ã¯ããã« ããã«ã¡ã¯ãéçºæ¬éšã®éªæ¬ã§ãã ä»åã¯ç§ã瀟å
å匷äŒ(TechLunch)ã«ãŠ Amazon Redshift(ä»¥äž Redshift)ã«ã€ããŠã話ããå
容ã玹ä»ãããŠããã ããŸãã Redshift ãšã¯ æŠèŠ Redshift ãšã¯ AWS ãµãŒãã¹ãæäŸããŠããããŒã¿ãŠã§ã¢ããŠã¹ã§ãé«å¯çš/é«ããã©ãŒãã³ã¹/æè»ãªã¹ã±ãŒã©ããªãã£ãå®çŸããŠããã®ãç¹åŸŽã§ãã ç«¶åãšããŠã¯ BigQuery ã Hadoop ããŸãåã AWS ãµãŒãã¹ã§ã¯ Amazon Athena ãåæ§ã®äœçœ®ä»ãã«ãªããšæããŸãã ããŒã¿ããŒã¹ãšããŠã®ç¹åŸŽ Redshift ã®ç¹åŸŽãšããŠãåå¿ååããŒã¿ããŒã¹ãšããç¹ããããŸãã MySQL ã®ãããªãªã¬ãŒã·ã§ãã«ããŒã¿ããŒã¹ã¯ããŒã¿ãè¡ïŒã¬ã³ãŒãïŒåäœã§ä¿æããŠããäºã«å¯ŸããRedshift ã¯ååäœã§ä¿æããŠããŸãã ååäœã§ããŒã¿ãæã£ãŠããããéèšã¯ãšãªã®ãããªç¹å®ã®åã«å¯ŸããŠå€§éã®è¡ã粟æ»ããã®ãé«éã§ããåé¢ãè¡ãç¹å®ããŠã®ã¢ã¯ã»ã¹ã¯ MySQL ã PostgreSQL ã®ãããªè¡å¿åã®ããŒã¿ããŒã¹ã«æ¯ã¹ãŠã®ã¯ãšãªã«æ¯ã¹ãŠé
ãåŸåã«ãããŸãã ãŸãããŒã¿ã«ã¯ SQL ã§ã¢ã¯ã»ã¹ããããšãã§ããæ§æã PostgreSQL ãšäºææ§ããããŸãã æè¿ã¹ããŒãã¬ã¹ãªããŒã¿ããŒã¹ãªã©ãå€ãåºãŠããŠããŸãããRedshift ã¯äºåã«ããŒãã«ãäœæããå¿
èŠã®ããåŸæ¥åã® RDBMS ã®åœ¢ãšãªã£ãŠãããããŒãã«äœææã¯ CREATE TABLE ãšãã£ãããŒã¿å®çŸ©èšèª(DDL)ã䜿ãããšã«ãªããŸãã æ©èœé¢ã®ç¹åŸŽ å
ã«ãæžããŸããããããŒã¿ã¢ã¯ã»ã¹æã«äœ¿ã SQL 㯠PostgreSQL ã®æ§æãšäºææ§ããããŸãã ãã£ãŠ PostgreSQL çšãã©ã€ã(JDBC å«ã)ãã䜿ããã°ãåŸã¯ç¹å¥ã«æèããããšãªã Redshift ã«å¯ŸããŠæ¥ç¶ãã¯ãšãªçºè¡ãè¡ãããšããããšã«ãªããŸãã ãã®æ©æµã¯ããã°ã©ã ã ãã§ã¯ãªãä»ç€Ÿãå±éããŠãããµãŒãã¹ã«ãåããããšãã§ããBI ããŒã«ã® Tableau ã Redash ãªã©ããã®ãŸãŸããŒã¿ãœãŒã¹ãšããŠå©çšããããšãåºæ¥ãŸãã æ¬¡ã«ãäžè¬ç㪠RDBMS ãšã®å·®ã«ã€ããŠã§ãã RDBMS ã«ã¯ãã Redshift ã«ã¯ç¡ããã®ãšããŠã¯ UNIQUE å¶çŽ å€éšããŒå¶çŽ ã€ã³ããã¯ã¹ãç¡ã ãªã©ããããŸãã ã€ã³ããã¯ã¹ã«é¢ããŠã¯é ãæå³ã§ã®ä»£çšå(Sort Key)ããããã®ã®ãåºæ¬çã«ã¯äœ¿ãããšãåºæ¥ãŸããã æ³šæç¹ãšããŠã¯ãšãªèªäœã¯ PostgreSQL äºæãªã®ã§ããããäœã DDL æ§æãåãå
¥ããŠããããŸãããRedshift ã§ã¯ç¡èŠãããŸãã®ã§ã泚æãã ããã éã«ãRedshift åºæã®ãã®ãšããŠã¯ Sort Key 忣ã㌠åå§çž® ãªã©ããããŸãã ãããã«ã€ããŠã¯ä»¥äžã§å°ãæãäžããŠèª¬æããŸãã Sort Key ããŒãã«ããœãŒãããéã«äœ¿ãã€ã³ããã¯ã¹ã®ãããªãã®ã§ãã ååäœã§æå®ããããšãã§ãã ORDER BY ã GROUP BY å¥ãªã©ã®ç²Ÿæ»é床ã«åœ±é¿ããŸãã 忣ã㌠MySQL ã§ããããŒãã£ã·ã§ãã³ã°ããŒã«è¿ããã®ãšãªããŸãã Redshift ã®ããŒã¿åæ£æ¹æ³ã¯ åçã«åæ£ ããŒå€ã«ãã忣 å
šã³ã㌠AutoïŒè² è·ç¶æ³ã«ããèªåéžæ) ã® 4 ã€ã§ãããŒã¿éãç¹æ§ã«ãã£ãŠäœ¿ãåããããšãåºæ¥ãŸãã 忣ããŒã¯ Redshift ãäžèšã®æ¹æ³ã§ã¯ã©ã¹ã¿ãªã³ã°ããéã«ãã©ã®ããŒãã«ã©ã®ããŒã¿ãä¿æããããæ±ºå®ãã倿ææãšãªãããŒã§ãã éçšé¢ã®ç¹åŸŽ AWS ã³ã³ãœãŒã« Redshift 㯠AWS ã³ã³ãœãŒã«äžãããè©³çŽ°ãªæ
å ±ã確èªããããšãåºæ¥ãŸãã Amazon RDS ã«ãããããªäžè¬çãªã¡ããªã¯ã¹ã«å ããŠã¯ãšãªåäœã§ã®å®è¡ç¶æ³ãå®è¡èšç»ããããŠã¯ãšãªã®åŒ·å¶åæ¢ãã³ã³ãœãŒã«ããå®è¡ããããšãã§ããŸãã ããŒã¿åã蟌㿠Redshift ã¯ã€ã³ããŒãå
ãšãªãããŒã¿åã蟌ã¿éžæè¢ãè±å¯ãšããããšãç¹åŸŽã®äžã€ã§ãã åã蟌ã¿å¯èœãªåœ¢åŒ CSV/JSON/AVRO/PARQUET/ORC + ãããã®åœ¢åŒãå§çž®ãããã®(BZIP,GZIP ãªã©) èªã¿åãå
Amazon S3 / Amazon EMR / Amazon DynamoDB ãªã© ç¹ã«ããŒã¿é
眮å
ãšã㊠S3 ããµããŒããããŠããã®ã§ãåçš®ãµãŒãã¹ãåºåãããã°ãã Amazon CloudWatch Logs ããã® S3 ã Amazon Kinesis Data Firehose ããã® S3 ã»ã»ãªã©ãçµã¿åããæ¬¡ç¬¬ã§å¯èœæ§ããšãŠãåºãããŸãã ãŸã S3 ã«é
眮ããŠããããŒã¿ã¯ã€ã³ããŒãããã«å€éšããŒãã«ãšããŠçŽæ¥ã¯ãšãªãå®è¡ããæ©èœ Amazon Redshift Spectrum ããããŸããããŒã¿éããšãŠãå€ãå Žåãªã©ã«ã¯ãã¡ããå©çšããã®ãæå¹ãªææ®µã§ãã ã¯ãŒã¯ããŒã管ç è² è·ã«é¢ããéçšã«ã€ããŠã¯ WLM(Work Load Management)ãšããæ©èœããããŸãã ãã㯠Redshift ã«æ¥ç¶ãããŠãŒã¶ãã°ã«ãŒãåäœã§è² è·å¶åŸ¡ãè¡ãããšãåºæ¥ãæ©èœã§ãã å¶åŸ¡ã§ããé
ç®ãšããŠã¯ 䞊åã¯ãšãªå®è¡æ° åäžã°ã«ãŒãå
ã§ã®ã¯ãšãªåæå®è¡æ°ãäžéã«éãããšåŸ
ã¡è¡åã«å
¥ã£ãŠè©°ãŸãã ã¯ãšãªå®è¡æé ã¯ãšãªå®è¡æéã®äžéã ã¡ã¢ãªäœ¿çšé ã¯ãšãªå®è¡æã«äœ¿ãã¡ã¢ãªäœ¿çšéã®äžéã ãªã©ããããŸãã å¯çšæ§ã«ã€ã㊠Redshift ã¯ã¯ã©ã¹ã¿ãªã³ã°ããµããŒãããŠãããã¯ã©ã¹ã¿ã«ã¯ã¯ãšãªã®åŸ
åãè¡ããªãŒããŒ(Leader)ããŒããšå®åŠçãè¡ãã³ã³ãã¥ãŒãã£ã³ã°ããŒããäœæãããŸãã AWS ãæšå¥šããŠããããã«ãRedshift ã¯ãã«ãããŒãéçšãåºæ¬ãšããŠããŸãã ãã㯠Redshift ã®åã
ã®ããŒã¿ããŒã㯠RAID5 ã®ãããªåœ¢ã§åããŒãã«åæ£ããŠãããããããŒãé害ãçºçããå Žåã§ãçåããŒãããããŒã埩æ§ãèªåã§è¡ã£ãŠãããŸãã ïŒåæã«é害ãçºçããŠã埩æ§å¯èœãªããŒãæ°ã«ã€ããŠã¯ãã¯ã©ã¹ã¿å
ã®ããŒãæ°ã«äŸåããŸãïŒ å°æ¥æ§ã«ã€ã㊠éå»ïŒå¹Žåã®éã§ãããã ãã®æ°æ©èœã远å ãããŠããããŸã ãŸã é²åããŠããŸãã UNLOAD ã³ãã³ãã® CSV å¯Ÿå¿ Concurrency Scaling ALTER æã§ VARCHAR ã®æ¡æ°å€æŽ Elastic Resize UNLOAD ã³ãã³ãã®ãããè¡åºåå¯Ÿå¿ ã³ã³ãœãŒã«ã«ãŠã¯ãšãªå®è¡ç°å¢è¿œå ãã¹ãåãããããŒã¿ã®ãµããŒã èªåããŒãžã§ã³ã¢ããæ¹åŒã®èšå®ïŒäºå確èªå¯èœ ParquetãORC ããã® IMPORT ãµããŒã Amazon Redshift Spectrum æ±äº¬ãµããŒã æ°ããŒãã¿ã€ã DC2 Query Editor ã®è¿œå PL/SQL ããã·ãŒãžã£ã®ãµããŒã Vacum ã³ãã³ãã®èªåå New!!(2018/12 ãªãªãŒã¹) WLM ã¯ãŒã¯ããŒã管çã®èªåå New!!(2019/06 ãªãªãŒã¹) å®éã®äœ¿ãåæ ã§ã¯ãå®éã®ãšãã Redshift ã®äœ¿ãåæãã©ããã£ããã®ãªã®ããå®äŸãå«ããŠç޹ä»ããŸãã ããã§ã¯ dc2.large ããŒãæ° 2 ã®ãµã³ãã«ç°å¢ã䜿çšããŸãã ããŒã¿ã®ããŒã ã¯ãšãªãçºè¡ããã«ãããŸãã¯å
ã«ãªãããŒã¿ãå¿
èŠã§ãã ããã§ã¯ æ¥æ¬èª Wikipedia ã®ç®æ¬¡ãã³ãããŒã¿ ã 100 ã»ããåçšæãããã®å
容ã Redshift ã«ããŒãããŠã¿ãŸãã ãŸãã¯ç®æ¬¡ããŒã¿ããã¡ãã®ç»åã®æ§ã«å å·¥ãã100 ã»ããåã®ãã¡ã€ã«ãšããŠåå²ã S3 ãžãšã¢ããããŒãããŸãã ä»åã®ããŒãããããŒã¿é㯠235,732,000 ã¬ã³ãŒãã® 11.9GB ãšãªããŸããã S3 ã«ãã¡ã€ã«ãé
çœ®åºæ¥ããããããæ ŒçŽããããŒãã«ã Redshift ã«äœããŸãã ãã®é PostgreSQL ã® CREATE TABLE ã«ãã£ãŠããŒãã«ãäœæããŸãã ããŒãã«ã®äœæãå®äºããããæ¬¡ã¯ããŒã¿ã®ããŒãã§ãã ããã SQL ã¯ãšãªã® COPY ã³ãã³ãã«ãã£ãŠåã蟌ã¿ãè¡ãããŸãã ä»åãã®ããŒãåŠç㯠8 å 55 ç§ ã§å®äºããŸããã ããŒã¿éããèãããšããªãæ©ããšæããŸãããããã¯ããŒãåŠçã«ãããŠäžŠååŠçã®æ©æµãæå€§éã«åããŠãããšããããšãçç±ãšèããããŸãã Redshift ã®ããŒãåŠçã¯åå²ããããã¡ã€ã«ã䜿ã£ãŠäžŠååŠçãå®è¡ããããã巚倧ãªåäžãã¡ã€ã«ãåã蟌ãããçæéã§åã蟌ãããšãã§ããŸãã ã¯ãšãªçºè¡ 次ã«ãã¯ãšãªçºè¡ã«ã€ããŠã§ãããããã¯ãã®ãŸãŸ PostgreSQL ã®ã¯ãšãªãå®è¡ããããšã«ãªããŸãã ä»åã¯å
ã®ã¹ãããã§åã蟌ãã ç®æ¬¡ããŒãžãã¿ã€ãã«ããšã« DISTINCT ããéèšã¯ãšãªãçºè¡ããŠã¿ãŸãã ãããš 49 ç§ ã§çµæãåž°ã£ãŠããŸããã æäœéã®ã¹ããã¯ã§ 235,732,000 ã¬ã³ãŒãã粟æ»ããã¯ãšãªã®å®è¡æéãšããŠã¯è¯ãã¹ã³ã¢ã§ã¯ãªãã§ããããã äžäŸ¿ã«æããããš ããã§ã¯ç§ã Redshift ãéçšããŠããŠäžäŸ¿ã«æããäºãããã€ã玹ä»ããŸãã æéãé«ã ããã ãã®æ©èœãšã¹ããã¯ãå«ãŸããŠããã®ã§ä»æ¹ãç¡ããããããŸããããAWS ã®ä»ã®ãµãŒãã¹ãšæ¯èŒããŠé«äŸ¡ãªå°è±¡ããããŸãã ããã«ãã«ãããŒããšãªããšæéãæãç®ã§å¢ããããšã«ãªããã¹ããã¯ã®éžæè¢ãä»ã®ãµãŒãã¹ãšæ¯ã¹ãŠãå°ãªãããéçšã®éã«ã¯ããèŠç©ãããããããšãããããããŸãã æŽæ°ã¯ãšãªãé
ã åå¿ååã®ãããªã®ãã©ã³ãã ã¢ã¯ã»ã¹ãèŠæã§ãç¹å®ã®è¡ãæ¢ããŠæŽæ°ãã UPDATE ã DELETE ã¯é
ãã§ãã ãããã Redshift ã¯é »ç¹ã« UPDATE / DELETE ããçšéã«ã¯åããŠãããïŒåŸè¿°ïŒã INSERT ã®ã¿ã®ç©ã¿äžãåãå
šã¬ã³ãŒãæŽãæ¿ããåºæ¬ã®çšéã«ãªããŸãã ãŸãã UPDATE / DELETE ãç¹°ãè¿ããšããã©ãŒãã³ã¹ãäœäžããŸãã ããã¯å
éšçã«ä¿æããŠãã SortKey ã®ç¶æ
ãæŽæ°ãããã³ã«å£åããé£åããŠããã©ãŒãã³ã¹ãäœäžããããã§ãã è§£æ¶ããããã«ã¯ SortKey ã®åæ§ç¯ïŒ VACUM / OPTIMIZE ã³ãã³ã)ã«ããå埩ããŸãããããããã³ãã³ãå®è¡æéãé·ããè² è·ã倧ããã®ã§å®è¡ã¿ã€ãã³ã°ã¯æ€èšãå¿
èŠãšãªããŸãã (远èš) 2018/12 ã® ã¢ããããŒã ã§èªåå®è¡æ©èœã远å ãããŸããïŒ AWS ã³ã³ãœãŒã«ãæ©èœããªãããšããã å
ã«å€ãã®äŸ¿å©ãªæ©èœã玹ä»ããŸãããããªãããããã AWS ã³ã³ãœãŒã«äžã§æ©èœããŠãããªãããšãå²ãšãããŸãã WLM ã®èšå®æ¬¡ç¬¬ãªã®ãäžæã§ãããå®è¡äžã®ã¯ãšãªãåºãªãã£ããã¯ãšãªã®åŒ·å¶åæ¢ãå¹ããªããªã©ãã€ã¶ãšããæã«éã£ãŠäœ¿ããªãããšããããããŸããã ã¡ã³ããã³ã¹ãé«é »åºŠ æ°æ©èœãç¶ã
远å ãããŠãããšç޹ä»ããŠããŸããããã®åºŠã«ã¡ã³ããã³ã¹ãçºçãããã®ãšãªããŸãã ã¿ã€ãã³ã°ã¯äºåã«èšå®ããã¡ã³ããã³ã¹ãŠã€ã³ããŠã®é±äžã®ææ¥/æé垯ã§ãããçµéšãã 2 é±éã« 1 床ãããã®é »åºŠã§çºçããŠããŸããã ãã®æé垯ã¯åèµ·åã䌎ãå ŽåããããããWrite ã©ããã Read ããåºæ¥ãªãç¶æ
ã«ãªãããšããããŸãã ãã®ããæ¥äžã¯ç€Ÿå
æ¥åãå€éã¯ãããã§ãšãã£ãïŒïŒæéãã£ãšçšŒåããèŠä»¶ãæºããäºã¯å°ãå³ãããã®ãšãªããŸãã ãŸãšã ãŸãšããšãšãªããŸãããRedshift ã¯ç¹åŸŽããµãŸãããšäžèšã®ãããªå Žé¢ã§å©çšããã°è¯ãããªãšæããŠããŸãã BI ããŒã«çã®ããŒã¿ãœãŒã¹ãšã㊠ã¡ã³ãé »åºŠãè² è·ã®åé¡ãããã®ã§ãèªåéã®ã¢ããªããçŽæ¥ã¯ç¹ããªãã å±¥æŽããã¹ã¿ããŒã¿ã®ãããªå€§éã®ç©ã¿äžãåããŒã¿ã®éèš UPDATE ãçºçãããªããå
šä»¶å
¥ãæ¿ããå¯èœãªããŒã¿ã ïŒæ¥ã®å©çšé »åºŠããããªãã«ããããš é »åºŠãé«ãç¡ãã®ã§ããã°ãAthena ã®æ¹ãå®ãã ã©ã®ãµãŒãã¹ã«ãèšããããšã§ãããèŠä»¶ã®åã£ããµãŒãã¹éžã³ãããããšãäžçªå€§äºã§ãã Redshift ã«ã€ããŠãç¹åŸŽãã¯ã£ããããŠããã¿ã€ãã®ãµãŒãã¹ãªã®ã§ã䜿ãæãééããªãããã«ãäžæã䜿ã£ãŠãããã°ãšæããŸãã
ã¯ããã« ããã«ã¡ã¯ãéçºæ¬éšã®éªæ¬ã§ãã ä»åã¯ç§ã瀟å
å匷äŒ(TechLunch)ã«ãŠ Amazon Redshift(ä»¥äž Redshift)ã«ã€ããŠã話ããå
容ã玹ä»ãããŠããã ããŸãã Redshift ãšã¯ æŠèŠ Redshift ãšã¯ AWS ãµãŒãã¹ãæäŸããŠããããŒã¿ãŠã§ã¢ããŠã¹ã§ãé«å¯çš/é«ããã©ãŒãã³ã¹/æè»ãªã¹ã±ãŒã©ããªãã£ãå®çŸããŠããã®ãç¹åŸŽã§ãã ç«¶åãšããŠã¯ BigQuery ã Hadoop ããŸãåã AWS ãµãŒãã¹ã§ã¯ Amazon Athena ãåæ§ã®äœçœ®ä»ãã«ãªããšæããŸãã ããŒã¿ããŒã¹ãšããŠã®ç¹åŸŽ Redshift ã®ç¹åŸŽãšããŠãåå¿ååããŒã¿ããŒã¹ãšããç¹ããããŸãã MySQL ã®ãããªãªã¬ãŒã·ã§ãã«ããŒã¿ããŒã¹ã¯ããŒã¿ãè¡ïŒã¬ã³ãŒãïŒåäœã§ä¿æããŠããäºã«å¯ŸããRedshift ã¯ååäœã§ä¿æããŠããŸãã ååäœã§ããŒã¿ãæã£ãŠããããéèšã¯ãšãªã®ãããªç¹å®ã®åã«å¯ŸããŠå€§éã®è¡ã粟æ»ããã®ãé«éã§ããåé¢ãè¡ãç¹å®ããŠã®ã¢ã¯ã»ã¹ã¯ MySQL ã PostgreSQL ã®ãããªè¡å¿åã®ããŒã¿ããŒã¹ã«æ¯ã¹ãŠã®ã¯ãšãªã«æ¯ã¹ãŠé
ãåŸåã«ãããŸãã ãŸãããŒã¿ã«ã¯ SQL ã§ã¢ã¯ã»ã¹ããããšãã§ããæ§æã PostgreSQL ãšäºææ§ããããŸãã æè¿ã¹ããŒãã¬ã¹ãªããŒã¿ããŒã¹ãªã©ãå€ãåºãŠããŠããŸãããRedshift ã¯äºåã«ããŒãã«ãäœæããå¿
èŠã®ããåŸæ¥åã® RDBMS ã®åœ¢ãšãªã£ãŠãããããŒãã«äœææã¯ CREATE TABLE ãšãã£ãããŒã¿å®çŸ©èšèª(DDL)ã䜿ãããšã«ãªããŸãã æ©èœé¢ã®ç¹åŸŽ å
