! Tracking Cookie CSRF Token Tracking Cookie

Reject !

submit form input[@type=hidden]

JWT object Reject

12


Access Token JWT Microservices


13


Microservices Access Token

! Microservices DB API Thin Token DB

14

AuthZ Server Token DB

Client Resource Server

Token Endpoint

1. Token Request 3. Token Response

2. Store Token

4. Request to Resource Server

Token DB


OAuth 2.0 Token IntrospecMon (RFC 7662)

! Introspection Endpoint Access Token AuthZ Server Microservices

15



Token Endpoint

1. Token Request 3. Token Response

2. Store Token 6. Lookup Token

4. Request to Resource Server

IntrospecUon Endpoint

5. IntrospecUon Request 7. IntrospecUon Response


IntrospecMon API

! API Gateway Access Token Service Service Access Token API Microservices

! API Gateway Introspection Endpoint

16

Client API Gateway

API (1)

API (3)

API (2)

1. API Request 2.

3.

4.

5.


Access Token JWT

! Access Token exp revoke Resource Server /_ext/st Scope Token ()

17

() Mobage Connect Access Token


18


Subscribe Endpoint

! Access Token revoke Resource Server AuthZ Server session_state

PubSub

19



Revoke Endpoint

1. Revoke Request 4. Revoke Response

2. Remove Token

Subscribe Endpoint

Revoke Token Subscriber Endpoint

3. Publish Revoke Event

Subscribe Endpoint Revoke Event subscribe

URL


Revoke Event

! Revoke Access Token jti Revoke Service API local revoke Access

Token

20

API

Revoked Token DB (Redis)

Service

API

Revoked Token DB (Redis)

Service Revoked

Token Publisher (Redis)

Revoke Token Subscriber Endpoint

AuthZ Server

1. Publish Token Revoked Event

2. Publish to channel Subscribe

channel

Lookup token (localhost)

Lookup token (localhost)


Revoke Token

! CSRF Token ! revoke jti Service

Redis exp

21

Access Token (JWT)

Cache revoke JWT jU

Revoke

iat exp


Intent URI Scheme Browser NaMve App


22


NaMve App OAuth 2/OIDC 1.0

! AuthZ Server Browser App

! Native App access token Implicit or Authorization Code Implicit Custom URI interception

() Native App public client client secret

Authorization Code ! Native App access token

Browser immediate login implicit

AuthZ Server Browser Native App

23


Custom URI

! Custom URI App App Redirect URI

24

hIp://tools.ie=.org/html/rfc7636


Custom URI

! Mobage Connect Native SDK

!

25


Intent URI Scheme (Chrome)

! Chrome for Android https://developer.chrome.com/multidevice/android/intents

! Android Intent Filter Native App

26

intent:{origin}{/path}{?queries*}#Intent {;package,action,category,component,scheme} ;end

intent:appId/callback? access_token=xyz123&state=abcd1234 #Intent;package=jp.or.openid; scheme=custom-scheme;end

URI Template

URI


Intent URI Scheme (Chrome)

! Original URI Intent URI Scheme ! package

package AuthZ Server Redirect URI

! package AuthZ Response

27

custom-scheme:appId/callback? access_token=xyz123&state=abcd1234

intent:appId/callback? access_token=xyz123&state=abcd1234 #Intent;package=jp.or.openid; scheme=custom-scheme;end

Original URI

Intent URI


! Chrome for Android iOS Mobile Safari Android/iOS

28


!

29

Mobage Connect と Identity 関連技術への取り組み - OpenID Summit Tokyo 2015

Technology