ã«ãæžããŸããããããŒã¿ã¢ã¯ã»ã¹æã«äœ¿ã SQL 㯠PostgreSQL ã®æ§æãšäºææ§ããããŸãã ãã£ãŠ PostgreSQL çšãã©ã€ã(JDBC å«ã)ãã䜿ããã°ãåŸã¯ç¹å¥ã«æèããããšãªã Redshift ã«å¯ŸããŠæ¥ç¶ãã¯ãšãªçºè¡ãè¡ãããšããããšã«ãªããŸãã ãã®æ©æµã¯ããã°ã©ã ã ãã§ã¯ãªãä»ç€Ÿãå±éããŠãããµãŒãã¹ã«ãåããããšãã§ããBI ããŒã«ã® Tableau ã Redash ãªã©ããã®ãŸãŸããŒã¿ãœãŒã¹ãšããŠå©çšããããšãåºæ¥ãŸãã æ¬¡ã«ãäžè¬ç㪠RDBMS ãšã®å·®ã«ã€ããŠã§ãã RDBMS ã«ã¯ãã Redshift ã«ã¯ç¡ããã®ãšããŠã¯ UNIQUE å¶çŽ å€éšããŒå¶çŽ ã€ã³ããã¯ã¹ãç¡ã ãªã©ããããŸãã ã€ã³ããã¯ã¹ã«é¢ããŠã¯é ãæå³ã§ã®ä»£çšå(Sort Key)ããããã®ã®ãåºæ¬çã«ã¯äœ¿ãããšãåºæ¥ãŸããã æ³šæç¹ãšããŠã¯ãšãªèªäœã¯ PostgreSQL äºæãªã®ã§ããããäœã DDL æ§æãåãå
¥ããŠããããŸãããRedshift ã§ã¯ç¡èŠãããŸãã®ã§ã泚æãã ããã éã«ãRedshift åºæã®ãã®ãšããŠã¯ Sort Key 忣ã㌠åå§çž® ãªã©ããããŸãã ãããã«ã€ããŠã¯ä»¥äžã§å°ãæãäžããŠèª¬æããŸãã Sort Key ããŒãã«ããœãŒãããéã«äœ¿ãã€ã³ããã¯ã¹ã®ãããªãã®ã§ãã ååäœã§æå®ããããšãã§ãã ORDER BY ã GROUP BY å¥ãªã©ã®ç²Ÿæ»é床ã«åœ±é¿ããŸãã 忣ã㌠MySQL ã§ããããŒãã£ã·ã§ãã³ã°ããŒã«è¿ããã®ãšãªããŸãã Redshift ã®ããŒã¿åæ£æ¹æ³ã¯ åçã«åæ£ ããŒå€ã«ãã忣 å
šã³ã㌠AutoïŒè² è·ç¶æ³ã«ããèªåéžæ) ã® 4 ã€ã§ãããŒã¿éãç¹æ§ã«ãã£ãŠäœ¿ãåããããšãåºæ¥ãŸãã 忣ããŒã¯ Redshift ãäžèšã®æ¹æ³ã§ã¯ã©ã¹ã¿ãªã³ã°ããéã«ãã©ã®ããŒãã«ã©ã®ããŒã¿ãä¿æããããæ±ºå®ãã倿ææãšãªãããŒã§ãã éçšé¢ã®ç¹åŸŽ AWS ã³ã³ãœãŒã« Redshift 㯠AWS ã³ã³ãœãŒã«äžãããè©³çŽ°ãªæ
å ±ã確èªããããšãåºæ¥ãŸãã Amazon RDS ã«ãããããªäžè¬çãªã¡ããªã¯ã¹ã«å ããŠã¯ãšãªåäœã§ã®å®è¡ç¶æ³ãå®è¡èšç»ããããŠã¯ãšãªã®åŒ·å¶åæ¢ãã³ã³ãœãŒã«ããå®è¡ããããšãã§ããŸãã ããŒã¿åã蟌㿠Redshift ã¯ã€ã³ããŒãå
ãšãªãããŒã¿åã蟌ã¿éžæè¢ãè±å¯ãšããããšãç¹åŸŽã®äžã€ã§ãã åã蟌ã¿å¯èœãªåœ¢åŒ CSV/JSON/AVRO/PARQUET/ORC + ãããã®åœ¢åŒãå§çž®ãããã®(BZIP,GZIP ãªã©) èªã¿åãå
Amazon S3 / Amazon EMR / Amazon DynamoDB ãªã© ç¹ã«ããŒã¿é
眮å
ãšã㊠S3 ããµããŒããããŠããã®ã§ãåçš®ãµãŒãã¹ãåºåãããã°ãã Amazon CloudWatch Logs ããã® S3 ã Amazon Kinesis Data Firehose ããã® S3 ã»ã»ãªã©ãçµã¿åããæ¬¡ç¬¬ã§å¯èœæ§ããšãŠãåºãããŸãã ãŸã S3 ã«é
眮ããŠããããŒã¿ã¯ã€ã³ããŒãããã«å€éšããŒãã«ãšããŠçŽæ¥ã¯ãšãªãå®è¡ããæ©èœ Amazon Redshift Spectrum ããããŸããããŒã¿éããšãŠãå€ãå Žåãªã©ã«ã¯ãã¡ããå©çšããã®ãæå¹ãªææ®µã§ãã ã¯ãŒã¯ããŒã管ç è² è·ã«é¢ããéçšã«ã€ããŠã¯ WLM(Work Load Management)ãšããæ©èœããããŸãã ãã㯠Redshift ã«æ¥ç¶ãããŠãŒã¶ãã°ã«ãŒãåäœã§è² è·å¶åŸ¡ãè¡ãããšãåºæ¥ãæ©èœã§ãã å¶åŸ¡ã§ããé
ç®ãšããŠã¯ 䞊åã¯ãšãªå®è¡æ° åäžã°ã«ãŒãå
ã§ã®ã¯ãšãªåæå®è¡æ°ãäžéã«éãããšåŸ
ã¡è¡åã«å
¥ã£ãŠè©°ãŸãã ã¯ãšãªå®è¡æé ã¯ãšãªå®è¡æéã®äžéã ã¡ã¢ãªäœ¿çšé ã¯ãšãªå®è¡æã«äœ¿ãã¡ã¢ãªäœ¿çšéã®äžéã ãªã©ããããŸãã å¯çšæ§ã«ã€ã㊠Redshift ã¯ã¯ã©ã¹ã¿ãªã³ã°ããµããŒãããŠãããã¯ã©ã¹ã¿ã«ã¯ã¯ãšãªã®åŸ
åãè¡ããªãŒããŒ(Leader)ããŒããšå®åŠçãè¡ãã³ã³ãã¥ãŒãã£ã³ã°ããŒããäœæãããŸãã AWS ãæšå¥šããŠããããã«ãRedshift ã¯ãã«ãããŒãéçšãåºæ¬ãšããŠããŸãã ãã㯠Redshift ã®åã
ã®ããŒã¿ããŒã㯠RAID5 ã®ãããªåœ¢ã§åããŒãã«åæ£ããŠãããããããŒãé害ãçºçããå Žåã§ãçåããŒãããããŒã埩æ§ãèªåã§è¡ã£ãŠãããŸãã ïŒåæã«é害ãçºçããŠã埩æ§å¯èœãªããŒãæ°ã«ã€ããŠã¯ãã¯ã©ã¹ã¿å
ã®ããŒãæ°ã«äŸåããŸãïŒ å°æ¥æ§ã«ã€ã㊠éå»ïŒå¹Žåã®éã§ãããã ãã®æ°æ©èœã远å ãããŠããããŸã ãŸã é²åããŠããŸãã UNLOAD ã³ãã³ãã® CSV å¯Ÿå¿ Concurrency Scaling ALTER æã§ VARCHAR ã®æ¡æ°å€æŽ Elastic Resize UNLOAD ã³ãã³ãã®ãããè¡åºåå¯Ÿå¿ ã³ã³ãœãŒã«ã«ãŠã¯ãšãªå®è¡ç°å¢è¿œå ãã¹ãåãããããŒã¿ã®ãµããŒã èªåããŒãžã§ã³ã¢ããæ¹åŒã®èšå®ïŒäºå確èªå¯èœ ParquetãORC ããã® IMPORT ãµããŒã Amazon Redshift Spectrum æ±äº¬ãµããŒã æ°ããŒãã¿ã€ã DC2 Query Editor ã®è¿œå PL/SQL ããã·ãŒãžã£ã®ãµããŒã Vacum ã³ãã³ãã®èªåå New!!(2018/12 ãªãªãŒã¹) WLM ã¯ãŒã¯ããŒã管çã®èªåå New!!(2019/06 ãªãªãŒã¹) å®éã®äœ¿ãåæ ã§ã¯ãå®éã®ãšãã Redshift ã®äœ¿ãåæãã©ããã£ããã®ãªã®ããå®äŸãå«ããŠç޹ä»ããŸãã ããã§ã¯ dc2.large ããŒãæ° 2 ã®ãµã³ãã«ç°å¢ã䜿çšããŸãã ããŒã¿ã®ããŒã ã¯ãšãªãçºè¡ããã«ãããŸãã¯å
ã«ãªãããŒã¿ãå¿
èŠã§ãã ããã§ã¯ æ¥æ¬èª Wikipedia ã®ç®æ¬¡ãã³ãããŒã¿ ã 100 ã»ããåçšæãããã®å
容ã Redshift ã«ããŒãããŠã¿ãŸãã ãŸãã¯ç®æ¬¡ããŒã¿ããã¡ãã®ç»åã®æ§ã«å å·¥ãã100 ã»ããåã®ãã¡ã€ã«ãšããŠåå²ã S3 ãžãšã¢ããããŒãããŸãã ä»åã®ããŒãããããŒã¿é㯠235,732,000 ã¬ã³ãŒãã® 11.9GB ãšãªããŸããã S3 ã«ãã¡ã€ã«ãé
çœ®åºæ¥ããããããæ ŒçŽããããŒãã«ã Redshift ã«äœããŸãã ãã®é PostgreSQL ã® CREATE TABLE ã«ãã£ãŠããŒãã«ãäœæããŸãã ããŒãã«ã®äœæãå®äºããããæ¬¡ã¯ããŒã¿ã®ããŒãã§ãã ããã SQL ã¯ãšãªã® COPY ã³ãã³ãã«ãã£ãŠåã蟌ã¿ãè¡ãããŸãã ä»åãã®ããŒãåŠç㯠8 å 55 ç§ ã§å®äºããŸããã ããŒã¿éããèãããšããªãæ©ããšæããŸãããããã¯ããŒãåŠçã«ãããŠäžŠååŠçã®æ©æµãæå€§éã«åããŠãããšããããšãçç±ãšèããããŸãã Redshift ã®ããŒãåŠçã¯åå²ããããã¡ã€ã«ã䜿ã£ãŠäžŠååŠçãå®è¡ããããã巚倧ãªåäžãã¡ã€ã«ãåã蟌ãããçæéã§åã蟌ãããšãã§ããŸãã ã¯ãšãªçºè¡ 次ã«ãã¯ãšãªçºè¡ã«ã€ããŠã§ãããããã¯ãã®ãŸãŸ PostgreSQL ã®ã¯ãšãªãå®è¡ããããšã«ãªããŸãã ä»åã¯å
ã®ã¹ãããã§åã蟌ãã ç®æ¬¡ããŒãžãã¿ã€ãã«ããšã« DISTINCT ããéèšã¯ãšãªãçºè¡ããŠã¿ãŸãã ãããš 49 ç§ ã§çµæãåž°ã£ãŠããŸããã æäœéã®ã¹ããã¯ã§ 235,732,000 ã¬ã³ãŒãã粟æ»ããã¯ãšãªã®å®è¡æéãšããŠã¯è¯ãã¹ã³ã¢ã§ã¯ãªãã§ããããã äžäŸ¿ã«æããããš ããã§ã¯ç§ã Redshift ãéçšããŠããŠäžäŸ¿ã«æããäºãããã€ã玹ä»ããŸãã æéãé«ã ããã ãã®æ©èœãšã¹ããã¯ãå«ãŸããŠããã®ã§ä»æ¹ãç¡ããããããŸããããAWS ã®ä»ã®ãµãŒãã¹ãšæ¯èŒããŠé«äŸ¡ãªå°è±¡ããããŸãã ããã«ãã«ãããŒããšãªããšæéãæãç®ã§å¢ããããšã«ãªããã¹ããã¯ã®éžæè¢ãä»ã®ãµãŒãã¹ãšæ¯ã¹ãŠãå°ãªãããéçšã®éã«ã¯ããèŠç©ãããããããšãããããããŸãã æŽæ°ã¯ãšãªãé
ã åå¿ååã®ãããªã®ãã©ã³ãã ã¢ã¯ã»ã¹ãèŠæã§ãç¹å®ã®è¡ãæ¢ããŠæŽæ°ãã UPDATE ã DELETE ã¯é
ãã§ãã ãããã Redshift ã¯é »ç¹ã« UPDATE / DELETE ããçšéã«ã¯åããŠãããïŒåŸè¿°ïŒã INSERT ã®ã¿ã®ç©ã¿äžãåãå
šã¬ã³ãŒãæŽãæ¿ããåºæ¬ã®çšéã«ãªããŸãã ãŸãã UPDATE / DELETE ãç¹°ãè¿ããšããã©ãŒãã³ã¹ãäœäžããŸãã ããã¯å
éšçã«ä¿æããŠãã SortKey ã®ç¶æ
ãæŽæ°ãããã³ã«å£åããé£åããŠããã©ãŒãã³ã¹ãäœäžããããã§ãã è§£æ¶ããããã«ã¯ SortKey ã®åæ§ç¯ïŒ VACUM / OPTIMIZE ã³ãã³ã)ã«ããå埩ããŸãããããããã³ãã³ãå®è¡æéãé·ããè² è·ã倧ããã®ã§å®è¡ã¿ã€ãã³ã°ã¯æ€èšãå¿
èŠãšãªããŸãã (远èš) 2018/12 ã® ã¢ããããŒã ã§èªåå®è¡æ©èœã远å ãããŸããïŒ AWS ã³ã³ãœãŒã«ãæ©èœããªãããšããã å
ã«å€ãã®äŸ¿å©ãªæ©èœã玹ä»ããŸãããããªãããããã AWS ã³ã³ãœãŒã«äžã§æ©èœããŠãããªãããšãå²ãšãããŸãã WLM ã®èšå®æ¬¡ç¬¬ãªã®ãäžæã§ãããå®è¡äžã®ã¯ãšãªãåºãªãã£ããã¯ãšãªã®åŒ·å¶åæ¢ãå¹ããªããªã©ãã€ã¶ãšããæã«éã£ãŠäœ¿ããªãããšããããããŸããã ã¡ã³ããã³ã¹ãé«é »åºŠ æ°æ©èœãç¶ã
远å ãããŠãããšç޹ä»ããŠããŸããããã®åºŠã«ã¡ã³ããã³ã¹ãçºçãããã®ãšãªããŸãã ã¿ã€ãã³ã°ã¯äºåã«èšå®ããã¡ã³ããã³ã¹ãŠã€ã³ããŠã®é±äžã®ææ¥/æé垯ã§ãããçµéšãã 2 é±éã« 1 床ãããã®é »åºŠã§çºçããŠããŸããã ãã®æé垯ã¯åèµ·åã䌎ãå ŽåããããããWrite ã©ããã Read ããåºæ¥ãªãç¶æ
ã«ãªãããšããããŸãã ãã®ããæ¥äžã¯ç€Ÿå
æ¥åãå€éã¯ãããã§ãšãã£ãïŒïŒæéãã£ãšçšŒåããèŠä»¶ãæºããäºã¯å°ãå³ãããã®ãšãªããŸãã ãŸãšã ãŸãšããšãšãªããŸãããRedshift ã¯ç¹åŸŽããµãŸãããšäžèšã®ãããªå Žé¢ã§å©çšããã°è¯ãããªãšæããŠããŸãã BI ããŒã«çã®ããŒã¿ãœãŒã¹ãšã㊠ã¡ã³ãé »åºŠãè² è·ã®åé¡ãããã®ã§ãèªåéã®ã¢ããªããçŽæ¥ã¯ç¹ããªãã å±¥æŽããã¹ã¿ããŒã¿ã®ãããªå€§éã®ç©ã¿äžãåããŒã¿ã®éèš UPDATE ãçºçãããªããå
šä»¶å
¥ãæ¿ããå¯èœãªããŒã¿ã ïŒæ¥ã®å©çšé »åºŠããããªãã«ããããš é »åºŠãé«ãç¡ãã®ã§ããã°ãAthena ã®æ¹ãå®ãã ã©ã®ãµãŒãã¹ã«ãèšããããšã§ãããèŠä»¶ã®åã£ããµãŒãã¹éžã³ãããããšãäžçªå€§äºã§ãã Redshift ã«ã€ããŠãç¹åŸŽãã¯ã£ããããŠããã¿ã€ãã®ãµãŒãã¹ãªã®ã§ã䜿ãæãééããªãããã«ãäžæã䜿ã£ãŠãããã°ãšæããŸãã
ã¯ããã« ããã«ã¡ã¯ãéçºæ¬éšã®éªæ¬ã§ãã ä»åã¯ç§ã瀟å
å匷äŒ(TechLunch)ã«ãŠ Amazon Redshift(ä»¥äž Redshift)ã«ã€ããŠã話ããå
容ã玹ä»ãããŠããã ããŸãã Redshift ãšã¯ æŠèŠ Redshift ãšã¯ AWS ãµãŒãã¹ãæäŸããŠããããŒã¿ãŠã§ã¢ããŠã¹ã§ãé«å¯çš/é«ããã©ãŒãã³ã¹/æè»ãªã¹ã±ãŒã©ããªãã£ãå®çŸããŠããã®ãç¹åŸŽã§ãã ç«¶åãšããŠã¯ BigQuery ã Hadoop ããŸãåã AWS ãµãŒãã¹ã§ã¯ Amazon Athena ãåæ§ã®äœçœ®ä»ãã«ãªããšæããŸãã ããŒã¿ããŒã¹ãšããŠã®ç¹åŸŽ Redshift ã®ç¹åŸŽãšããŠãåå¿ååããŒã¿ããŒã¹ãšããç¹ããããŸãã MySQL ã®ãããªãªã¬ãŒã·ã§ãã«ããŒã¿ããŒã¹ã¯ããŒã¿ãè¡ïŒã¬ã³ãŒãïŒåäœã§ä¿æããŠããäºã«å¯ŸããRedshift ã¯ååäœã§ä¿æããŠããŸãã ååäœã§ããŒã¿ãæã£ãŠããããéèšã¯ãšãªã®ãããªç¹å®ã®åã«å¯ŸããŠå€§éã®è¡ã粟æ»ããã®ãé«éã§ããåé¢ãè¡ãç¹å®ããŠã®ã¢ã¯ã»ã¹ã¯ MySQL ã PostgreSQL ã®ãããªè¡å¿åã®ããŒã¿ããŒã¹ã«æ¯ã¹ãŠã®ã¯ãšãªã«æ¯ã¹ãŠé
ãåŸåã«ãããŸãã ãŸãããŒã¿ã«ã¯ SQL ã§ã¢ã¯ã»ã¹ããããšãã§ããæ§æã PostgreSQL ãšäºææ§ããããŸãã æè¿ã¹ããŒãã¬ã¹ãªããŒã¿ããŒã¹ãªã©ãå€ãåºãŠããŠããŸãããRedshift ã¯äºåã«ããŒãã«ãäœæããå¿
èŠã®ããåŸæ¥åã® RDBMS ã®åœ¢ãšãªã£ãŠãããããŒãã«äœææã¯ CREATE TABLE ãšãã£ãããŒã¿å®çŸ©èšèª(DDL)ã䜿ãããšã«ãªããŸãã æ©èœé¢ã®ç¹åŸŽ å
ã«ãæžããŸããããããŒã¿ã¢ã¯ã»ã¹æã«äœ¿ã SQL 㯠PostgreSQL ã®æ§æãšäºææ§ããããŸãã ãã£ãŠ PostgreSQL çšãã©ã€ã(JDBC å«ã)ãã䜿ããã°ãåŸã¯ç¹å¥ã«æèããããšãªã Redshift ã«å¯ŸããŠæ¥ç¶ãã¯ãšãªçºè¡ãè¡ãããšããããšã«ãªããŸãã ãã®æ©æµã¯ããã°ã©ã ã ãã§ã¯ãªãä»ç€Ÿãå±éããŠãããµãŒãã¹ã«ãåããããšãã§ããBI ããŒã«ã® Tableau ã Redash ãªã©ããã®ãŸãŸããŒã¿ãœãŒã¹ãšããŠå©çšããããšãåºæ¥ãŸãã æ¬¡ã«ãäžè¬ç㪠RDBMS ãšã®å·®ã«ã€ããŠã§ãã RDBMS ã«ã¯ãã Redshift ã«ã¯ç¡ããã®ãšããŠã¯ UNIQUE å¶çŽ å€éšããŒå¶çŽ ã€ã³ããã¯ã¹ãç¡ã ãªã©ããããŸãã ã€ã³ããã¯ã¹ã«é¢ããŠã¯é ãæå³ã§ã®ä»£çšå(Sort Key)ããããã®ã®ãåºæ¬çã«ã¯äœ¿ãããšãåºæ¥ãŸããã æ³šæç¹ãšããŠã¯ãšãªèªäœã¯ PostgreSQL äºæãªã®ã§ããããäœã DDL æ§æãåãå
¥ããŠããããŸãããRedshift ã§ã¯ç¡èŠãããŸãã®ã§ã泚æãã ããã éã«ãRedshift åºæã®ãã®ãšããŠã¯ Sort Key 忣ã㌠åå§çž® ãªã©ããããŸãã ãããã«ã€ããŠã¯ä»¥äžã§å°ãæãäžããŠèª¬æããŸãã Sort Key ããŒãã«ããœãŒãããéã«äœ¿ãã€ã³ããã¯ã¹ã®ãããªãã®ã§ãã ååäœã§æå®ããããšãã§ãã ORDER BY ã GROUP BY å¥ãªã©ã®ç²Ÿæ»é床ã«åœ±é¿ããŸãã 忣ã㌠MySQL ã§ããããŒãã£ã·ã§ãã³ã°ããŒã«è¿ããã®ãšãªããŸãã Redshift ã®ããŒã¿åæ£æ¹æ³ã¯ åçã«åæ£ ããŒå€ã«ãã忣 å
šã³ã㌠AutoïŒè² è·ç¶æ³ã«ããèªåéžæ) ã® 4 ã€ã§ãããŒã¿éãç¹æ§ã«ãã£ãŠäœ¿ãåããããšãåºæ¥ãŸãã 忣ããŒã¯ Redshift ãäžèšã®æ¹æ³ã§ã¯ã©ã¹ã¿ãªã³ã°ããéã«ãã©ã®ããŒãã«ã©ã®ããŒã¿ãä¿æããããæ±ºå®ãã倿ææãšãªãããŒã§ãã éçšé¢ã®ç¹åŸŽ AWS ã³ã³ãœãŒã« Redshift 㯠AWS ã³ã³ãœãŒã«äžãããè©³çŽ°ãªæ
å ±ã確èªããããšãåºæ¥ãŸãã Amazon RDS ã«ãããããªäžè¬çãªã¡ããªã¯ã¹ã«å ããŠã¯ãšãªåäœã§ã®å®è¡ç¶æ³ãå®è¡èšç»ããããŠã¯ãšãªã®åŒ·å¶åæ¢ãã³ã³ãœãŒã«ããå®è¡ããããšãã§ããŸãã ããŒã¿åã蟌㿠Redshift ã¯ã€ã³ããŒãå
ãšãªãããŒã¿åã蟌ã¿éžæè¢ãè±å¯ãšããããšãç¹åŸŽã®äžã€ã§ãã åã蟌ã¿å¯èœãªåœ¢åŒ CSV/JSON/AVRO/PARQUET/ORC + ãããã®åœ¢åŒãå§çž®ãããã®(BZIP,GZIP ãªã©) èªã¿åãå
Amazon S3 / Amazon EMR / Amazon DynamoDB ãªã© ç¹ã«ããŒã¿é
眮å
ãšã㊠S3 ããµããŒããããŠããã®ã§ãåçš®ãµãŒãã¹ãåºåãããã°ãã Amazon CloudWatch Logs ããã® S3 ã Amazon Kinesis Data Firehose ããã® S3 ã»ã»ãªã©ãçµã¿åããæ¬¡ç¬¬ã§å¯èœæ§ããšãŠãåºãããŸãã ãŸã S3 ã«é
眮ããŠããããŒã¿ã¯ã€ã³ããŒãããã«å€éšããŒãã«ãšããŠçŽæ¥ã¯ãšãªãå®è¡ããæ©èœ Amazon Redshift Spectrum ããããŸããããŒã¿éããšãŠãå€ãå Žåãªã©ã«ã¯ãã¡ããå©çšããã®ãæå¹ãªææ®µã§ãã ã¯ãŒã¯ããŒã管ç è² è·ã«é¢ããéçšã«ã€ããŠã¯ WLM(Work Load Management)ãšããæ©èœããããŸãã ãã㯠Redshift ã«æ¥ç¶ãããŠãŒã¶ãã°ã«ãŒãåäœã§è² è·å¶åŸ¡ãè¡ãããšãåºæ¥ãæ©èœã§ãã å¶åŸ¡ã§ããé
ç®ãšããŠã¯ 䞊åã¯ãšãªå®è¡æ° åäžã°ã«ãŒãå
ã§ã®ã¯ãšãªåæå®è¡æ°ãäžéã«éãããšåŸ
ã¡è¡åã«å
¥ã£ãŠè©°ãŸãã ã¯ãšãªå®è¡æé ã¯ãšãªå®è¡æéã®äžéã ã¡ã¢ãªäœ¿çšé ã¯ãšãªå®è¡æã«äœ¿ãã¡ã¢ãªäœ¿çšéã®äžéã ãªã©ããããŸãã å¯çšæ§ã«ã€ã㊠Redshift ã¯ã¯ã©ã¹ã¿ãªã³ã°ããµããŒãããŠãããã¯ã©ã¹ã¿ã«ã¯ã¯ãšãªã®åŸ
åãè¡ããªãŒããŒ(Leader)ããŒããšå®åŠçãè¡ãã³ã³ãã¥ãŒãã£ã³ã°ããŒããäœæãããŸãã AWS ãæšå¥šããŠããããã«ãRedshift ã¯ãã«ãããŒãéçšãåºæ¬ãšããŠããŸãã ãã㯠Redshift ã®åã
ã®ããŒã¿ããŒã㯠RAID5 ã®ãããªåœ¢ã§åããŒãã«åæ£ããŠãããããããŒãé害ãçºçããå Žåã§ãçåããŒãããããŒã埩æ§ãèªåã§è¡ã£ãŠãããŸãã ïŒåæã«é害ãçºçããŠã埩æ§å¯èœãªããŒãæ°ã«ã€ããŠã¯ãã¯ã©ã¹ã¿å
ã®ããŒãæ°ã«äŸåããŸãïŒ å°æ¥æ§ã«ã€ã㊠éå»ïŒå¹Žåã®éã§ãããã ãã®æ°æ©èœã远å ãããŠããããŸã ãŸã é²åããŠããŸãã UNLOAD ã³ãã³ãã® CSV å¯Ÿå¿ Concurrency Scaling ALTER æã§ VARCHAR ã®æ¡æ°å€æŽ Elastic Resize UNLOAD ã³ãã³ãã®ãããè¡åºåå¯Ÿå¿ ã³ã³ãœãŒã«ã«ãŠã¯ãšãªå®è¡ç°å¢è¿œå ãã¹ãåãããããŒã¿ã®ãµããŒã èªåããŒãžã§ã³ã¢ããæ¹åŒã®èšå®ïŒäºå確èªå¯èœ ParquetãORC ããã® IMPORT ãµããŒã Amazon Redshift Spectrum æ±äº¬ãµããŒã æ°ããŒãã¿ã€ã DC2 Query Editor ã®è¿œå PL/SQL ããã·ãŒãžã£ã®ãµããŒã Vacum ã³ãã³ãã®èªåå New!!(2018/12 ãªãªãŒã¹) WLM ã¯ãŒã¯ããŒã管çã®èªåå New!!(2019/06 ãªãªãŒã¹) å®éã®äœ¿ãåæ ã§ã¯ãå®éã®ãšãã Redshift ã®äœ¿ãåæãã©ããã£ããã®ãªã®ããå®äŸãå«ããŠç޹ä»ããŸãã ããã§ã¯ dc2.large ããŒãæ° 2 ã®ãµã³ãã«ç°å¢ã䜿çšããŸãã ããŒã¿ã®ããŒã ã¯ãšãªãçºè¡ããã«ãããŸãã¯å
ã«ãªãããŒã¿ãå¿
èŠã§ãã ããã§ã¯ æ¥æ¬èª Wikipedia ã®ç®æ¬¡ãã³ãããŒã¿ ã 100 ã»ããåçšæãããã®å
容ã Redshift ã«ããŒãããŠã¿ãŸãã ãŸãã¯ç®æ¬¡ããŒã¿ããã¡ãã®ç»åã®æ§ã«å å·¥ãã100 ã»ããåã®ãã¡ã€ã«ãšããŠåå²ã S3 ãžãšã¢ããããŒãããŸãã ä»åã®ããŒãããããŒã¿é㯠235,732,000 ã¬ã³ãŒãã® 11.9GB ãšãªããŸããã S3 ã«ãã¡ã€ã«ãé
çœ®åºæ¥ããããããæ ŒçŽããããŒãã«ã Redshift ã«äœããŸãã ãã®é PostgreSQL ã® CREATE TABLE ã«ãã£ãŠããŒãã«ãäœæããŸãã ããŒãã«ã®äœæãå®äºããããæ¬¡ã¯ããŒã¿ã®ããŒãã§ãã ããã SQL ã¯ãšãªã® COPY ã³ãã³ãã«ãã£ãŠåã蟌ã¿ãè¡ãããŸãã ä»åãã®ããŒãåŠç㯠8 å 55 ç§ ã§å®äºããŸããã ããŒã¿éããèãããšããªãæ©ããšæããŸãããããã¯ããŒãåŠçã«ãããŠäžŠååŠçã®æ©æµãæå€§éã«åããŠãããšããããšãçç±ãšèããããŸãã Redshift ã®ããŒãåŠçã¯åå²ããããã¡ã€ã«ã䜿ã£ãŠäžŠååŠçãå®è¡ããããã巚倧ãªåäžãã¡ã€ã«ãåã蟌ãããçæéã§åã蟌ãããšãã§ããŸãã ã¯ãšãªçºè¡ 次ã«ãã¯ãšãªçºè¡ã«ã€ããŠã§ãããããã¯ãã®ãŸãŸ PostgreSQL ã®ã¯ãšãªãå®è¡ããããšã«ãªããŸãã ä»åã¯å
ã®ã¹ãããã§åã蟌ãã ç®æ¬¡ããŒãžãã¿ã€ãã«ããšã« DISTINCT ããéèšã¯ãšãªãçºè¡ããŠã¿ãŸãã ãããš 49 ç§ ã§çµæãåž°ã£ãŠããŸããã æäœéã®ã¹ããã¯ã§ 235,732,000 ã¬ã³ãŒãã粟æ»ããã¯ãšãªã®å®è¡æéãšããŠã¯è¯ãã¹ã³ã¢ã§ã¯ãªãã§ããããã äžäŸ¿ã«æããããš ããã§ã¯ç§ã Redshift ãéçšããŠããŠäžäŸ¿ã«æããäºãããã€ã玹ä»ããŸãã æéãé«ã ããã ãã®æ©èœãšã¹ããã¯ãå«ãŸããŠããã®ã§ä»æ¹ãç¡ããããããŸããããAWS ã®ä»ã®ãµãŒãã¹ãšæ¯èŒããŠé«äŸ¡ãªå°è±¡ããããŸãã ããã«ãã«ãããŒããšãªããšæéãæãç®ã§å¢ããããšã«ãªããã¹ããã¯ã®éžæè¢ãä»ã®ãµãŒãã¹ãšæ¯ã¹ãŠãå°ãªãããéçšã®éã«ã¯ããèŠç©ãããããããšãããããããŸãã æŽæ°ã¯ãšãªãé
ã åå¿ååã®ãããªã®ãã©ã³ãã ã¢ã¯ã»ã¹ãèŠæã§ãç¹å®ã®è¡ãæ¢ããŠæŽæ°ãã UPDATE ã DELETE ã¯é
ãã§ãã ãããã Redshift ã¯é »ç¹ã« UPDATE / DELETE ããçšéã«ã¯åããŠãããïŒåŸè¿°ïŒã INSERT ã®ã¿ã®ç©ã¿äžãåãå
šã¬ã³ãŒãæŽãæ¿ããåºæ¬ã®çšéã«ãªããŸãã ãŸãã UPDATE / DELETE ãç¹°ãè¿ããšããã©ãŒãã³ã¹ãäœäžããŸãã ããã¯å
éšçã«ä¿æããŠãã SortKey ã®ç¶æ
ãæŽæ°ãããã³ã«å£åããé£åããŠããã©ãŒãã³ã¹ãäœäžããããã§ãã è§£æ¶ããããã«ã¯ SortKey ã®åæ§ç¯ïŒ VACUM / OPTIMIZE ã³ãã³ã)ã«ããå埩ããŸãããããããã³ãã³ãå®è¡æéãé·ããè² è·ã倧ããã®ã§å®è¡ã¿ã€ãã³ã°ã¯æ€èšãå¿
èŠãšãªããŸãã (远èš) 2018/12 ã® ã¢ããããŒã ã§èªåå®è¡æ©èœã远å ãããŸããïŒ AWS ã³ã³ãœãŒã«ãæ©èœããªãããšããã å
ã«å€ãã®äŸ¿å©ãªæ©èœã玹ä»ããŸãããããªãããããã AWS ã³ã³ãœãŒã«äžã§æ©èœããŠãããªãããšãå²ãšãããŸãã WLM ã®èšå®æ¬¡ç¬¬ãªã®ãäžæã§ãããå®è¡äžã®ã¯ãšãªãåºãªãã£ããã¯ãšãªã®åŒ·å¶åæ¢ãå¹ããªããªã©ãã€ã¶ãšããæã«éã£ãŠäœ¿ããªãããšããããããŸããã ã¡ã³ããã³ã¹ãé«é »åºŠ æ°æ©èœãç¶ã
远å ãããŠãããšç޹ä»ããŠããŸããããã®åºŠã«ã¡ã³ããã³ã¹ãçºçãããã®ãšãªããŸãã ã¿ã€ãã³ã°ã¯äºåã«èšå®ããã¡ã³ããã³ã¹ãŠã€ã³ããŠã®é±äžã®ææ¥/æé垯ã§ãããçµéšãã 2 é±éã« 1 床ãããã®é »åºŠã§çºçããŠããŸããã ãã®æé垯ã¯åèµ·åã䌎ãå ŽåããããããWrite ã©ããã Read ããåºæ¥ãªãç¶æ
ã«ãªãããšããããŸãã ãã®ããæ¥äžã¯ç€Ÿå
æ¥åãå€éã¯ãããã§ãšãã£ãïŒïŒæéãã£ãšçšŒåããèŠä»¶ãæºããäºã¯å°ãå³ãããã®ãšãªããŸãã ãŸãšã ãŸãšããšãšãªããŸãããRedshift ã¯ç¹åŸŽããµãŸãããšäžèšã®ãããªå Žé¢ã§å©çšããã°è¯ãããªãšæããŠããŸãã BI ããŒã«çã®ããŒã¿ãœãŒã¹ãšã㊠ã¡ã³ãé »åºŠãè² è·ã®åé¡ãããã®ã§ãèªåéã®ã¢ããªããçŽæ¥ã¯ç¹ããªãã å±¥æŽããã¹ã¿ããŒã¿ã®ãããªå€§éã®ç©ã¿äžãåããŒã¿ã®éèš UPDATE ãçºçãããªããå
šä»¶å
¥ãæ¿ããå¯èœãªããŒã¿ã ïŒæ¥ã®å©çšé »åºŠããããªãã«ããããš é »åºŠãé«ãç¡ãã®ã§ããã°ãAthena ã®æ¹ãå®ãã ã©ã®ãµãŒãã¹ã«ãèšããããšã§ãããèŠä»¶ã®åã£ããµãŒãã¹éžã³ãããããšãäžçªå€§äºã§ãã Redshift ã«ã€ããŠãç¹åŸŽãã¯ã£ããããŠããã¿ã€ãã®ãµãŒãã¹ãªã®ã§ã䜿ãæãééããªãããã«ãäžæã䜿ã£ãŠãããã°ãšæããŸãã
ã¯ããã« ããã«ã¡ã¯ãéçºæ¬éšã®éªæ¬ã§ãã ä»åã¯ç§ã瀟å
å匷äŒ(TechLunch)ã«ãŠ Amazon Redshift(ä»¥äž Redshift)ã«ã€ããŠã話ããå
容ã玹ä»ãããŠããã ããŸãã Redshift ãšã¯ æŠèŠ Redshift ãšã¯ AWS ãµãŒãã¹ãæäŸããŠããããŒã¿ãŠã§ã¢ããŠã¹ã§ãé«å¯çš/é«ããã©ãŒãã³ã¹/æè»ãªã¹ã±ãŒã©ããªãã£ãå®çŸããŠããã®ãç¹åŸŽã§ãã ç«¶åãšããŠã¯ BigQuery ã Hadoop ããŸãåã AWS ãµãŒãã¹ã§ã¯ Amazon Athena ãåæ§ã®äœçœ®ä»ãã«ãªããšæããŸãã ããŒã¿ããŒã¹ãšããŠã®ç¹åŸŽ Redshift ã®ç¹åŸŽãšããŠãåå¿ååããŒã¿ããŒã¹ãšããç¹ããããŸãã MySQL ã®ãããªãªã¬ãŒã·ã§ãã«ããŒã¿ããŒã¹ã¯ããŒã¿ãè¡ïŒã¬ã³ãŒãïŒåäœã§ä¿æããŠããäºã«å¯ŸããRedshift ã¯ååäœã§ä¿æããŠããŸãã ååäœã§ããŒã¿ãæã£ãŠããããéèšã¯ãšãªã®ãããªç¹å®ã®åã«å¯ŸããŠå€§éã®è¡ã粟æ»ããã®ãé«éã§ããåé¢ãè¡ãç¹å®ããŠã®ã¢ã¯ã»ã¹ã¯ MySQL ã PostgreSQL ã®ãããªè¡å¿åã®ããŒã¿ããŒã¹ã«æ¯ã¹ãŠã®ã¯ãšãªã«æ¯ã¹ãŠé
ãåŸåã«ãããŸãã ãŸãããŒã¿ã«ã¯ SQL ã§ã¢ã¯ã»ã¹ããããšãã§ããæ§æã PostgreSQL ãšäºææ§ããããŸãã æè¿ã¹ããŒãã¬ã¹ãªããŒã¿ããŒã¹ãªã©ãå€ãåºãŠããŠããŸãããRedshift ã¯äºåã«ããŒãã«ãäœæããå¿
èŠã®ããåŸæ¥åã® RDBMS ã®åœ¢ãšãªã£ãŠãããããŒãã«äœææã¯ CREATE TABLE ãšãã£ãããŒã¿å®çŸ©èšèª(DDL)ã䜿ãããšã«ãªããŸãã æ©èœé¢ã®ç¹åŸŽ å
ã«ãæžããŸããããããŒã¿ã¢ã¯ã»ã¹æã«äœ¿ã SQL 㯠PostgreSQL ã®æ§æãšäºææ§ããããŸãã ãã£ãŠ PostgreSQL çšãã©ã€ã(JDBC å«ã)ãã䜿ããã°ãåŸã¯ç¹å¥ã«æèããããšãªã Redshift ã«å¯ŸããŠæ¥ç¶ãã¯ãšãªçºè¡ãè¡ãããšããããšã«ãªããŸãã ãã®æ©æµã¯ããã°ã©ã ã ãã§ã¯ãªãä»ç€Ÿãå±éããŠãããµãŒãã¹ã«ãåããããšãã§ããBI ããŒã«ã® Tableau ã Redash ãªã©ããã®ãŸãŸããŒã¿ãœãŒã¹ãšããŠå©çšããããšãåºæ¥ãŸãã æ¬¡ã«ãäžè¬ç㪠RDBMS ãšã®å·®ã«ã€ããŠã§ãã RDBMS ã«ã¯ãã Redshift ã«ã¯ç¡ããã®ãšããŠã¯ UNIQUE å¶çŽ å€éšããŒå¶çŽ ã€ã³ããã¯ã¹ãç¡ã ãªã©ããããŸãã ã€ã³ããã¯ã¹ã«é¢ããŠã¯é ãæå³ã§ã®ä»£çšå(Sort Key)ããããã®ã®ãåºæ¬çã«ã¯äœ¿ãããšãåºæ¥ãŸããã æ³šæç¹ãšããŠã¯ãšãªèªäœã¯ PostgreSQL äºæãªã®ã§ããããäœã DDL æ§æãåãå
¥ããŠããããŸãããRedshift ã§ã¯ç¡èŠãããŸãã®ã§ã泚æãã ããã éã«ãRedshift åºæã®ãã®ãšããŠã¯ Sort Key 忣ã㌠åå§çž® ãªã©ããããŸãã ãããã«ã€ããŠã¯ä»¥äžã§å°ãæãäžããŠèª¬æããŸãã Sort Key ããŒãã«ããœãŒãããéã«äœ¿ãã€ã³ããã¯ã¹ã®ãããªãã®ã§ãã ååäœã§æå®ããããšãã§ãã ORDER BY ã GROUP BY å¥ãªã©ã®ç²Ÿæ»é床ã«åœ±é¿ããŸãã 忣ã㌠MySQL ã§ããããŒãã£ã·ã§ãã³ã°ããŒã«è¿ããã®ãšãªããŸãã Redshift ã®ããŒã¿åæ£æ¹æ³ã¯ åçã«åæ£ ããŒå€ã«ãã忣 å
šã³ã㌠AutoïŒè² è·ç¶æ³ã«ããèªåéžæ) ã® 4 ã€ã§ãããŒã¿éãç¹æ§ã«ãã£ãŠäœ¿ãåããããšãåºæ¥ãŸãã 忣ããŒã¯ Redshift ãäžèšã®æ¹æ³ã§ã¯ã©ã¹ã¿ãªã³ã°ããéã«ãã©ã®ããŒãã«ã©ã®ããŒã¿ãä¿æããããæ±ºå®ãã倿ææãšãªãããŒã§ãã éçšé¢ã®ç¹åŸŽ AWS ã³ã³ãœãŒã« Redshift 㯠AWS ã³ã³ãœãŒã«äžãããè©³çŽ°ãªæ
å ±ã確èªããããšãåºæ¥ãŸãã Amazon RDS ã«ãããããªäžè¬çãªã¡ããªã¯ã¹ã«å ããŠã¯ãšãªåäœã§ã®å®è¡ç¶æ³ãå®è¡èšç»ããããŠã¯ãšãªã®åŒ·å¶åæ¢ãã³ã³ãœãŒã«ããå®è¡ããããšãã§ããŸãã ããŒã¿åã蟌㿠Redshift ã¯ã€ã³ããŒãå
ãšãªãããŒã¿åã蟌ã¿éžæè¢ãè±å¯ãšããããšãç¹åŸŽã®äžã€ã§ãã åã蟌ã¿å¯èœãªåœ¢åŒ CSV/JSON/AVRO/PARQUET/ORC + ãããã®åœ¢åŒãå§çž®ãããã®(BZIP,GZIP ãªã©) èªã¿åãå
Amazon S3 / Amazon EMR / Amazon DynamoDB ãªã© ç¹ã«ããŒã¿é
眮å
ãšã㊠S3 ããµããŒããããŠããã®ã§ãåçš®ãµãŒãã¹ãåºåãããã°ãã Amazon CloudWatch Logs ããã® S3 ã Amazon Kinesis Data Firehose ããã® S3 ã»ã»ãªã©ãçµã¿åããæ¬¡ç¬¬ã§å¯èœæ§ããšãŠãåºãããŸãã ãŸã S3 ã«é
眮ããŠããããŒã¿ã¯ã€ã³ããŒãããã«å€éšããŒãã«ãšããŠçŽæ¥ã¯ãšãªãå®è¡ããæ©èœ Amazon Redshift Spectrum ããããŸããããŒã¿éããšãŠãå€ãå Žåãªã©ã«ã¯ãã¡ããå©çšããã®ãæå¹ãªææ®µã§ãã ã¯ãŒã¯ããŒã管ç è² è·ã«é¢ããéçšã«ã€ããŠã¯ WLM(Work Load Management)ãšããæ©èœããããŸãã ãã㯠Redshift ã«æ¥ç¶ãããŠãŒã¶ãã°ã«ãŒãåäœã§è² è·å¶åŸ¡ãè¡ãããšãåºæ¥ãæ©èœã§ãã å¶åŸ¡ã§ããé
ç®ãšããŠã¯ 䞊åã¯ãšãªå®è¡æ° åäžã°ã«ãŒãå
ã§ã®ã¯ãšãªåæå®è¡æ°ãäžéã«éãããšåŸ
ã¡è¡åã«å
¥ã£ãŠè©°ãŸãã ã¯ãšãªå®è¡æé ã¯ãšãªå®è¡æéã®äžéã ã¡ã¢ãªäœ¿çšé ã¯ãšãªå®è¡æã«äœ¿ãã¡ã¢ãªäœ¿çšéã®äžéã ãªã©ããããŸãã å¯çšæ§ã«ã€ã㊠Redshift ã¯ã¯ã©ã¹ã¿ãªã³ã°ããµããŒãããŠãããã¯ã©ã¹ã¿ã«ã¯ã¯ãšãªã®åŸ
åãè¡ããªãŒããŒ(Leader)ããŒããšå®åŠçãè¡ãã³ã³ãã¥ãŒãã£ã³ã°ããŒããäœæãããŸãã AWS ãæšå¥šããŠããããã«ãRedshift ã¯ãã«ãããŒãéçšãåºæ¬ãšããŠããŸãã ãã㯠Redshift ã®åã
ã®ããŒã¿ããŒã㯠RAID5 ã®ãããªåœ¢ã§åããŒãã«åæ£ããŠãããããããŒãé害ãçºçããå Žåã§ãçåããŒãããããŒã埩æ§ãèªåã§è¡ã£ãŠãããŸãã ïŒåæã«é害ãçºçããŠã埩æ§å¯èœãªããŒãæ°ã«ã€ããŠã¯ãã¯ã©ã¹ã¿å
ã®ããŒãæ°ã«äŸåããŸãïŒ å°æ¥æ§ã«ã€ã㊠éå»ïŒå¹Žåã®éã§ãããã ãã®æ°æ©èœã远å ãããŠããããŸã ãŸã é²åããŠããŸãã UNLOAD ã³ãã³ãã® CSV å¯Ÿå¿ Concurrency Scaling ALTER æã§ VARCHAR ã®æ¡æ°å€æŽ Elastic Resize UNLOAD ã³ãã³ãã®ãããè¡åºåå¯Ÿå¿ ã³ã³ãœãŒã«ã«ãŠã¯ãšãªå®è¡ç°å¢è¿œå ãã¹ãåãããããŒã¿ã®ãµããŒã èªåããŒãžã§ã³ã¢ããæ¹åŒã®èšå®ïŒäºå確èªå¯èœ ParquetãORC ããã® IMPORT ãµããŒã Amazon Redshift Spectrum æ±äº¬ãµããŒã æ°ããŒãã¿ã€ã DC2 Query Editor ã®è¿œå PL/SQL ããã·ãŒãžã£ã®ãµããŒã Vacum ã³ãã³ãã®èªåå New!!(2018/12 ãªãªãŒã¹) WLM ã¯ãŒã¯ããŒã管çã®èªåå New!!(2019/06 ãªãªãŒã¹) å®éã®äœ¿ãåæ ã§ã¯ãå®éã®ãšãã Redshift ã®äœ¿ãåæãã©ããã£ããã®ãªã®ããå®äŸãå«ããŠç޹ä»ããŸãã ããã§ã¯ dc2.large ããŒãæ° 2 ã®ãµã³ãã«ç°å¢ã䜿çšããŸãã ããŒã¿ã®ããŒã ã¯ãšãªãçºè¡ããã«ãããŸãã¯å
ã«ãªãããŒã¿ãå¿
èŠã§ãã ããã§ã¯ æ¥æ¬èª Wikipedia ã®ç®æ¬¡ãã³ãããŒã¿ ã 100 ã»ããåçšæãããã®å
容ã Redshift ã«ããŒãããŠã¿ãŸãã ãŸãã¯ç®æ¬¡ããŒã¿ããã¡ãã®ç»åã®æ§ã«å å·¥ãã100 ã»ããåã®ãã¡ã€ã«ãšããŠåå²ã S3 ãžãšã¢ããããŒãããŸãã ä»åã®ããŒãããããŒã¿é㯠235,732,000 ã¬ã³ãŒãã® 11.9GB ãšãªããŸããã S3 ã«ãã¡ã€ã«ãé
çœ®åºæ¥ããããããæ ŒçŽããããŒãã«ã Redshift ã«äœããŸãã ãã®é PostgreSQL ã® CREATE TABLE ã«ãã£ãŠããŒãã«ãäœæããŸãã ããŒãã«ã®äœæãå®äºããããæ¬¡ã¯ããŒã¿ã®ããŒãã§ãã ããã SQL ã¯ãšãªã® COPY ã³ãã³ãã«ãã£ãŠåã蟌ã¿ãè¡ãããŸãã ä»åãã®ããŒãåŠç㯠8 å 55 ç§ ã§å®äºããŸããã ããŒã¿éããèãããšããªãæ©ããšæããŸãããããã¯ããŒãåŠçã«ãããŠäžŠååŠçã®æ©æµãæå€§éã«åããŠãããšããããšãçç±ãšèããããŸãã Redshift ã®ããŒãåŠçã¯åå²ããããã¡ã€ã«ã䜿ã£ãŠäžŠååŠçãå®è¡ããããã巚倧ãªåäžãã¡ã€ã«ãåã蟌ãããçæéã§åã蟌ãããšãã§ããŸãã ã¯ãšãªçºè¡ 次ã«ãã¯ãšãªçºè¡ã«ã€ããŠã§ãããããã¯ãã®ãŸãŸ PostgreSQL ã®ã¯ãšãªãå®è¡ããããšã«ãªããŸãã ä»åã¯å
ã®ã¹ãããã§åã蟌ãã ç®æ¬¡ããŒãžãã¿ã€ãã«ããšã« DISTINCT ããéèšã¯ãšãªãçºè¡ããŠã¿ãŸãã ãããš 49 ç§ ã§çµæãåž°ã£ãŠããŸããã æäœéã®ã¹ããã¯ã§ 235,732,000 ã¬ã³ãŒãã粟æ»ããã¯ãšãªã®å®è¡æéãšããŠã¯è¯ãã¹ã³ã¢ã§ã¯ãªãã§ããããã äžäŸ¿ã«æããããš ããã§ã¯ç§ã Redshift ãéçšããŠããŠäžäŸ¿ã«æããäºãããã€ã玹ä»ããŸãã æéãé«ã ããã ãã®æ©èœãšã¹ããã¯ãå«ãŸããŠããã®ã§ä»æ¹ãç¡ããããããŸããããAWS ã®ä»ã®ãµãŒãã¹ãšæ¯èŒããŠé«äŸ¡ãªå°è±¡ããããŸãã ããã«ãã«ãããŒããšãªããšæéãæãç®ã§å¢ããããšã«ãªããã¹ããã¯ã®éžæè¢ãä»ã®ãµãŒãã¹ãšæ¯ã¹ãŠãå°ãªãããéçšã®éã«ã¯ããèŠç©ãããããããšãããããããŸãã æŽæ°ã¯ãšãªãé
ã åå¿ååã®ãããªã®ãã©ã³ãã ã¢ã¯ã»ã¹ãèŠæã§ãç¹å®ã®è¡ãæ¢ããŠæŽæ°ãã UPDATE ã DELETE ã¯é
ãã§ãã ãããã Redshift ã¯é »ç¹ã« UPDATE / DELETE ããçšéã«ã¯åããŠãããïŒåŸè¿°ïŒã INSERT ã®ã¿ã®ç©ã¿äžãåãå
šã¬ã³ãŒãæŽãæ¿ããåºæ¬ã®çšéã«ãªããŸãã ãŸãã UPDATE / DELETE ãç¹°ãè¿ããšããã©ãŒãã³ã¹ãäœäžããŸãã ããã¯å
éšçã«ä¿æããŠãã SortKey ã®ç¶æ
ãæŽæ°ãããã³ã«å£åããé£åããŠããã©ãŒãã³ã¹ãäœäžããããã§ãã è§£æ¶ããããã«ã¯ SortKey ã®åæ§ç¯ïŒ VACUM / OPTIMIZE ã³ãã³ã)ã«ããå埩ããŸãããããããã³ãã³ãå®è¡æéãé·ããè² è·ã倧ããã®ã§å®è¡ã¿ã€ãã³ã°ã¯æ€èšãå¿
èŠãšãªããŸãã (远èš) 2018/12 ã® ã¢ããããŒã ã§èªåå®è¡æ©èœã远å ãããŸããïŒ AWS ã³ã³ãœãŒã«ãæ©èœããªãããšããã å
ã«å€ãã®äŸ¿å©ãªæ©èœã玹ä»ããŸãããããªãããããã AWS ã³ã³ãœãŒã«äžã§æ©èœããŠãããªãããšãå²ãšãããŸãã WLM ã®èšå®æ¬¡ç¬¬ãªã®ãäžæã§ãããå®è¡äžã®ã¯ãšãªãåºãªãã£ããã¯ãšãªã®åŒ·å¶åæ¢ãå¹ããªããªã©ãã€ã¶ãšããæã«éã£ãŠäœ¿ããªãããšããããããŸããã ã¡ã³ããã³ã¹ãé«é »åºŠ æ°æ©èœãç¶ã
远å ãããŠãããšç޹ä»ããŠããŸããããã®åºŠã«ã¡ã³ããã³ã¹ãçºçãããã®ãšãªããŸãã ã¿ã€ãã³ã°ã¯äºåã«èšå®ããã¡ã³ããã³ã¹ãŠã€ã³ããŠã®é±äžã®ææ¥/æé垯ã§ãããçµéšãã 2 é±éã« 1 床ãããã®é »åºŠã§çºçããŠããŸããã ãã®æé垯ã¯åèµ·åã䌎ãå ŽåããããããWrite ã©ããã Read ããåºæ¥ãªãç¶æ
ã«ãªãããšããããŸãã ãã®ããæ¥äžã¯ç€Ÿå
æ¥åãå€éã¯ãããã§ãšãã£ãïŒïŒæéãã£ãšçšŒåããèŠä»¶ãæºããäºã¯å°ãå³ãããã®ãšãªããŸãã ãŸãšã ãŸãšããšãšãªããŸãããRedshift ã¯ç¹åŸŽããµãŸãããšäžèšã®ãããªå Žé¢ã§å©çšããã°è¯ãããªãšæããŠããŸãã BI ããŒã«çã®ããŒã¿ãœãŒã¹ãšã㊠ã¡ã³ãé »åºŠãè² è·ã®åé¡ãããã®ã§ãèªåéã®ã¢ããªããçŽæ¥ã¯ç¹ããªãã å±¥æŽããã¹ã¿ããŒã¿ã®ãããªå€§éã®ç©ã¿äžãåããŒã¿ã®éèš UPDATE ãçºçãããªããå
šä»¶å
¥ãæ¿ããå¯èœãªããŒã¿ã ïŒæ¥ã®å©çšé »åºŠããããªãã«ããããš é »åºŠãé«ãç¡ãã®ã§ããã°ãAthena ã®æ¹ãå®ãã ã©ã®ãµãŒãã¹ã«ãèšããããšã§ãããèŠä»¶ã®åã£ããµãŒãã¹éžã³ãããããšãäžçªå€§äºã§ãã Redshift ã«ã€ããŠãç¹åŸŽãã¯ã£ããããŠããã¿ã€ãã®ãµãŒãã¹ãªã®ã§ã䜿ãæãééããªãããã«ãäžæã䜿ã£ãŠãããã°ãšæããŸãã
ããã«ã¡ã¯ãéçºæ¬éšãšã³ãžãã¢ã®å¹³æšã§ãã ã¡ãã¬ãŒã§ã¯ãæè¡ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšããèãããããšã³ãžãã¢ã»ãã¶ã€ããŒã®æè¡ã€ãã³ããªã©ã«ãç©æ¥µçã«åè³ãããŠããã ããããšèããŠããŸãã7 æä»¥éã®ã€ãã³ããç©æ¥µçã«ã¹ãã³ãµãŒããããŠããã ããŸãã®ã§ããã²çæ§ã«ããè¶ãããã ãããããã®ãšã³ããªã§ã¯ã¡ãã¬ãŒãåè³ããã€ãã³ãã®é
åãã玹ä»ããŸãã Developers Summit 2019 Summer å
¬åŒãµã€ã 2019/07/02(ç«) @ãœã©ã·ãã£ã«ã³ãã¡ã¬ã³ã¹ã»ã³ã¿ãŒ ããã³ãºã¹ãã³ãµãŒ äžçªæåã«ã玹ä»ããã®ã¯ããåç¥ Developers Summit 2019 Summer(以éãããµãå€)ã§ãã æ¬å®¶ã§ãã Developers Summit 2019 å¬ã§ãåè³ãããŠããã ããŸããããä»åã®ãããµãå€ã§ã¯ããã³ãºã¹ãã³ãµãŒãšã㊠å·è¡åœ¹å¡ã§ããç°äž ã SI à Web ã®ç·ååã§åãæãæ°ãããšã³ãžãã¢ã®ãã£ãªã¢ãã¹ ãšããã¿ã€ãã«ã§ã話ããŸãã ããæ°å¹Žã§ X-Tech ã DX ã®å¿
èŠæ§ãäžæ°ã«å«ã°ããããã«ãªã£ãŠããŸããããã¡ãã¬ãŒã§ã å»çã«ãããããžã¿ã«ãã©ã³ã¹ãã©ãŒã¡ãŒã·ã§ã³ã®æšé² ãç®æããŠæ¥ã
ãããã¯ãã®éçºãé²ããŠããŸããX-Tech ã DX ãæšé²ããäžã§ããããããWeb ç³»ãšã³ãžãã¢ããšãSI ç³»ãšã³ãžãã¢ããšãã壿 ¹ãè¶ããããã€ããªãããªæ°ãããšã³ãžãã¢åãæ±ããããããã«ãªã£ãŠãããšæããŸããã課é¡ã解決ããããã«å¿
èŠãšãããããã«ãªã£ããã€ããªãããªèœåãšã¯?ããããããã®ãšã³ãžãã¢ã¯ã©ãæé·ããŠããã®ãããã?ããšããããšãã話ãããŠããã ããŸãã ãããããŸã§ãçŸæç¹ã§ã»ãã·ã§ã³ã¯æºå¡ã«ãªã£ãŠããŸããããã²ã芧ããã ããã°å¹žãã§ãã CloudNativeDays Tokyo 2019 / OpenStack Days Tokyo 2019 å
¬åŒãµã€ã 2019/07/22(æ) ~ 23(ç«) @èãéãã«ãºãã©ãŒã©ã ããã«ãã£ã¹ãã³ãµãŒ(ããŒãããã°) ä»å¹Žã¯ã€ãã³ãã®çµ±åããããåç§°ãäžæ°ãããæ¥æ¬æå€§çŽã®ã³ã³ããæè¡ãå§ããšããã¯ã©ãŠããã€ãã£ããšãªãŒãã³ã€ã³ãã©ã®ç¥å
žã§ããããã¡ãã®ã€ãã³ãã«ãåè³ãããŠããã ããŸãã åœæ¥äŒå Žã§é
ãããããŒãããã°ã«å
¬åŒããŽãšå
±ã«ã¡ãã¬ãŒã®ããŽãå
¥ããŠããã ããŸãããå®éã«ã©ããªãã¶ã€ã³ã«ãªããã¯åœæ¥ã«ãæ¥å ŽããŠããã ããŸã§ã®ã楜ãã¿ãšãããŠããã ããŸããããšãŠãè¯ããã®ã«ãªã£ãŠããããšæããŸãã builderscon tokyo 2019 å
¬åŒãµã€ã 2019/08/29(æš) ~ 31(å) @æ±äº¬é»æ©å€§åŠ(æ±äº¬åäœãã£ã³ãã¹)1 å·é€š ããã¯ããã«ã¹ãã³ãµãŒ 2016 幎ããæ¯å¹Žéå¬ãããŠãããè²ã
ãªåéã®ãšã³ãžãã¢ã®æ§ã
ãªã»ãã·ã§ã³ãäžæ°ã«èããã€ãã³ããbuilderscon tokyoãã§ãã(å»å¹Žã¯é»ååæãããžãã€ã³ãã¯ããããŸããã)ãä»å¹Žã¯åããŠã¹ãã³ãµãŒãšããŠåå ãããŠããã ãããšã«ãªããŸããã äŒå Žã§ããæ±äº¬é»æ©å€§åŠåäœãã£ã³ãã¹ã®éšå±ã®äžã€ã100 åšå¹Žèšå¿µããŒã«ã§ã»ãã·ã§ã³ããã¹ããŒã«ãŒããã®åŸãã«èšçœ®ãããããã¯ããã«ã®ãªãã«ãã¡ãã¬ãŒã®ããŽãå
¥ãããšã«ã ãã¡ãã®ã€ãã³ãã§ã¯åŒç€Ÿãšã³ãžãã¢ããéªéããäºå®ã§ãã®ã§ãäŒå Žã§ãæ°è»œã«ã声ããããŠããã ããã°ãšæããŸãã CODE BLUE 2019 å
¬åŒãµã€ã 2019/10/29(ç«) ~ 30(æ°Ž) @ãã«ãµãŒã«æžè°·ã¬ãŒãã³ ããã³ãºã¹ãã³ãµãŒ ä»å¹Žã§ 7 åç®ã®éå¬ãšãªãæ
å ±ã»ãã¥ãªãã£ã®åœéäŒè°ãCODE BLUE 2019ãã«åããŠã¹ãã³ãµãŒããããŠããã ããŠããŸãã ã¡ãã¬ãŒã§ãåãæ±ã£ãŠããæ
å ±ã®éèŠæ§ãããäŒç€ŸãšããŠã®åãçµã¿ã§ ISMS èªèšŒ / ISMS ã¯ã©ãŠãã»ãã¥ãªãã£èªèšŒãååŸ ããŠããŸããããã®ãããªã»ãã¥ãªãã£ã«é¢ããã€ãã³ãã«ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšä»å¹Žããåè³ãããŠããã ãããšã«ãªããŸããã DesginShip 2019 å
¬åŒãµã€ã 2019/11/23(å ) ~ 24(æ¥) @æ±äº¬åœéãã©ãŒã©ã B7 ã» B5 ã·ã«ããŒã¹ãã³ãµãŒ å»å¹Žããéå¬ãããŠãããã¶ã€ã³ã«ã³ãã¡ã¬ã³ã¹ãDesignShip 2019ãã«ãå»å¹Žããç¶ãã¹ãã³ãµãŒããããŠããã ããŸãã ä»å¹Žã¯äŒå Žãæ±äº¬åœéãã©ãŒã©ã ã«ãªããšããããšã§ãã¡ãã¬ãŒãå»å¹Žãããããã«ã¢ã¯ãã£ããªåœ¢ã§ã€ãã³ãã«åå ãããŠããã ãããšã«ãªãããã§ãã ãŸãšã ãããŸã§ã玹ä»ãããŠããã ããã€ãã³ã以å€ã«ãçŸåšãã¹ãã³ãµãŒã®æèšºããããŠããã ããŠããã€ãã³ããããã€ããããŸããããã¡ããæ±ºå®æ¬¡ç¬¬ããããã§ããã°ãšèããŠããŸãã ã¡ãã¬ãŒã§ã¯ãæè¡ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšããèãããããšã³ãžãã¢ã»ãã¶ã€ããŒã®æè¡ã€ãã³ããªã©ã«ãããããç©æ¥µçã«åè³ãããŠããã ãã¹ã¿ã³ã¹ãåã£ãŠããŸãã å
šãŠã®ã€ãã³ãã«åè³ã§ããããã§ã¯ãããŸããããã¹ãã³ãµãŒãæ¢ããŠããã€ãã³ãéå¶è
ã®æ¹ãããã£ããããŸããããäžåºŠãæ°è»œã«ãåãåããããã ããã°ãšæããŸãã®ã§ããããããé¡ãããŸãã ⌠ã¡ãã¬ãŒã£ãŠã©ããªäŒç€ŸïŒæ°ã«ãªã£ãæ¹ã¯ãã¡ã ã¡ãã¬ãŒã§åã | æ ªåŒäŒç€Ÿã¡ãã¬ãŒ ã¡ãã¬ãŒã®çµç¹æåãåéèŠé
ãã玹ä»ããŸã www.medley.jp
ããã«ã¡ã¯ãéçºæ¬éšãšã³ãžãã¢ã®å¹³æšã§ãã ã¡ãã¬ãŒã§ã¯ãæè¡ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšããèãããããšã³ãžãã¢ã»ãã¶ã€ããŒã®æè¡ã€ãã³ããªã©ã«ãç©æ¥µçã«åè³ãããŠããã ããããšèããŠããŸãã7 æä»¥éã®ã€ãã³ããç©æ¥µçã«ã¹ãã³ãµãŒããããŠããã ããŸãã®ã§ããã²çæ§ã«ããè¶ãããã ãããããã®ãšã³ããªã§ã¯ã¡ãã¬ãŒãåè³ããã€ãã³ãã®é
åãã玹ä»ããŸãã Developers Summit 2019 Summer å
¬åŒãµã€ã 2019/07/02(ç«) @ãœã©ã·ãã£ã«ã³ãã¡ã¬ã³ã¹ã»ã³ã¿ãŒ ããã³ãºã¹ãã³ãµãŒ äžçªæåã«ã玹ä»ããã®ã¯ããåç¥ Developers Summit 2019 Summer(以éãããµãå€)ã§ãã æ¬å®¶ã§ãã Developers Summit 2019 å¬ã§ãåè³ãããŠããã ããŸããããä»åã®ãããµãå€ã§ã¯ããã³ãºã¹ãã³ãµãŒãšã㊠å·è¡åœ¹å¡ã§ããç°äž ã SI à Web ã®ç·ååã§åãæãæ°ãããšã³ãžãã¢ã®ãã£ãªã¢ãã¹ ãšããã¿ã€ãã«ã§ã話ããŸãã ããæ°å¹Žã§ X-Tech ã DX ã®å¿
èŠæ§ãäžæ°ã«å«ã°ããããã«ãªã£ãŠããŸããããã¡ãã¬ãŒã§ã å»çã«ãããããžã¿ã«ãã©ã³ã¹ãã©ãŒã¡ãŒã·ã§ã³ã®æšé² ãç®æããŠæ¥ã
ãããã¯ãã®éçºãé²ããŠããŸããX-Tech ã DX ãæšé²ããäžã§ããããããWeb ç³»ãšã³ãžãã¢ããšãSI ç³»ãšã³ãžãã¢ããšãã壿 ¹ãè¶ããããã€ããªãããªæ°ãããšã³ãžãã¢åãæ±ããããããã«ãªã£ãŠãããšæããŸããã課é¡ã解決ããããã«å¿
èŠãšãããããã«ãªã£ããã€ããªãããªèœåãšã¯?ããããããã®ãšã³ãžãã¢ã¯ã©ãæé·ããŠããã®ãããã?ããšããããšãã話ãããŠããã ããŸãã ãããããŸã§ãçŸæç¹ã§ã»ãã·ã§ã³ã¯æºå¡ã«ãªã£ãŠããŸããããã²ã芧ããã ããã°å¹žãã§ãã CloudNativeDays Tokyo 2019 / OpenStack Days Tokyo 2019 å
¬åŒãµã€ã 2019/07/22(æ) ~ 23(ç«) @èãéãã«ãºãã©ãŒã©ã ããã«ãã£ã¹ãã³ãµãŒ(ããŒãããã°) ä»å¹Žã¯ã€ãã³ãã®çµ±åããããåç§°ãäžæ°ãããæ¥æ¬æå€§çŽã®ã³ã³ããæè¡ãå§ããšããã¯ã©ãŠããã€ãã£ããšãªãŒãã³ã€ã³ãã©ã®ç¥å
žã§ããããã¡ãã®ã€ãã³ãã«ãåè³ãããŠããã ããŸãã åœæ¥äŒå Žã§é
ãããããŒãããã°ã«å
¬åŒããŽãšå
±ã«ã¡ãã¬ãŒã®ããŽãå
¥ããŠããã ããŸãããå®éã«ã©ããªãã¶ã€ã³ã«ãªããã¯åœæ¥ã«ãæ¥å ŽããŠããã ããŸã§ã®ã楜ãã¿ãšãããŠããã ããŸããããšãŠãè¯ããã®ã«ãªã£ãŠããããšæããŸãã builderscon tokyo 2019 å
¬åŒãµã€ã 2019/08/29(æš) ~ 31(å) @æ±äº¬é»æ©å€§åŠ(æ±äº¬åäœãã£ã³ãã¹)1 å·é€š ããã¯ããã«ã¹ãã³ãµãŒ 2016 幎ããæ¯å¹Žéå¬ãããŠãããè²ã
ãªåéã®ãšã³ãžãã¢ã®æ§ã
ãªã»ãã·ã§ã³ãäžæ°ã«èããã€ãã³ããbuilderscon tokyoãã§ãã(å»å¹Žã¯é»ååæãããžãã€ã³ãã¯ããããŸããã)ãä»å¹Žã¯åããŠã¹ãã³ãµãŒãšããŠåå ãããŠããã ãããšã«ãªããŸããã äŒå Žã§ããæ±äº¬é»æ©å€§åŠåäœãã£ã³ãã¹ã®éšå±ã®äžã€ã100 åšå¹Žèšå¿µããŒã«ã§ã»ãã·ã§ã³ããã¹ããŒã«ãŒããã®åŸãã«èšçœ®ãããããã¯ããã«ã®ãªãã«ãã¡ãã¬ãŒã®ããŽãå
¥ãããšã«ã ãã¡ãã®ã€ãã³ãã§ã¯åŒç€Ÿãšã³ãžãã¢ããéªéããäºå®ã§ãã®ã§ãäŒå Žã§ãæ°è»œã«ã声ããããŠããã ããã°ãšæããŸãã CODE BLUE 2019 å
¬åŒãµã€ã 2019/10/29(ç«) ~ 30(æ°Ž) @ãã«ãµãŒã«æžè°·ã¬ãŒãã³ ããã³ãºã¹ãã³ãµãŒ ä»å¹Žã§ 7 åç®ã®éå¬ãšãªãæ
å ±ã»ãã¥ãªãã£ã®åœéäŒè°ãCODE BLUE 2019ãã«åããŠã¹ãã³ãµãŒããããŠããã ããŠããŸãã ã¡ãã¬ãŒã§ãåãæ±ã£ãŠããæ
å ±ã®éèŠæ§ãããäŒç€ŸãšããŠã®åãçµã¿ã§ ISMS èªèšŒ / ISMS ã¯ã©ãŠãã»ãã¥ãªãã£èªèšŒãååŸ ããŠããŸããããã®ãããªã»ãã¥ãªãã£ã«é¢ããã€ãã³ãã«ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšä»å¹Žããåè³ãããŠããã ãããšã«ãªããŸããã DesginShip 2019 å
¬åŒãµã€ã 2019/11/23(å ) ~ 24(æ¥) @æ±äº¬åœéãã©ãŒã©ã B7 ã» B5 ã·ã«ããŒã¹ãã³ãµãŒ å»å¹Žããéå¬ãããŠãããã¶ã€ã³ã«ã³ãã¡ã¬ã³ã¹ãDesignShip 2019ãã«ãå»å¹Žããç¶ãã¹ãã³ãµãŒããããŠããã ããŸãã ä»å¹Žã¯äŒå Žãæ±äº¬åœéãã©ãŒã©ã ã«ãªããšããããšã§ãã¡ãã¬ãŒãå»å¹Žãããããã«ã¢ã¯ãã£ããªåœ¢ã§ã€ãã³ãã«åå ãããŠããã ãããšã«ãªãããã§ãã ãŸãšã ãããŸã§ã玹ä»ãããŠããã ããã€ãã³ã以å€ã«ãçŸåšãã¹ãã³ãµãŒã®æèšºããããŠããã ããŠããã€ãã³ããããã€ããããŸããããã¡ããæ±ºå®æ¬¡ç¬¬ããããã§ããã°ãšèããŠããŸãã ã¡ãã¬ãŒã§ã¯ãæè¡ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšããèãããããšã³ãžãã¢ã»ãã¶ã€ããŒã®æè¡ã€ãã³ããªã©ã«ãããããç©æ¥µçã«åè³ãããŠããã ãã¹ã¿ã³ã¹ãåã£ãŠããŸãã å
šãŠã®ã€ãã³ãã«åè³ã§ããããã§ã¯ãããŸããããã¹ãã³ãµãŒãæ¢ããŠããã€ãã³ãéå¶è
ã®æ¹ãããã£ããããŸããããäžåºŠãæ°è»œã«ãåãåããããã ããã°ãšæããŸãã®ã§ããããããé¡ãããŸãã ⌠ã¡ãã¬ãŒã£ãŠã©ããªäŒç€ŸïŒæ°ã«ãªã£ãæ¹ã¯ãã¡ã https://www.medley.jp/team/
ããã«ã¡ã¯ãéçºæ¬éšãšã³ãžãã¢ã®å¹³æšã§ãã ã¡ãã¬ãŒã§ã¯ãæè¡ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšããèãããããšã³ãžãã¢ã»ãã¶ã€ããŒã®æè¡ã€ãã³ããªã©ã«ãç©æ¥µçã«åè³ãããŠããã ããããšèããŠããŸãã7 æä»¥éã®ã€ãã³ããç©æ¥µçã«ã¹ãã³ãµãŒããããŠããã ããŸãã®ã§ããã²çæ§ã«ããè¶ãããã ãããããã®ãšã³ããªã§ã¯ã¡ãã¬ãŒãåè³ããã€ãã³ãã®é
åãã玹ä»ããŸãã Developers Summit 2019 Summer å
¬åŒãµã€ã 2019/07/02(ç«) @ãœã©ã·ãã£ã«ã³ãã¡ã¬ã³ã¹ã»ã³ã¿ãŒ ããã³ãºã¹ãã³ãµãŒ äžçªæåã«ã玹ä»ããã®ã¯ããåç¥ Developers Summit 2019 Summer(以éãããµãå€)ã§ãã æ¬å®¶ã§ãã Developers Summit 2019 å¬ã§ãåè³ãããŠããã ããŸããããä»åã®ãããµãå€ã§ã¯ããã³ãºã¹ãã³ãµãŒãšã㊠å·è¡åœ¹å¡ã§ããç°äž ã SI à Web ã®ç·ååã§åãæãæ°ãããšã³ãžãã¢ã®ãã£ãªã¢ãã¹ ãšããã¿ã€ãã«ã§ã話ããŸãã ããæ°å¹Žã§ X-Tech ã DX ã®å¿
èŠæ§ãäžæ°ã«å«ã°ããããã«ãªã£ãŠããŸããããã¡ãã¬ãŒã§ã å»çã«ãããããžã¿ã«ãã©ã³ã¹ãã©ãŒã¡ãŒã·ã§ã³ã®æšé² ãç®æããŠæ¥ã
ãããã¯ãã®éçºãé²ããŠããŸããX-Tech ã DX ãæšé²ããäžã§ããããããWeb ç³»ãšã³ãžãã¢ããšãSI ç³»ãšã³ãžãã¢ããšãã壿 ¹ãè¶ããããã€ããªãããªæ°ãããšã³ãžãã¢åãæ±ããããããã«ãªã£ãŠãããšæããŸããã課é¡ã解決ããããã«å¿
èŠãšãããããã«ãªã£ããã€ããªãããªèœåãšã¯?ããããããã®ãšã³ãžãã¢ã¯ã©ãæé·ããŠããã®ãããã?ããšããããšãã話ãããŠããã ããŸãã ãããããŸã§ãçŸæç¹ã§ã»ãã·ã§ã³ã¯æºå¡ã«ãªã£ãŠããŸããããã²ã芧ããã ããã°å¹žãã§ãã CloudNativeDays Tokyo 2019 / OpenStack Days Tokyo 2019 å
¬åŒãµã€ã 2019/07/22(æ) ~ 23(ç«) @èãéãã«ãºãã©ãŒã©ã ããã«ãã£ã¹ãã³ãµãŒ(ããŒãããã°) ä»å¹Žã¯ã€ãã³ãã®çµ±åããããåç§°ãäžæ°ãããæ¥æ¬æå€§çŽã®ã³ã³ããæè¡ãå§ããšããã¯ã©ãŠããã€ãã£ããšãªãŒãã³ã€ã³ãã©ã®ç¥å
žã§ããããã¡ãã®ã€ãã³ãã«ãåè³ãããŠããã ããŸãã åœæ¥äŒå Žã§é
ãããããŒãããã°ã«å
¬åŒããŽãšå
±ã«ã¡ãã¬ãŒã®ããŽãå
¥ããŠããã ããŸãããå®éã«ã©ããªãã¶ã€ã³ã«ãªããã¯åœæ¥ã«ãæ¥å ŽããŠããã ããŸã§ã®ã楜ãã¿ãšãããŠããã ããŸããããšãŠãè¯ããã®ã«ãªã£ãŠããããšæããŸãã builderscon tokyo 2019 å
¬åŒãµã€ã 2019/08/29(æš) ~ 31(å) @æ±äº¬é»æ©å€§åŠ(æ±äº¬åäœãã£ã³ãã¹)1 å·é€š ããã¯ããã«ã¹ãã³ãµãŒ 2016 幎ããæ¯å¹Žéå¬ãããŠãããè²ã
ãªåéã®ãšã³ãžãã¢ã®æ§ã
ãªã»ãã·ã§ã³ãäžæ°ã«èããã€ãã³ããbuilderscon tokyoãã§ãã(å»å¹Žã¯é»ååæãããžãã€ã³ãã¯ããããŸããã)ãä»å¹Žã¯åããŠã¹ãã³ãµãŒãšããŠåå ãããŠããã ãããšã«ãªããŸããã äŒå Žã§ããæ±äº¬é»æ©å€§åŠåäœãã£ã³ãã¹ã®éšå±ã®äžã€ã100 åšå¹Žèšå¿µããŒã«ã§ã»ãã·ã§ã³ããã¹ããŒã«ãŒããã®åŸãã«èšçœ®ãããããã¯ããã«ã®ãªãã«ãã¡ãã¬ãŒã®ããŽãå
¥ãããšã«ã ãã¡ãã®ã€ãã³ãã§ã¯åŒç€Ÿãšã³ãžãã¢ããéªéããäºå®ã§ãã®ã§ãäŒå Žã§ãæ°è»œã«ã声ããããŠããã ããã°ãšæããŸãã CODE BLUE 2019 å
¬åŒãµã€ã 2019/10/29(ç«) ~ 30(æ°Ž) @ãã«ãµãŒã«æžè°·ã¬ãŒãã³ ããã³ãºã¹ãã³ãµãŒ ä»å¹Žã§ 7 åç®ã®éå¬ãšãªãæ
å ±ã»ãã¥ãªãã£ã®åœéäŒè°ãCODE BLUE 2019ãã«åããŠã¹ãã³ãµãŒããããŠããã ããŠããŸãã ã¡ãã¬ãŒã§ãåãæ±ã£ãŠããæ
å ±ã®éèŠæ§ãããäŒç€ŸãšããŠã®åãçµã¿ã§ ISMS èªèšŒ / ISMS ã¯ã©ãŠãã»ãã¥ãªãã£èªèšŒãååŸ ããŠããŸããããã®ãããªã»ãã¥ãªãã£ã«é¢ããã€ãã³ãã«ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšä»å¹Žããåè³ãããŠããã ãããšã«ãªããŸããã DesginShip 2019 å
¬åŒãµã€ã 2019/11/23(å ) ~ 24(æ¥) @æ±äº¬åœéãã©ãŒã©ã B7 ã» B5 ã·ã«ããŒã¹ãã³ãµãŒ å»å¹Žããéå¬ãããŠãããã¶ã€ã³ã«ã³ãã¡ã¬ã³ã¹ãDesignShip 2019ãã«ãå»å¹Žããç¶ãã¹ãã³ãµãŒããããŠããã ããŸãã ä»å¹Žã¯äŒå Žãæ±äº¬åœéãã©ãŒã©ã ã«ãªããšããããšã§ãã¡ãã¬ãŒãå»å¹Žãããããã«ã¢ã¯ãã£ããªåœ¢ã§ã€ãã³ãã«åå ãããŠããã ãããšã«ãªãããã§ãã ãŸãšã ãããŸã§ã玹ä»ãããŠããã ããã€ãã³ã以å€ã«ãçŸåšãã¹ãã³ãµãŒã®æèšºããããŠããã ããŠããã€ãã³ããããã€ããããŸããããã¡ããæ±ºå®æ¬¡ç¬¬ããããã§ããã°ãšèããŠããŸãã ã¡ãã¬ãŒã§ã¯ãæè¡ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšããèãããããšã³ãžãã¢ã»ãã¶ã€ããŒã®æè¡ã€ãã³ããªã©ã«ãããããç©æ¥µçã«åè³ãããŠããã ãã¹ã¿ã³ã¹ãåã£ãŠããŸãã å
šãŠã®ã€ãã³ãã«åè³ã§ããããã§ã¯ãããŸããããã¹ãã³ãµãŒãæ¢ããŠããã€ãã³ãéå¶è
ã®æ¹ãããã£ããããŸããããäžåºŠãæ°è»œã«ãåãåããããã ããã°ãšæããŸãã®ã§ããããããé¡ãããŸãã ⌠ã¡ãã¬ãŒã£ãŠã©ããªäŒç€ŸïŒæ°ã«ãªã£ãæ¹ã¯ãã¡ã ã¡ãã¬ãŒã§åã | æ ªåŒäŒç€Ÿã¡ãã¬ãŒ ã¡ãã¬ãŒã®çµç¹æåãåéèŠé
ãã玹ä»ããŸã www.medley.jp
ããã«ã¡ã¯ãéçºæ¬éšãšã³ãžãã¢ã®å¹³æšã§ãã ã¡ãã¬ãŒã§ã¯ãæè¡ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšããèãããããšã³ãžãã¢ã»ãã¶ã€ããŒã®æè¡ã€ãã³ããªã©ã«ãç©æ¥µçã«åè³ãããŠããã ããããšèããŠããŸãã7 æä»¥éã®ã€ãã³ããç©æ¥µçã«ã¹ãã³ãµãŒããããŠããã ããŸãã®ã§ããã²çæ§ã«ããè¶ãããã ãããããã®ãšã³ããªã§ã¯ã¡ãã¬ãŒãåè³ããã€ãã³ãã®é
åãã玹ä»ããŸãã Developers Summit 2019 Summer å
¬åŒãµã€ã 2019/07/02(ç«) @ãœã©ã·ãã£ã«ã³ãã¡ã¬ã³ã¹ã»ã³ã¿ãŒ ããã³ãºã¹ãã³ãµãŒ äžçªæåã«ã玹ä»ããã®ã¯ããåç¥ Developers Summit 2019 Summer(以éãããµãå€)ã§ãã æ¬å®¶ã§ãã Developers Summit 2019 å¬ã§ãåè³ãããŠããã ããŸããããä»åã®ãããµãå€ã§ã¯ããã³ãºã¹ãã³ãµãŒãšã㊠å·è¡åœ¹å¡ã§ããç°äž ã SI à Web ã®ç·ååã§åãæãæ°ãããšã³ãžãã¢ã®ãã£ãªã¢ãã¹ ãšããã¿ã€ãã«ã§ã話ããŸãã ããæ°å¹Žã§ X-Tech ã DX ã®å¿
èŠæ§ãäžæ°ã«å«ã°ããããã«ãªã£ãŠããŸããããã¡ãã¬ãŒã§ã å»çã«ãããããžã¿ã«ãã©ã³ã¹ãã©ãŒã¡ãŒã·ã§ã³ã®æšé² ãç®æããŠæ¥ã
ãããã¯ãã®éçºãé²ããŠããŸããX-Tech ã DX ãæšé²ããäžã§ããããããWeb ç³»ãšã³ãžãã¢ããšãSI ç³»ãšã³ãžãã¢ããšãã壿 ¹ãè¶ããããã€ããªãããªæ°ãããšã³ãžãã¢åãæ±ããããããã«ãªã£ãŠãããšæããŸããã課é¡ã解決ããããã«å¿
èŠãšãããããã«ãªã£ããã€ããªãããªèœåãšã¯?ããããããã®ãšã³ãžãã¢ã¯ã©ãæé·ããŠããã®ãããã?ããšããããšãã話ãããŠããã ããŸãã ãããããŸã§ãçŸæç¹ã§ã»ãã·ã§ã³ã¯æºå¡ã«ãªã£ãŠããŸããããã²ã芧ããã ããã°å¹žãã§ãã CloudNativeDays Tokyo 2019 / OpenStack Days Tokyo 2019 å
¬åŒãµã€ã 2019/07/22(æ) ~ 23(ç«) @èãéãã«ãºãã©ãŒã©ã ããã«ãã£ã¹ãã³ãµãŒ(ããŒãããã°) ä»å¹Žã¯ã€ãã³ãã®çµ±åããããåç§°ãäžæ°ãããæ¥æ¬æå€§çŽã®ã³ã³ããæè¡ãå§ããšããã¯ã©ãŠããã€ãã£ããšãªãŒãã³ã€ã³ãã©ã®ç¥å
žã§ããããã¡ãã®ã€ãã³ãã«ãåè³ãããŠããã ããŸãã åœæ¥äŒå Žã§é
ãããããŒãããã°ã«å
¬åŒããŽãšå
±ã«ã¡ãã¬ãŒã®ããŽãå
¥ããŠããã ããŸãããå®éã«ã©ããªãã¶ã€ã³ã«ãªããã¯åœæ¥ã«ãæ¥å ŽããŠããã ããŸã§ã®ã楜ãã¿ãšãããŠããã ããŸããããšãŠãè¯ããã®ã«ãªã£ãŠããããšæããŸãã builderscon tokyo 2019 å
¬åŒãµã€ã 2019/08/29(æš) ~ 31(å) @æ±äº¬é»æ©å€§åŠ(æ±äº¬åäœãã£ã³ãã¹)1 å·é€š ããã¯ããã«ã¹ãã³ãµãŒ 2016 幎ããæ¯å¹Žéå¬ãããŠãããè²ã
ãªåéã®ãšã³ãžãã¢ã®æ§ã
ãªã»ãã·ã§ã³ãäžæ°ã«èããã€ãã³ããbuilderscon tokyoãã§ãã(å»å¹Žã¯é»ååæãããžãã€ã³ãã¯ããããŸããã)ãä»å¹Žã¯åããŠã¹ãã³ãµãŒãšããŠåå ãããŠããã ãããšã«ãªããŸããã äŒå Žã§ããæ±äº¬é»æ©å€§åŠåäœãã£ã³ãã¹ã®éšå±ã®äžã€ã100 åšå¹Žèšå¿µããŒã«ã§ã»ãã·ã§ã³ããã¹ããŒã«ãŒããã®åŸãã«èšçœ®ãããããã¯ããã«ã®ãªãã«ãã¡ãã¬ãŒã®ããŽãå
¥ãããšã«ã ãã¡ãã®ã€ãã³ãã§ã¯åŒç€Ÿãšã³ãžãã¢ããéªéããäºå®ã§ãã®ã§ãäŒå Žã§ãæ°è»œã«ã声ããããŠããã ããã°ãšæããŸãã CODE BLUE 2019 å
¬åŒãµã€ã 2019/10/29(ç«) ~ 30(æ°Ž) @ãã«ãµãŒã«æžè°·ã¬ãŒãã³ ããã³ãºã¹ãã³ãµãŒ ä»å¹Žã§ 7 åç®ã®éå¬ãšãªãæ
å ±ã»ãã¥ãªãã£ã®åœéäŒè°ãCODE BLUE 2019ãã«åããŠã¹ãã³ãµãŒããããŠããã ããŠããŸãã ã¡ãã¬ãŒã§ãåãæ±ã£ãŠããæ
å ±ã®éèŠæ§ãããäŒç€ŸãšããŠã®åãçµã¿ã§ ISMS èªèšŒ / ISMS ã¯ã©ãŠãã»ãã¥ãªãã£èªèšŒãååŸ ããŠããŸããããã®ãããªã»ãã¥ãªãã£ã«é¢ããã€ãã³ãã«ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšä»å¹Žããåè³ãããŠããã ãããšã«ãªããŸããã DesginShip 2019 å
¬åŒãµã€ã 2019/11/23(å ) ~ 24(æ¥) @æ±äº¬åœéãã©ãŒã©ã B7 ã» B5 ã·ã«ããŒã¹ãã³ãµãŒ å»å¹Žããéå¬ãããŠãããã¶ã€ã³ã«ã³ãã¡ã¬ã³ã¹ãDesignShip 2019ãã«ãå»å¹Žããç¶ãã¹ãã³ãµãŒããããŠããã ããŸãã ä»å¹Žã¯äŒå Žãæ±äº¬åœéãã©ãŒã©ã ã«ãªããšããããšã§ãã¡ãã¬ãŒãå»å¹Žãããããã«ã¢ã¯ãã£ããªåœ¢ã§ã€ãã³ãã«åå ãããŠããã ãããšã«ãªãããã§ãã ãŸãšã ãããŸã§ã玹ä»ãããŠããã ããã€ãã³ã以å€ã«ãçŸåšãã¹ãã³ãµãŒã®æèšºããããŠããã ããŠããã€ãã³ããããã€ããããŸããããã¡ããæ±ºå®æ¬¡ç¬¬ããããã§ããã°ãšèããŠããŸãã ã¡ãã¬ãŒã§ã¯ãæè¡ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšããèãããããšã³ãžãã¢ã»ãã¶ã€ããŒã®æè¡ã€ãã³ããªã©ã«ãããããç©æ¥µçã«åè³ãããŠããã ãã¹ã¿ã³ã¹ãåã£ãŠããŸãã å
šãŠã®ã€ãã³ãã«åè³ã§ããããã§ã¯ãããŸããããã¹ãã³ãµãŒãæ¢ããŠããã€ãã³ãéå¶è
ã®æ¹ãããã£ããããŸããããäžåºŠãæ°è»œã«ãåãåããããã ããã°ãšæããŸãã®ã§ããããããé¡ãããŸãã ⌠ã¡ãã¬ãŒã£ãŠã©ããªäŒç€ŸïŒæ°ã«ãªã£ãæ¹ã¯ãã¡ã ã¡ãã¬ãŒã§åã | æ ªåŒäŒç€Ÿã¡ãã¬ãŒ ã¡ãã¬ãŒã®çµç¹æåãåéèŠé
ãã玹ä»ããŸã www.medley.jp
ããã«ã¡ã¯ãéçºæ¬éšãšã³ãžãã¢ã®å¹³æšã§ãã ã¡ãã¬ãŒã§ã¯ãæè¡ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšããèãããããšã³ãžãã¢ã»ãã¶ã€ããŒã®æè¡ã€ãã³ããªã©ã«ãç©æ¥µçã«åè³ãããŠããã ããããšèããŠããŸãã7 æä»¥éã®ã€ãã³ããç©æ¥µçã«ã¹ãã³ãµãŒããããŠããã ããŸãã®ã§ããã²çæ§ã«ããè¶ãããã ãããããã®ãšã³ããªã§ã¯ã¡ãã¬ãŒãåè³ããã€ãã³ãã®é
åãã玹ä»ããŸãã Developers Summit 2019 Summer å
¬åŒãµã€ã 2019/07/02(ç«) @ãœã©ã·ãã£ã«ã³ãã¡ã¬ã³ã¹ã»ã³ã¿ãŒ ããã³ãºã¹ãã³ãµãŒ äžçªæåã«ã玹ä»ããã®ã¯ããåç¥ Developers Summit 2019 Summer(以éãããµãå€)ã§ãã æ¬å®¶ã§ãã Developers Summit 2019 å¬ã§ãåè³ãããŠããã ããŸããããä»åã®ãããµãå€ã§ã¯ããã³ãºã¹ãã³ãµãŒãšã㊠å·è¡åœ¹å¡ã§ããç°äž ã SI à Web ã®ç·ååã§åãæãæ°ãããšã³ãžãã¢ã®ãã£ãªã¢ãã¹ ãšããã¿ã€ãã«ã§ã話ããŸãã ããæ°å¹Žã§ X-Tech ã DX ã®å¿
èŠæ§ãäžæ°ã«å«ã°ããããã«ãªã£ãŠããŸããããã¡ãã¬ãŒã§ã å»çã«ãããããžã¿ã«ãã©ã³ã¹ãã©ãŒã¡ãŒã·ã§ã³ã®æšé² ãç®æããŠæ¥ã
ãããã¯ãã®éçºãé²ããŠããŸããX-Tech ã DX ãæšé²ããäžã§ããããããWeb ç³»ãšã³ãžãã¢ããšãSI ç³»ãšã³ãžãã¢ããšãã壿 ¹ãè¶ããããã€ããªãããªæ°ãããšã³ãžãã¢åãæ±ããããããã«ãªã£ãŠãããšæããŸããã課é¡ã解決ããããã«å¿
èŠãšãããããã«ãªã£ããã€ããªãããªèœåãšã¯?ããããããã®ãšã³ãžãã¢ã¯ã©ãæé·ããŠããã®ãããã?ããšããããšãã話ãããŠããã ããŸãã ãããããŸã§ãçŸæç¹ã§ã»ãã·ã§ã³ã¯æºå¡ã«ãªã£ãŠããŸããããã²ã芧ããã ããã°å¹žãã§ãã CloudNativeDays Tokyo 2019 / OpenStack Days Tokyo 2019 å
¬åŒãµã€ã 2019/07/22(æ) ~ 23(ç«) @èãéãã«ãºãã©ãŒã©ã ããã«ãã£ã¹ãã³ãµãŒ(ããŒãããã°) ä»å¹Žã¯ã€ãã³ãã®çµ±åããããåç§°ãäžæ°ãããæ¥æ¬æå€§çŽã®ã³ã³ããæè¡ãå§ããšããã¯ã©ãŠããã€ãã£ããšãªãŒãã³ã€ã³ãã©ã®ç¥å
žã§ããããã¡ãã®ã€ãã³ãã«ãåè³ãããŠããã ããŸãã åœæ¥äŒå Žã§é
ãããããŒãããã°ã«å
¬åŒããŽãšå
±ã«ã¡ãã¬ãŒã®ããŽãå
¥ããŠããã ããŸãããå®éã«ã©ããªãã¶ã€ã³ã«ãªããã¯åœæ¥ã«ãæ¥å ŽããŠããã ããŸã§ã®ã楜ãã¿ãšãããŠããã ããŸããããšãŠãè¯ããã®ã«ãªã£ãŠããããšæããŸãã builderscon tokyo 2019 å
¬åŒãµã€ã 2019/08/29(æš) ~ 31(å) @æ±äº¬é»æ©å€§åŠ(æ±äº¬åäœãã£ã³ãã¹)1 å·é€š ããã¯ããã«ã¹ãã³ãµãŒ 2016 幎ããæ¯å¹Žéå¬ãããŠãããè²ã
ãªåéã®ãšã³ãžãã¢ã®æ§ã
ãªã»ãã·ã§ã³ãäžæ°ã«èããã€ãã³ããbuilderscon tokyoãã§ãã(å»å¹Žã¯é»ååæãããžãã€ã³ãã¯ããããŸããã)ãä»å¹Žã¯åããŠã¹ãã³ãµãŒãšããŠåå ãããŠããã ãããšã«ãªããŸããã äŒå Žã§ããæ±äº¬é»æ©å€§åŠåäœãã£ã³ãã¹ã®éšå±ã®äžã€ã100 åšå¹Žèšå¿µããŒã«ã§ã»ãã·ã§ã³ããã¹ããŒã«ãŒããã®åŸãã«èšçœ®ãããããã¯ããã«ã®ãªãã«ãã¡ãã¬ãŒã®ããŽãå
¥ãããšã«ã ãã¡ãã®ã€ãã³ãã§ã¯åŒç€Ÿãšã³ãžãã¢ããéªéããäºå®ã§ãã®ã§ãäŒå Žã§ãæ°è»œã«ã声ããããŠããã ããã°ãšæããŸãã CODE BLUE 2019 å
¬åŒãµã€ã 2019/10/29(ç«) ~ 30(æ°Ž) @ãã«ãµãŒã«æžè°·ã¬ãŒãã³ ããã³ãºã¹ãã³ãµãŒ ä»å¹Žã§ 7 åç®ã®éå¬ãšãªãæ
å ±ã»ãã¥ãªãã£ã®åœéäŒè°ãCODE BLUE 2019ãã«åããŠã¹ãã³ãµãŒããããŠããã ããŠããŸãã ã¡ãã¬ãŒã§ãåãæ±ã£ãŠããæ
å ±ã®éèŠæ§ãããäŒç€ŸãšããŠã®åãçµã¿ã§ ISMS èªèšŒ / ISMS ã¯ã©ãŠãã»ãã¥ãªãã£èªèšŒãååŸ ããŠããŸããããã®ãããªã»ãã¥ãªãã£ã«é¢ããã€ãã³ãã«ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšä»å¹Žããåè³ãããŠããã ãããšã«ãªããŸããã DesginShip 2019 å
¬åŒãµã€ã 2019/11/23(å ) ~ 24(æ¥) @æ±äº¬åœéãã©ãŒã©ã B7 ã» B5 ã·ã«ããŒã¹ãã³ãµãŒ å»å¹Žããéå¬ãããŠãããã¶ã€ã³ã«ã³ãã¡ã¬ã³ã¹ãDesignShip 2019ãã«ãå»å¹Žããç¶ãã¹ãã³ãµãŒããããŠããã ããŸãã ä»å¹Žã¯äŒå Žãæ±äº¬åœéãã©ãŒã©ã ã«ãªããšããããšã§ãã¡ãã¬ãŒãå»å¹Žãããããã«ã¢ã¯ãã£ããªåœ¢ã§ã€ãã³ãã«åå ãããŠããã ãããšã«ãªãããã§ãã ãŸãšã ãããŸã§ã玹ä»ãããŠããã ããã€ãã³ã以å€ã«ãçŸåšãã¹ãã³ãµãŒã®æèšºããããŠããã ããŠããã€ãã³ããããã€ããããŸããããã¡ããæ±ºå®æ¬¡ç¬¬ããããã§ããã°ãšèããŠããŸãã ã¡ãã¬ãŒã§ã¯ãæè¡ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšããèãããããšã³ãžãã¢ã»ãã¶ã€ããŒã®æè¡ã€ãã³ããªã©ã«ãããããç©æ¥µçã«åè³ãããŠããã ãã¹ã¿ã³ã¹ãåã£ãŠããŸãã å
šãŠã®ã€ãã³ãã«åè³ã§ããããã§ã¯ãããŸããããã¹ãã³ãµãŒãæ¢ããŠããã€ãã³ãéå¶è
ã®æ¹ãããã£ããããŸããããäžåºŠãæ°è»œã«ãåãåããããã ããã°ãšæããŸãã®ã§ããããããé¡ãããŸãã ⌠ã¡ãã¬ãŒã£ãŠã©ããªäŒç€ŸïŒæ°ã«ãªã£ãæ¹ã¯ãã¡ã ã¡ãã¬ãŒã§åã | æ ªåŒäŒç€Ÿã¡ãã¬ãŒ ã¡ãã¬ãŒã®çµç¹æåãåéèŠé
ãã玹ä»ããŸã www.medley.jp
ããã«ã¡ã¯ãéçºæ¬éšãšã³ãžãã¢ã®å¹³æšã§ãã ã¡ãã¬ãŒã§ã¯ãæè¡ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšããèãããããšã³ãžãã¢ã»ãã¶ã€ããŒã®æè¡ã€ãã³ããªã©ã«ãç©æ¥µçã«åè³ãããŠããã ããããšèããŠããŸãã7 æä»¥éã®ã€ãã³ããç©æ¥µçã«ã¹ãã³ãµãŒããããŠããã ããŸãã®ã§ããã²çæ§ã«ããè¶ãããã ãããããã®ãšã³ããªã§ã¯ã¡ãã¬ãŒãåè³ããã€ãã³ãã®é
åãã玹ä»ããŸãã Developers Summit 2019 Summer å
¬åŒãµã€ã 2019/07/02(ç«) @ãœã©ã·ãã£ã«ã³ãã¡ã¬ã³ã¹ã»ã³ã¿ãŒ ããã³ãºã¹ãã³ãµãŒ äžçªæåã«ã玹ä»ããã®ã¯ããåç¥ Developers Summit 2019 Summer(以éãããµãå€)ã§ãã æ¬å®¶ã§ãã Developers Summit 2019 å¬ã§ãåè³ãããŠããã ããŸããããä»åã®ãããµãå€ã§ã¯ããã³ãºã¹ãã³ãµãŒãšã㊠å·è¡åœ¹å¡ã§ããç°äž ã SI à Web ã®ç·ååã§åãæãæ°ãããšã³ãžãã¢ã®ãã£ãªã¢ãã¹ ãšããã¿ã€ãã«ã§ã話ããŸãã ããæ°å¹Žã§ X-Tech ã DX ã®å¿
èŠæ§ãäžæ°ã«å«ã°ããããã«ãªã£ãŠããŸããããã¡ãã¬ãŒã§ã å»çã«ãããããžã¿ã«ãã©ã³ã¹ãã©ãŒã¡ãŒã·ã§ã³ã®æšé² ãç®æããŠæ¥ã
ãããã¯ãã®éçºãé²ããŠããŸããX-Tech ã DX ãæšé²ããäžã§ããããããWeb ç³»ãšã³ãžãã¢ããšãSI ç³»ãšã³ãžãã¢ããšãã壿 ¹ãè¶ããããã€ããªãããªæ°ãããšã³ãžãã¢åãæ±ããããããã«ãªã£ãŠãããšæããŸããã課é¡ã解決ããããã«å¿
èŠãšãããããã«ãªã£ããã€ããªãããªèœåãšã¯?ããããããã®ãšã³ãžãã¢ã¯ã©ãæé·ããŠããã®ãããã?ããšããããšãã話ãããŠããã ããŸãã ãããããŸã§ãçŸæç¹ã§ã»ãã·ã§ã³ã¯æºå¡ã«ãªã£ãŠããŸããããã²ã芧ããã ããã°å¹žãã§ãã CloudNativeDays Tokyo 2019 / OpenStack Days Tokyo 2019 å
¬åŒãµã€ã 2019/07/22(æ) ~ 23(ç«) @èãéãã«ãºãã©ãŒã©ã ããã«ãã£ã¹ãã³ãµãŒ(ããŒãããã°) ä»å¹Žã¯ã€ãã³ãã®çµ±åããããåç§°ãäžæ°ãããæ¥æ¬æå€§çŽã®ã³ã³ããæè¡ãå§ããšããã¯ã©ãŠããã€ãã£ããšãªãŒãã³ã€ã³ãã©ã®ç¥å
žã§ããããã¡ãã®ã€ãã³ãã«ãåè³ãããŠããã ããŸãã åœæ¥äŒå Žã§é
ãããããŒãããã°ã«å
¬åŒããŽãšå
±ã«ã¡ãã¬ãŒã®ããŽãå
¥ããŠããã ããŸãããå®éã«ã©ããªãã¶ã€ã³ã«ãªããã¯åœæ¥ã«ãæ¥å ŽããŠããã ããŸã§ã®ã楜ãã¿ãšãããŠããã ããŸããããšãŠãè¯ããã®ã«ãªã£ãŠããããšæããŸãã builderscon tokyo 2019 å
¬åŒãµã€ã 2019/08/29(æš) ~ 31(å) @æ±äº¬é»æ©å€§åŠ(æ±äº¬åäœãã£ã³ãã¹)1 å·é€š ããã¯ããã«ã¹ãã³ãµãŒ 2016 幎ããæ¯å¹Žéå¬ãããŠãããè²ã
ãªåéã®ãšã³ãžãã¢ã®æ§ã
ãªã»ãã·ã§ã³ãäžæ°ã«èããã€ãã³ããbuilderscon tokyoãã§ãã(å»å¹Žã¯é»ååæãããžãã€ã³ãã¯ããããŸããã)ãä»å¹Žã¯åããŠã¹ãã³ãµãŒãšããŠåå ãããŠããã ãããšã«ãªããŸããã äŒå Žã§ããæ±äº¬é»æ©å€§åŠåäœãã£ã³ãã¹ã®éšå±ã®äžã€ã100 åšå¹Žèšå¿µããŒã«ã§ã»ãã·ã§ã³ããã¹ããŒã«ãŒããã®åŸãã«èšçœ®ãããããã¯ããã«ã®ãªãã«ãã¡ãã¬ãŒã®ããŽãå
¥ãããšã«ã ãã¡ãã®ã€ãã³ãã§ã¯åŒç€Ÿãšã³ãžãã¢ããéªéããäºå®ã§ãã®ã§ãäŒå Žã§ãæ°è»œã«ã声ããããŠããã ããã°ãšæããŸãã CODE BLUE 2019 å
¬åŒãµã€ã 2019/10/29(ç«) ~ 30(æ°Ž) @ãã«ãµãŒã«æžè°·ã¬ãŒãã³ ããã³ãºã¹ãã³ãµãŒ ä»å¹Žã§ 7 åç®ã®éå¬ãšãªãæ
å ±ã»ãã¥ãªãã£ã®åœéäŒè°ãCODE BLUE 2019ãã«åããŠã¹ãã³ãµãŒããããŠããã ããŠããŸãã ã¡ãã¬ãŒã§ãåãæ±ã£ãŠããæ
å ±ã®éèŠæ§ãããäŒç€ŸãšããŠã®åãçµã¿ã§ ISMS èªèšŒ / ISMS ã¯ã©ãŠãã»ãã¥ãªãã£èªèšŒãååŸ ããŠããŸããããã®ãããªã»ãã¥ãªãã£ã«é¢ããã€ãã³ãã«ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšä»å¹Žããåè³ãããŠããã ãããšã«ãªããŸããã DesginShip 2019 å
¬åŒãµã€ã 2019/11/23(å ) ~ 24(æ¥) @æ±äº¬åœéãã©ãŒã©ã B7 ã» B5 ã·ã«ããŒã¹ãã³ãµãŒ å»å¹Žããéå¬ãããŠãããã¶ã€ã³ã«ã³ãã¡ã¬ã³ã¹ãDesignShip 2019ãã«ãå»å¹Žããç¶ãã¹ãã³ãµãŒããããŠããã ããŸãã ä»å¹Žã¯äŒå Žãæ±äº¬åœéãã©ãŒã©ã ã«ãªããšããããšã§ãã¡ãã¬ãŒãå»å¹Žãããããã«ã¢ã¯ãã£ããªåœ¢ã§ã€ãã³ãã«åå ãããŠããã ãããšã«ãªãããã§ãã ãŸãšã ãããŸã§ã玹ä»ãããŠããã ããã€ãã³ã以å€ã«ãçŸåšãã¹ãã³ãµãŒã®æèšºããããŠããã ããŠããã€ãã³ããããã€ããããŸããããã¡ããæ±ºå®æ¬¡ç¬¬ããããã§ããã°ãšèããŠããŸãã ã¡ãã¬ãŒã§ã¯ãæè¡ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšããèãããããšã³ãžãã¢ã»ãã¶ã€ããŒã®æè¡ã€ãã³ããªã©ã«ãããããç©æ¥µçã«åè³ãããŠããã ãã¹ã¿ã³ã¹ãåã£ãŠããŸãã å
šãŠã®ã€ãã³ãã«åè³ã§ããããã§ã¯ãããŸããããã¹ãã³ãµãŒãæ¢ããŠããã€ãã³ãéå¶è
ã®æ¹ãããã£ããããŸããããäžåºŠãæ°è»œã«ãåãåããããã ããã°ãšæããŸãã®ã§ããããããé¡ãããŸãã ⌠ã¡ãã¬ãŒã£ãŠã©ããªäŒç€ŸïŒæ°ã«ãªã£ãæ¹ã¯ãã¡ã ã¡ãã¬ãŒã§åã | æ ªåŒäŒç€Ÿã¡ãã¬ãŒ ã¡ãã¬ãŒã®çµç¹æåãåéèŠé
ãã玹ä»ããŸã www.medley.jp
ããã«ã¡ã¯ãéçºæ¬éšãšã³ãžãã¢ã®å¹³æšã§ãã ã¡ãã¬ãŒã§ã¯ãæè¡ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšããèãããããšã³ãžãã¢ã»ãã¶ã€ããŒã®æè¡ã€ãã³ããªã©ã«ãç©æ¥µçã«åè³ãããŠããã ããããšèããŠããŸãã7 æä»¥éã®ã€ãã³ããç©æ¥µçã«ã¹ãã³ãµãŒããããŠããã ããŸãã®ã§ããã²çæ§ã«ããè¶ãããã ãããããã®ãšã³ããªã§ã¯ã¡ãã¬ãŒãåè³ããã€ãã³ãã®é
åãã玹ä»ããŸãã Developers Summit 2019 Summer å
¬åŒãµã€ã 2019/07/02(ç«) @ãœã©ã·ãã£ã«ã³ãã¡ã¬ã³ã¹ã»ã³ã¿ãŒ ããã³ãºã¹ãã³ãµãŒ äžçªæåã«ã玹ä»ããã®ã¯ããåç¥ Developers Summit 2019 Summer(以éãããµãå€)ã§ãã æ¬å®¶ã§ãã Developers Summit 2019 å¬ã§ãåè³ãããŠããã ããŸããããä»åã®ãããµãå€ã§ã¯ããã³ãºã¹ãã³ãµãŒãšã㊠å·è¡åœ¹å¡ã§ããç°äž ã SI à Web ã®ç·ååã§åãæãæ°ãããšã³ãžãã¢ã®ãã£ãªã¢ãã¹ ãšããã¿ã€ãã«ã§ã話ããŸãã ããæ°å¹Žã§ X-Tech ã DX ã®å¿
èŠæ§ãäžæ°ã«å«ã°ããããã«ãªã£ãŠããŸããããã¡ãã¬ãŒã§ã å»çã«ãããããžã¿ã«ãã©ã³ã¹ãã©ãŒã¡ãŒã·ã§ã³ã®æšé² ãç®æããŠæ¥ã
ãããã¯ãã®éçºãé²ããŠããŸããX-Tech ã DX ãæšé²ããäžã§ããããããWeb ç³»ãšã³ãžãã¢ããšãSI ç³»ãšã³ãžãã¢ããšãã壿 ¹ãè¶ããããã€ããªãããªæ°ãããšã³ãžãã¢åãæ±ããããããã«ãªã£ãŠãããšæããŸããã課é¡ã解決ããããã«å¿
èŠãšãããããã«ãªã£ããã€ããªãããªèœåãšã¯?ããããããã®ãšã³ãžãã¢ã¯ã©ãæé·ããŠããã®ãããã?ããšããããšãã話ãããŠããã ããŸãã ãããããŸã§ãçŸæç¹ã§ã»ãã·ã§ã³ã¯æºå¡ã«ãªã£ãŠããŸããããã²ã芧ããã ããã°å¹žãã§ãã CloudNativeDays Tokyo 2019 / OpenStack Days Tokyo 2019 å
¬åŒãµã€ã 2019/07/22(æ) ~ 23(ç«) @èãéãã«ãºãã©ãŒã©ã ããã«ãã£ã¹ãã³ãµãŒ(ããŒãããã°) ä»å¹Žã¯ã€ãã³ãã®çµ±åããããåç§°ãäžæ°ãããæ¥æ¬æå€§çŽã®ã³ã³ããæè¡ãå§ããšããã¯ã©ãŠããã€ãã£ããšãªãŒãã³ã€ã³ãã©ã®ç¥å
žã§ããããã¡ãã®ã€ãã³ãã«ãåè³ãããŠããã ããŸãã åœæ¥äŒå Žã§é
ãããããŒãããã°ã«å
¬åŒããŽãšå
±ã«ã¡ãã¬ãŒã®ããŽãå
¥ããŠããã ããŸãããå®éã«ã©ããªãã¶ã€ã³ã«ãªããã¯åœæ¥ã«ãæ¥å ŽããŠããã ããŸã§ã®ã楜ãã¿ãšãããŠããã ããŸããããšãŠãè¯ããã®ã«ãªã£ãŠããããšæããŸãã builderscon tokyo 2019 å
¬åŒãµã€ã 2019/08/29(æš) ~ 31(å) @æ±äº¬é»æ©å€§åŠ(æ±äº¬åäœãã£ã³ãã¹)1 å·é€š ããã¯ããã«ã¹ãã³ãµãŒ 2016 幎ããæ¯å¹Žéå¬ãããŠãããè²ã
ãªåéã®ãšã³ãžãã¢ã®æ§ã
ãªã»ãã·ã§ã³ãäžæ°ã«èããã€ãã³ããbuilderscon tokyoãã§ãã(å»å¹Žã¯é»ååæãããžãã€ã³ãã¯ããããŸããã)ãä»å¹Žã¯åããŠã¹ãã³ãµãŒãšããŠåå ãããŠããã ãããšã«ãªããŸããã äŒå Žã§ããæ±äº¬é»æ©å€§åŠåäœãã£ã³ãã¹ã®éšå±ã®äžã€ã100 åšå¹Žèšå¿µããŒã«ã§ã»ãã·ã§ã³ããã¹ããŒã«ãŒããã®åŸãã«èšçœ®ãããããã¯ããã«ã®ãªãã«ãã¡ãã¬ãŒã®ããŽãå
¥ãããšã«ã ãã¡ãã®ã€ãã³ãã§ã¯åŒç€Ÿãšã³ãžãã¢ããéªéããäºå®ã§ãã®ã§ãäŒå Žã§ãæ°è»œã«ã声ããããŠããã ããã°ãšæããŸãã CODE BLUE 2019 å
¬åŒãµã€ã 2019/10/29(ç«) ~ 30(æ°Ž) @ãã«ãµãŒã«æžè°·ã¬ãŒãã³ ããã³ãºã¹ãã³ãµãŒ ä»å¹Žã§ 7 åç®ã®éå¬ãšãªãæ
å ±ã»ãã¥ãªãã£ã®åœéäŒè°ãCODE BLUE 2019ãã«åããŠã¹ãã³ãµãŒããããŠããã ããŠããŸãã ã¡ãã¬ãŒã§ãåãæ±ã£ãŠããæ
å ±ã®éèŠæ§ãããäŒç€ŸãšããŠã®åãçµã¿ã§ ISMS èªèšŒ / ISMS ã¯ã©ãŠãã»ãã¥ãªãã£èªèšŒãååŸ ããŠããŸããããã®ãããªã»ãã¥ãªãã£ã«é¢ããã€ãã³ãã«ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšä»å¹Žããåè³ãããŠããã ãããšã«ãªããŸããã DesginShip 2019 å
¬åŒãµã€ã 2019/11/23(å ) ~ 24(æ¥) @æ±äº¬åœéãã©ãŒã©ã B7 ã» B5 ã·ã«ããŒã¹ãã³ãµãŒ å»å¹Žããéå¬ãããŠãããã¶ã€ã³ã«ã³ãã¡ã¬ã³ã¹ãDesignShip 2019ãã«ãå»å¹Žããç¶ãã¹ãã³ãµãŒããããŠããã ããŸãã ä»å¹Žã¯äŒå Žãæ±äº¬åœéãã©ãŒã©ã ã«ãªããšããããšã§ãã¡ãã¬ãŒãå»å¹Žãããããã«ã¢ã¯ãã£ããªåœ¢ã§ã€ãã³ãã«åå ãããŠããã ãããšã«ãªãããã§ãã ãŸãšã ãããŸã§ã玹ä»ãããŠããã ããã€ãã³ã以å€ã«ãçŸåšãã¹ãã³ãµãŒã®æèšºããããŠããã ããŠããã€ãã³ããããã€ããããŸããããã¡ããæ±ºå®æ¬¡ç¬¬ããããã§ããã°ãšèããŠããŸãã ã¡ãã¬ãŒã§ã¯ãæè¡ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšããèãããããšã³ãžãã¢ã»ãã¶ã€ããŒã®æè¡ã€ãã³ããªã©ã«ãããããç©æ¥µçã«åè³ãããŠããã ãã¹ã¿ã³ã¹ãåã£ãŠããŸãã å
šãŠã®ã€ãã³ãã«åè³ã§ããããã§ã¯ãããŸããããã¹ãã³ãµãŒãæ¢ããŠããã€ãã³ãéå¶è
ã®æ¹ãããã£ããããŸããããäžåºŠãæ°è»œã«ãåãåããããã ããã°ãšæããŸãã®ã§ããããããé¡ãããŸãã ⌠ã¡ãã¬ãŒã£ãŠã©ããªäŒç€ŸïŒæ°ã«ãªã£ãæ¹ã¯ãã¡ã ã¡ãã¬ãŒã§åã | æ ªåŒäŒç€Ÿã¡ãã¬ãŒ ã¡ãã¬ãŒã®çµç¹æåãåéèŠé
ãã玹ä»ããŸã www.medley.jp
ããã«ã¡ã¯ãéçºæ¬éšãšã³ãžãã¢ã®å¹³æšã§ãã ã¡ãã¬ãŒã§ã¯ãæè¡ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšããèãããããšã³ãžãã¢ã»ãã¶ã€ããŒã®æè¡ã€ãã³ããªã©ã«ãç©æ¥µçã«åè³ãããŠããã ããããšèããŠããŸãã7 æä»¥éã®ã€ãã³ããç©æ¥µçã«ã¹ãã³ãµãŒããããŠããã ããŸãã®ã§ããã²çæ§ã«ããè¶ãããã ãããããã®ãšã³ããªã§ã¯ã¡ãã¬ãŒãåè³ããã€ãã³ãã®é
åãã玹ä»ããŸãã Developers Summit 2019 Summer å
¬åŒãµã€ã 2019/07/02(ç«) @ãœã©ã·ãã£ã«ã³ãã¡ã¬ã³ã¹ã»ã³ã¿ãŒ ããã³ãºã¹ãã³ãµãŒ äžçªæåã«ã玹ä»ããã®ã¯ããåç¥ Developers Summit 2019 Summer(以éãããµãå€)ã§ãã æ¬å®¶ã§ãã Developers Summit 2019 å¬ã§ãåè³ãããŠããã ããŸããããä»åã®ãããµãå€ã§ã¯ããã³ãºã¹ãã³ãµãŒãšã㊠å·è¡åœ¹å¡ã§ããç°äž ã SI à Web ã®ç·ååã§åãæãæ°ãããšã³ãžãã¢ã®ãã£ãªã¢ãã¹ ãšããã¿ã€ãã«ã§ã話ããŸãã ããæ°å¹Žã§ X-Tech ã DX ã®å¿
èŠæ§ãäžæ°ã«å«ã°ããããã«ãªã£ãŠããŸããããã¡ãã¬ãŒã§ã å»çã«ãããããžã¿ã«ãã©ã³ã¹ãã©ãŒã¡ãŒã·ã§ã³ã®æšé² ãç®æããŠæ¥ã
ãããã¯ãã®éçºãé²ããŠããŸããX-Tech ã DX ãæšé²ããäžã§ããããããWeb ç³»ãšã³ãžãã¢ããšãSI ç³»ãšã³ãžãã¢ããšãã壿 ¹ãè¶ããããã€ããªãããªæ°ãããšã³ãžãã¢åãæ±ããããããã«ãªã£ãŠãããšæããŸããã課é¡ã解決ããããã«å¿
èŠãšãããããã«ãªã£ããã€ããªãããªèœåãšã¯?ããããããã®ãšã³ãžãã¢ã¯ã©ãæé·ããŠããã®ãããã?ããšããããšãã話ãããŠããã ããŸãã ãããããŸã§ãçŸæç¹ã§ã»ãã·ã§ã³ã¯æºå¡ã«ãªã£ãŠããŸããããã²ã芧ããã ããã°å¹žãã§ãã CloudNativeDays Tokyo 2019 / OpenStack Days Tokyo 2019 å
¬åŒãµã€ã 2019/07/22(æ) ~ 23(ç«) @èãéãã«ãºãã©ãŒã©ã ããã«ãã£ã¹ãã³ãµãŒ(ããŒãããã°) ä»å¹Žã¯ã€ãã³ãã®çµ±åããããåç§°ãäžæ°ãããæ¥æ¬æå€§çŽã®ã³ã³ããæè¡ãå§ããšããã¯ã©ãŠããã€ãã£ããšãªãŒãã³ã€ã³ãã©ã®ç¥å
žã§ããããã¡ãã®ã€ãã³ãã«ãåè³ãããŠããã ããŸãã åœæ¥äŒå Žã§é
ãããããŒãããã°ã«å
¬åŒããŽãšå
±ã«ã¡ãã¬ãŒã®ããŽãå
¥ããŠããã ããŸãããå®éã«ã©ããªãã¶ã€ã³ã«ãªããã¯åœæ¥ã«ãæ¥å ŽããŠããã ããŸã§ã®ã楜ãã¿ãšãããŠããã ããŸããããšãŠãè¯ããã®ã«ãªã£ãŠããããšæããŸãã builderscon tokyo 2019 å
¬åŒãµã€ã 2019/08/29(æš) ~ 31(å) @æ±äº¬é»æ©å€§åŠ(æ±äº¬åäœãã£ã³ãã¹)1 å·é€š ããã¯ããã«ã¹ãã³ãµãŒ 2016 幎ããæ¯å¹Žéå¬ãããŠãããè²ã
ãªåéã®ãšã³ãžãã¢ã®æ§ã
ãªã»ãã·ã§ã³ãäžæ°ã«èããã€ãã³ããbuilderscon tokyoãã§ãã(å»å¹Žã¯é»ååæãããžãã€ã³ãã¯ããããŸããã)ãä»å¹Žã¯åããŠã¹ãã³ãµãŒãšããŠåå ãããŠããã ãããšã«ãªããŸããã äŒå Žã§ããæ±äº¬é»æ©å€§åŠåäœãã£ã³ãã¹ã®éšå±ã®äžã€ã100 åšå¹Žèšå¿µããŒã«ã§ã»ãã·ã§ã³ããã¹ããŒã«ãŒããã®åŸãã«èšçœ®ãããããã¯ããã«ã®ãªãã«ãã¡ãã¬ãŒã®ããŽãå
¥ãããšã«ã ãã¡ãã®ã€ãã³ãã§ã¯åŒç€Ÿãšã³ãžãã¢ããéªéããäºå®ã§ãã®ã§ãäŒå Žã§ãæ°è»œã«ã声ããããŠããã ããã°ãšæããŸãã CODE BLUE 2019 å
¬åŒãµã€ã 2019/10/29(ç«) ~ 30(æ°Ž) @ãã«ãµãŒã«æžè°·ã¬ãŒãã³ ããã³ãºã¹ãã³ãµãŒ ä»å¹Žã§ 7 åç®ã®éå¬ãšãªãæ
å ±ã»ãã¥ãªãã£ã®åœéäŒè°ãCODE BLUE 2019ãã«åããŠã¹ãã³ãµãŒããããŠããã ããŠããŸãã ã¡ãã¬ãŒã§ãåãæ±ã£ãŠããæ
å ±ã®éèŠæ§ãããäŒç€ŸãšããŠã®åãçµã¿ã§ ISMS èªèšŒ / ISMS ã¯ã©ãŠãã»ãã¥ãªãã£èªèšŒãååŸ ããŠããŸããããã®ãããªã»ãã¥ãªãã£ã«é¢ããã€ãã³ãã«ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšä»å¹Žããåè³ãããŠããã ãããšã«ãªããŸããã DesginShip 2019 å
¬åŒãµã€ã 2019/11/23(å ) ~ 24(æ¥) @æ±äº¬åœéãã©ãŒã©ã B7 ã» B5 ã·ã«ããŒã¹ãã³ãµãŒ å»å¹Žããéå¬ãããŠãããã¶ã€ã³ã«ã³ãã¡ã¬ã³ã¹ãDesignShip 2019ãã«ãå»å¹Žããç¶ãã¹ãã³ãµãŒããããŠããã ããŸãã ä»å¹Žã¯äŒå Žãæ±äº¬åœéãã©ãŒã©ã ã«ãªããšããããšã§ãã¡ãã¬ãŒãå»å¹Žãããããã«ã¢ã¯ãã£ããªåœ¢ã§ã€ãã³ãã«åå ãããŠããã ãããšã«ãªãããã§ãã ãŸãšã ãããŸã§ã玹ä»ãããŠããã ããã€ãã³ã以å€ã«ãçŸåšãã¹ãã³ãµãŒã®æèšºããããŠããã ããŠããã€ãã³ããããã€ããããŸããããã¡ããæ±ºå®æ¬¡ç¬¬ããããã§ããã°ãšèããŠããŸãã ã¡ãã¬ãŒã§ã¯ãæè¡ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšããèãããããšã³ãžãã¢ã»ãã¶ã€ããŒã®æè¡ã€ãã³ããªã©ã«ãããããç©æ¥µçã«åè³ãããŠããã ãã¹ã¿ã³ã¹ãåã£ãŠããŸãã å
šãŠã®ã€ãã³ãã«åè³ã§ããããã§ã¯ãããŸããããã¹ãã³ãµãŒãæ¢ããŠããã€ãã³ãéå¶è
ã®æ¹ãããã£ããããŸããããäžåºŠãæ°è»œã«ãåãåããããã ããã°ãšæããŸãã®ã§ããããããé¡ãããŸãã ⌠ã¡ãã¬ãŒã£ãŠã©ããªäŒç€ŸïŒæ°ã«ãªã£ãæ¹ã¯ãã¡ã ã¡ãã¬ãŒã§åã | æ ªåŒäŒç€Ÿã¡ãã¬ãŒ ã¡ãã¬ãŒã®çµç¹æåãåéèŠé
ãã玹ä»ããŸã www.medley.jp
ããã«ã¡ã¯ãéçºæ¬éšãšã³ãžãã¢ã®å¹³æšã§ãã ã¡ãã¬ãŒã§ã¯ãæè¡ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšããèãããããšã³ãžãã¢ã»ãã¶ã€ããŒã®æè¡ã€ãã³ããªã©ã«ãç©æ¥µçã«åè³ãããŠããã ããããšèããŠããŸãã7 æä»¥éã®ã€ãã³ããç©æ¥µçã«ã¹ãã³ãµãŒããããŠããã ããŸãã®ã§ããã²çæ§ã«ããè¶ãããã ãããããã®ãšã³ããªã§ã¯ã¡ãã¬ãŒãåè³ããã€ãã³ãã®é
åãã玹ä»ããŸãã Developers Summit 2019 Summer å
¬åŒãµã€ã 2019/07/02(ç«) @ãœã©ã·ãã£ã«ã³ãã¡ã¬ã³ã¹ã»ã³ã¿ãŒ ããã³ãºã¹ãã³ãµãŒ äžçªæåã«ã玹ä»ããã®ã¯ããåç¥ Developers Summit 2019 Summer(以éãããµãå€)ã§ãã æ¬å®¶ã§ãã Developers Summit 2019 å¬ã§ãåè³ãããŠããã ããŸããããä»åã®ãããµãå€ã§ã¯ããã³ãºã¹ãã³ãµãŒãšã㊠å·è¡åœ¹å¡ã§ããç°äž ã SI à Web ã®ç·ååã§åãæãæ°ãããšã³ãžãã¢ã®ãã£ãªã¢ãã¹ ãšããã¿ã€ãã«ã§ã話ããŸãã ããæ°å¹Žã§ X-Tech ã DX ã®å¿
èŠæ§ãäžæ°ã«å«ã°ããããã«ãªã£ãŠããŸããããã¡ãã¬ãŒã§ã å»çã«ãããããžã¿ã«ãã©ã³ã¹ãã©ãŒã¡ãŒã·ã§ã³ã®æšé² ãç®æããŠæ¥ã
ãããã¯ãã®éçºãé²ããŠããŸããX-Tech ã DX ãæšé²ããäžã§ããããããWeb ç³»ãšã³ãžãã¢ããšãSI ç³»ãšã³ãžãã¢ããšãã壿 ¹ãè¶ããããã€ããªãããªæ°ãããšã³ãžãã¢åãæ±ããããããã«ãªã£ãŠãããšæããŸããã課é¡ã解決ããããã«å¿
èŠãšãããããã«ãªã£ããã€ããªãããªèœåãšã¯?ããããããã®ãšã³ãžãã¢ã¯ã©ãæé·ããŠããã®ãããã?ããšããããšãã話ãããŠããã ããŸãã ãããããŸã§ãçŸæç¹ã§ã»ãã·ã§ã³ã¯æºå¡ã«ãªã£ãŠããŸããããã²ã芧ããã ããã°å¹žãã§ãã CloudNativeDays Tokyo 2019 / OpenStack Days Tokyo 2019 å
¬åŒãµã€ã 2019/07/22(æ) ~ 23(ç«) @èãéãã«ãºãã©ãŒã©ã ããã«ãã£ã¹ãã³ãµãŒ(ããŒãããã°) ä»å¹Žã¯ã€ãã³ãã®çµ±åããããåç§°ãäžæ°ãããæ¥æ¬æå€§çŽã®ã³ã³ããæè¡ãå§ããšããã¯ã©ãŠããã€ãã£ããšãªãŒãã³ã€ã³ãã©ã®ç¥å
žã§ããããã¡ãã®ã€ãã³ãã«ãåè³ãããŠããã ããŸãã åœæ¥äŒå Žã§é
ãããããŒãããã°ã«å
¬åŒããŽãšå
±ã«ã¡ãã¬ãŒã®ããŽãå
¥ããŠããã ããŸãããå®éã«ã©ããªãã¶ã€ã³ã«ãªããã¯åœæ¥ã«ãæ¥å ŽããŠããã ããŸã§ã®ã楜ãã¿ãšãããŠããã ããŸããããšãŠãè¯ããã®ã«ãªã£ãŠããããšæããŸãã builderscon tokyo 2019 å
¬åŒãµã€ã 2019/08/29(æš) ~ 31(å) @æ±äº¬é»æ©å€§åŠ(æ±äº¬åäœãã£ã³ãã¹)1 å·é€š ããã¯ããã«ã¹ãã³ãµãŒ 2016 幎ããæ¯å¹Žéå¬ãããŠãããè²ã
ãªåéã®ãšã³ãžãã¢ã®æ§ã
ãªã»ãã·ã§ã³ãäžæ°ã«èããã€ãã³ããbuilderscon tokyoãã§ãã(å»å¹Žã¯é»ååæãããžãã€ã³ãã¯ããããŸããã)ãä»å¹Žã¯åããŠã¹ãã³ãµãŒãšããŠåå ãããŠããã ãããšã«ãªããŸããã äŒå Žã§ããæ±äº¬é»æ©å€§åŠåäœãã£ã³ãã¹ã®éšå±ã®äžã€ã100 åšå¹Žèšå¿µããŒã«ã§ã»ãã·ã§ã³ããã¹ããŒã«ãŒããã®åŸãã«èšçœ®ãããããã¯ããã«ã®ãªãã«ãã¡ãã¬ãŒã®ããŽãå
¥ãããšã«ã ãã¡ãã®ã€ãã³ãã§ã¯åŒç€Ÿãšã³ãžãã¢ããéªéããäºå®ã§ãã®ã§ãäŒå Žã§ãæ°è»œã«ã声ããããŠããã ããã°ãšæããŸãã CODE BLUE 2019 å
¬åŒãµã€ã 2019/10/29(ç«) ~ 30(æ°Ž) @ãã«ãµãŒã«æžè°·ã¬ãŒãã³ ããã³ãºã¹ãã³ãµãŒ ä»å¹Žã§ 7 åç®ã®éå¬ãšãªãæ
å ±ã»ãã¥ãªãã£ã®åœéäŒè°ãCODE BLUE 2019ãã«åããŠã¹ãã³ãµãŒããããŠããã ããŠããŸãã ã¡ãã¬ãŒã§ãåãæ±ã£ãŠããæ
å ±ã®éèŠæ§ãããäŒç€ŸãšããŠã®åãçµã¿ã§ ISMS èªèšŒ / ISMS ã¯ã©ãŠãã»ãã¥ãªãã£èªèšŒãååŸ ããŠããŸããããã®ãããªã»ãã¥ãªãã£ã«é¢ããã€ãã³ãã«ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšä»å¹Žããåè³ãããŠããã ãããšã«ãªããŸããã DesginShip 2019 å
¬åŒãµã€ã 2019/11/23(å ) ~ 24(æ¥) @æ±äº¬åœéãã©ãŒã©ã B7 ã» B5 ã·ã«ããŒã¹ãã³ãµãŒ å»å¹Žããéå¬ãããŠãããã¶ã€ã³ã«ã³ãã¡ã¬ã³ã¹ãDesignShip 2019ãã«ãå»å¹Žããç¶ãã¹ãã³ãµãŒããããŠããã ããŸãã ä»å¹Žã¯äŒå Žãæ±äº¬åœéãã©ãŒã©ã ã«ãªããšããããšã§ãã¡ãã¬ãŒãå»å¹Žãããããã«ã¢ã¯ãã£ããªåœ¢ã§ã€ãã³ãã«åå ãããŠããã ãããšã«ãªãããã§ãã ãŸãšã ãããŸã§ã玹ä»ãããŠããã ããã€ãã³ã以å€ã«ãçŸåšãã¹ãã³ãµãŒã®æèšºããããŠããã ããŠããã€ãã³ããããã€ããããŸããããã¡ããæ±ºå®æ¬¡ç¬¬ããããã§ããã°ãšèããŠããŸãã ã¡ãã¬ãŒã§ã¯ãæè¡ãæ¥çã®çºå±ã«å°ãã§ãå¯äžã§ããã°ãšããèãããããšã³ãžãã¢ã»ãã¶ã€ããŒã®æè¡ã€ãã³ããªã©ã«ãããããç©æ¥µçã«åè³ãããŠããã ãã¹ã¿ã³ã¹ãåã£ãŠããŸãã å
šãŠã®ã€ãã³ãã«åè³ã§ããããã§ã¯ãããŸããããã¹ãã³ãµãŒãæ¢ããŠããã€ãã³ãéå¶è
ã®æ¹ãããã£ããããŸããããäžåºŠãæ°è»œã«ãåãåããããã ããã°ãšæããŸãã®ã§ããããããé¡ãããŸãã ⌠ã¡ãã¬ãŒã£ãŠã©ããªäŒç€ŸïŒæ°ã«ãªã£ãæ¹ã¯ãã¡ã ã¡ãã¬ãŒã§åãïœæ ªåŒäŒç€Ÿã¡ãã¬ãŒ ã¡ãã¬ãŒã§ã®åãæ¹ã人äºå¶åºŠãæ±äººæ
å ±ãªã©ãæ¡çšã«é¢ããæ
å ±ãã玹ä»ããŸãã www.medley.jp
ããã«ã¡ã¯ãéçºæ¬éšã®ãšã³ãžãã¢ã®é¶Žã§ãã ä»åã¯å
æã«è¡ã£ã瀟å
ã®ååŒ·äŒ TechLunch ã®å
容ãã玹ä»ãããŠããã ããŸãã ã€ã³ãã Web ãµãŒãã¹ã§ã¯ããŠãŒã¶ãŒã«ã¢ã«ãŠã³ããäœã£ãŠãããããã°ã€ã³ãããŠãµãŒãã¹ãå©çšããŠãããããšãããŠãŒã¶ãŒèªèšŒãå©çšãããµãŒãã¹ãå€ãããšæããŸãã Web ãµãŒãã¹ãéçºããåŽãšããŠã¯ããµãŒãã¹ããšã«éœåºŠãŠãŒã¶ãŒèªèšŒã®ä»çµã¿ãæ§ç¯ããå¿
èŠããããŸãããã»ãã¥ãªãã£å¯Ÿçã®èгç¹ããèæ
®ããããšãå€ããå°å³ã«éçºã®å·¥æ°ãããã£ãŠããŸããŸãã ãŸãæè¿ã§ã¯ã Amazon Cognito ã Firebase Authentication ã Auth0 ãªã©ããŠãŒã¶ãŒèªèšŒãµãŒãã¹ãããã€ããªãªãŒã¹ããããŠãŒã¶ãŒèªèšŒã®æ©èœããããã®å€éšãµãŒãã¹ã«ä»»ããŠéçºã®æéãçããšããéžæè¢ãåããããã«ãªã£ãŠããŠããŸãã èªåèªèº«ããã€ãŠæ
åœãããããžã§ã¯ãã§ãŠãŒã¶ãŒèªèšŒã®ä»çµã¿ã Amazon Cognito ã«ãŸãããŠã·ã¹ãã ãæ§ç¯ããããšããããŸããã ããããåœæã¯ç¹ã«ãŠãŒã¶ãŒããŒã«ã®æ©èœããªãªãŒã¹ãããŠéããªãããšããããSDK ã®åäœããµãŒãã¹ã®ä»æ§ã®çè§£ã«ããªãæéåã£ãããšãèŠããŠããŸãã ãŠãŒã¶ãŒèªèšŒãµãŒãã¹ã§ã¯ OpenID Connect ãšãã仿§ã«æºæ ããŠããããšãå€ãã®ã§ãããããããèªåã«ãšã£ãŠãã®ä»æ§ã®çè§£ãçãã ã£ãããšãåå ã®äžã€ã ã£ããšæããŸãã ããã§ä»åã¯ããŠãŒã¶ãŒèªèšŒãš OpenID Connect ã®ä»çµã¿ã«ã€ããŠæ¹ããŠå匷ãçŽããã®ã§ããã®å
容ãç°¡åã«è§£èª¬ããããŠããã ãããšæããŸãã ãŠãŒã¶ãŒèªèšŒãšã¯ ãŠãŒã¶ãŒèªèšŒã®åã«ãããããèªèšŒãšã¯ã©ãããæäœã®ããšãæãã®ã§ããããã ã¿ããªå€§å¥œã Wikipedia å
ç ã«ãããšã以äžã®ãããªèšèŒããããŸãã èªèšŒïŒã«ããããïŒãšã¯ãäœãã«ãã£ãŠãå¯Ÿè±¡ã®æ£åœæ§ã確èªããè¡çºãæãã èªèšŒè¡çºã¯èªèšŒå¯Ÿè±¡ãã£ãŠåé¡ãããèªèšŒå¯Ÿè±¡ã人éã§ããå Žåã«ã¯çžæèªèšŒïŒæ¬äººèªèšŒïŒãã¡ãã»ãŒãžã§ããå Žåã«ã¯ã¡ãã»ãŒãžèªèšŒãæå»ã®å Žåã«ã¯æå»èªèšŒãšåŒã¶ã åã«èªèšŒãšèšã£ãå Žåã«ã¯çžæèªèšŒãæãå Žåãå€ãã ãŠãŒã¶ãŒèªèšŒã¯ Web ãµãŒãã¹ã«ãšã£ãŠãªã¯ãšã¹ããéä¿¡ããŠããçžæã®æ£åœæ§ãèªèšŒããããšãªã®ã§ãçžæèªèšŒã® 1 ã€ã§ããã ããã«çžæèªèšŒã®èªèšŒæ¹æ³ãšã㊠2 éãã®æ¹æ³ããããŸãã 第 1 ã®æ¹æ³ã¯ã被èªèšŒè
ãèªèšŒè
ã«ãç§å¯éµããã£ãŠããããšã«ãã£ãŠåŸãããäœããã®èœåã®èšŒæãè¡ãæ¹æ³ã§ããã第 2 ã®æ¹æ³ã¯ã被èªèšŒè
ãèªèšŒè
ã«ã被èªèšŒè
ã®å
¬ééµã«å¯Ÿå¿ããç§å¯éµã®ç¥èã®èšŒæãè¡ãæ¹æ³ã§ããã ãŠãŒã¶ãŒèªèšŒã®å Žåãå€ãã¯ãã®ç¬¬ 1 ã®æ¹æ³ã§ã®èªèšŒã§ããã°ã€ã³æã«ãŠãŒã¶ãŒ ID ã«å ããŠããã®ãç§å¯éµããšããŠã¢ã«ãŠã³ãäœææã«ç»é²ããŠããããã¹ã¯ãŒããå
¥åããããšã§ãŠãŒã¶ãŒèªèšŒãè¡ã£ãŠããããšæããŸãã Web ãµãŒãã¹ã§ã®ãŠãŒã¶ãŒèªèšŒ Web ãµãŒãã¹ã§æ±ãæ
å ±ã®ç§å¿æ§ãé«ããªãã°ãªãã»ã©ããã®ãç§å¯éµããæ¬åœã«ãã®ãŠãŒã¶ãŒã«ããæäŸã§ããªãæ
å ±ã§ããããšãæ±ããããŸãã äžè¿°ã®ãããªãã¹ã¯ãŒãã«ããèªèšŒã®å Žåããã¹ã¯ãŒããæšæž¬ããããªã©ããŠæªæã®ãã第äžè
ã«ã¢ã«ãŠã³ããä¹ã£åãããŠããŸãäºä»¶ã¯ããè³ã«ããŸãã ããã»ãã¥ãªãã£ãé«ããããããã¹ã¯ãŒã以å€ã®èªèšŒãå€èŠçŽ èªèšŒãªã©ãçšããäºãå¢ããŠããŸããã ãŸããã»ãã¥ãªãã£ã®èгç¹ã ãã§ãªãå©äŸ¿æ§ã®èгç¹ãããããã¹ã¯ãŒãå
¥åã®ä»£ããã«æçŽèªèšŒãé¡èªèšŒã«ãããã°ã€ã³ãããããã¯åçš® SNS ã¢ã«ãŠã³ãã«ãããã°ã€ã³ãå¢ããŠããŠããŸããèªç€Ÿã®è€æ°ã®ãµãŒãã¹ã飿ºã§ãããããŠãŒã¶ãŒã«å
±é ID ãæäŸãããããšãã£ãã±ãŒã¹ããããããããŸããã æè¿ã§ã¯ãã¹ã¯ãŒãã¬ã¹èªèšŒã WebAuthn ãæ³šç®ãããŠããŸãããä»åã¯ç޹ä»ã¯å²æããŸããããã¹ã¯ãŒãã¬ã¹èªèšŒã®äžã€ã§ãã FIDO èªèšŒ ã¯ãåè¿°ã®ã被èªèšŒè
ãèªèšŒè
ã«ã被èªèšŒè
ã®å
¬ééµã«å¯Ÿå¿ããç§å¯éµã®ç¥èã®èšŒæãè¡ãæ¹æ³ããå©çšããèªèšŒæ¹åŒã®ããã§ããïŒ ref1 , ref2 ïŒ ãã®ããã«ãã»ãã¥ãªãã£ã®èгç¹ããŠãŒã¶ãŒå©äŸ¿æ§ã®èгç¹ãªã©ã«ãããWeb ãµãŒãã¹ã«ããããŠãŒã¶ãŒèªèšŒæ©èœã¯ 1 åäœã£ããçµããã§ã¯ãªããææµã«å¿ããŠé©å®æ¹ä¿®ããå¿
èŠãåºãŠããããšãããããšæããŸãã ããããç¹ã«ãŠãŒã¶ãŒèªèšŒãã¡ã€ã³ã®ãµãŒãã¹ãšå¯çµåããŠããå Žåãªã©ã§ã¯ãèªèšŒã®ååŸãªã©èªèšŒåŠçãã®ãã®ã ãã§ãªããã®åšèŸºã®åŠçãžã®åœ±é¿ç¯å²ãç¡èŠã§ããªãå ŽåãããããŠãŒã¶ãŒèªèšŒã®æ¹ä¿®ã«å·¥æ°ãæã£ãããããã£ãŠããŸã£ããã察å¿ãæ»ã£ãŠããŸãããšããããããããŸããã ãããªãšããèªèšŒãµãŒãã¹ãã¡ã€ã³ã®ãµãŒãã¹ãšåãé¢ãããšã§ããæè»ãªãŠãŒã¶ãŒèªèšŒææ®µãæäŸã§ãããããOpenID Connect ã®å°å
¥ãæ€èšããŠã¿ãŠãè¯ããããããŸããã OpenID Connect ãšã¯ OpenID Connect(以éãOIDC)ã«ã€ããŠãæ¬å®¶ãµã€ãã§ã¯ä»¥äžã®ããã«èª¬æãããŠããŸãã OpenID Connect 1.0 ã¯, OAuth 2.0 ãããã³ã«ã®äžã«ã·ã³ãã«ãªã¢ã€ãã³ãã£ãã£ã¬ã€ã€ãŒãä»äžãããã®ã§ãã. ãã®ãããã³ã«ã¯ Client ã Authorization Server ã®èªèšŒçµæã«åºã¥ã㊠End-User ã®ã¢ã€ãã³ãã£ãã£ãæ€èšŒå¯èœã«ãã. ãŸãåæã« End-User ã®å¿
èŠæäœéã®ãããã£ãŒã«æ
å ±ã, çžäºéçšå¯èœã〠RESTful ãªåœ¢ã§ååŸããããšãå¯èœã«ãã. ãã®ä»æ§ã¯, OpenID Connect ã®äž»èŠãªæ©èœã§ãã OAuth 2.0 äžã§ End-User ã®æ
å ±äŒéã®ããã«ã¯ã¬ãŒã ãçšããèªèšŒæ©èœãå®çŸ©ãã. ãã®ä»æ§ã¯ãŸã, OpenID Connect ãå©çšããããã® Security, Privacy Considerations ã説æãã. ïŒ æ¥æ¬èª , è±èª ïŒ å人çã«ã¯ãã¡ã€ã³ã®ãµãŒãã¹ãšèªèšŒãµãŒãã¹ãåãé¢ããŠéçšããããšãæ³å®ããŠä»æ§ãèŠå®ãããŠããç¹ãéèŠãšèããŸãã OIDC ãå©çšããããšã§ããŠãŒã¶ãŒèªèšŒãããæè»ã«æ¹ä¿®ãããæ°ããèªèšŒæ¹æ³ã«å¯Ÿå¿ãããããããšããããããªãããšãæåŸ
ãããããã§ãã ãªããOIDC ã®ä»æ§ã«ã¯èªèšŒææ®µèªäœïŒãã¹ã¯ãŒãèªèšŒãå€èŠçŽ èªèšŒãªã©ïŒã«é¢ããŠã¯èŠå®ãããŠãããããããŸã§èªèšŒãµãŒãã¹ã«ããèªèšŒçµæã®ååŸæ¹æ³ãæ±ãæ¹ã«ã€ããŠãèŠå®ãããŠããŸãã ãŸããæ§ã
ãªãŠãŒã¹ã±ãŒã¹ã«å¯Ÿå¿ã§ããããããã€ãã®åŠçãããŒããªãã·ã§ãã«ãªèšå®ãæäŸãããŠããŸããããã®åé¢ã»ãã¥ãªãã£ã®ç¢ºä¿ã¯å®è£
è
ã«å§ããããŠããããŠãŒã¹ã±ãŒã¹ã«å¿ããŠé©åãªå®è£
ãè¡ãå¿
èŠããããŸãã åè¿°ãããŠãŒã¶ãŒèªèšŒãµãŒãã¹ã§ãã Amazon Cognito ã FirebaseAuthentication ãªã©ã¯ãèªèšŒææ®µãæšæºã§ããã€ãæäŸãããŠãããå ããŠããã¯ãšã³ããš SDK ã« OIDC åºæã®ã»ãã¥ã¢ãªå®è£
ãæœãããŠãããããéçºè
ã¯æå°éã®èšå®ã ãã§ãŠãŒã¶ãŒèªèšŒæ©èœãå©çšã§ããããã«ãªããŸãã䟿å©ã§ããã åŠçãããŒã®è§£èª¬ ããŠãOIDC ã®å
·äœçãªåŠçã«ã€ããŠè§£èª¬ããŠããããšæããŸãã ãŸãç»å Žäººç©ã§ãã OpenID ProviderïŒOPïŒïŒèªèšŒèªå¯ãè¡ããµãŒãã¹ããŠãŒã¶ãŒèªèšŒæ
å ±ïŒèå¥åããã¹ã¯ãŒããªã©ïŒã管çããããèªèšŒã«é¢ãããŠãŒã¶ãŒå±æ§æ
å ±ïŒæ°åããŠãŒã¶ãŒåãªã©ïŒãä¿æããã RelyingPartyïŒRPïŒïŒ ã¢ã¯ã»ã¹å
ã®ãŠãŒã¶ãŒã®èªèšŒãšãŠãŒã¶ãŒå±æ§æ
å ±ãèŠæ±ãããµãŒãã¹ããŠãŒã¶ãŒããã®ãªã¯ãšã¹ãã«å¯Ÿã OP ã«ããèªèšŒçµæãä¿¡é ŒïŒrelyïŒããŠãªãœãŒã¹ãžã®ã¢ã¯ã»ã¹ãèš±å¯ããïŒäŸãã°ãã€ããŒãžã衚瀺ãããªã©ïŒã EndUserïŒãã°ã€ã³ãããŠãµãŒãã¹ãå©çšããããšããŠãããŠãŒã¶ãŒã åºæ¬çãªçšèªãå
ã«ç°¡åã«ç޹ä»ããŠãããŸãã ã¯ã©ã€ã¢ã³ã IDïŒOpenID Provider ã§ç®¡çãããRelyingParty ã®è奿
å ±ã ã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ããïŒOpenID Provider ã RelyingParty ããšã«çºè¡ããç§å¯éµã èªèšŒã³ãŒãïŒåŸè¿°ãã AuthorizationCodeFlow ã§ OpenID Provider ãçºè¡ããçåœã®ãã¹ã¯ãŒãã®ãããªãã®ã ID ããŒã¯ã³ïŒOpenID Provider ããçºè¡ãããããŠãŒã¶ãŒã«ããèªèšŒãè¡ã£ã蚌ææ
å ±ã JSON Web Token(JWT) ã§è¡šçŸãããæ€èšŒã«ããæ¹ããæ€ç¥ããããšãã§ãããèªèšŒã®å
容ïŒOpenID ProviderããŠãŒã¶ãŒèå¥åãRelyingParty ã®ã¯ã©ã€ã¢ã³ã IDãæå¹æéãªã©ïŒããŠãŒã¶ãŒå±æ§æ
å ±ãæ ŒçŽãããã ã¢ã¯ã»ã¹ããŒã¯ã³:OpenID Provider ãä¿æãããŠãŒã¶ãŒå±æ§æ
å ±ã«å¯Ÿãã¢ã¯ã»ã¹ããããã® OAuth2 ã®èªå¯ããŒã¯ã³ã OIDC ã®åŠçãããŒã¯å€§ããåã㊠3 çš®é¡ãèŠå®ãããŠããŸãã AuthorizationCodeFlowïŒèªèšŒæåæã« OpenID Provider ã RelyingParty ã«å¯ŸãèªèšŒã³ãŒããçºè¡ããRelyingParty ã¯ãããçšã㊠OpenID Provider ãã ID ããŒã¯ã³çãååŸãããRelyingParty ããµãŒããŒãµã€ãã¢ããªã±ãŒã·ã§ã³ã§ãOpenID Provider ããçºè¡ãããã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå®å
šã«ç®¡çããããšãã§ããå Žåãªã©ã«çšããããã ImplicitFlowïŒèªèšŒã³ãŒãã䜿ããèªèšŒçµæã®ã¬ã¹ãã³ã¹ã§ ID ããŒã¯ã³çãååŸãããRelyingParty ãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã®å Žåãªã©ãã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå®å
šã«ç®¡çã§ããªãå Žåãªã©ã«çšããããã HybridFlowïŒAuthorizationCodeFlow ãš ImplicitFlow ã®çµã¿åããã ãããã®ãããŒã®éãã¯ä»¥äžã®è¡šã®ãšããã§ãã ïŒ å
¬åŒããåŒçš ïŒ ä»åã¯ã å
¬åŒ ã ãã¡ãã®è§£èª¬èšäº ãªã©ãåç
§ããªãããåºæ¬ã®åŠçãããŒã§ãã AuthorizationCodeFlow ã«ã€ããŠè§£èª¬ããŸãã ç°¡ç¥åã®ãããã€ã¡ãŒãžéèŠã§ç»å Žäººç©ã¯ã ãŠãŒã¶ãŒ ããïŒãŠãŒã¶ãŒã«ãµãŒãã¹ãæäŸããïŒ Web ãµãŒãã¹ ãã èªèšŒãµãŒãã¹ ããšè¡šçŸããããšã«ããŸãã 倧ãŸãã«ã¯ä»¥äžã®ã¹ãããã§åŠçãè¡ãããŸãã ãŠãŒã¶ãŒ ããã®ã¢ã¯ã»ã¹ã«å¯Ÿãã Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ã«ãŠãŒã¶ãŒèªèšŒãèŠæ±ãã èªèšŒãµãŒãã¹ ã¯ãŠãŒã¶ãŒèªèšŒãè¡ããèªèšŒã³ãŒããçºè¡ããŠã ãŠãŒã¶ãŒ ã Web ãµãŒãã¹ ã«ãªãã€ã¬ã¯ãããã Web ãµãŒã㹠㯠2 ã§ååŸããèªèšŒã³ãŒããçšã㊠èªèšŒãµãŒãã¹ ã« ID ããŒã¯ã³çããªã¯ãšã¹ããã Web ãµãŒã㹠㯠3 ã§ååŸãã ID ããŒã¯ã³ãæ€èšŒãã ãŠãŒã¶ãŒ ã®èå¥åãååŸãã Step.0 : äºåæºå ããããã Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ããã¯ã©ã€ã¢ã³ã ID ãšã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããååŸãä¿æããŠãããŸãã Step.1: ãŠãŒã¶ãŒèªèšŒã®èŠæ± ãŠãŒã¶ãŒ ã Web ãµãŒãã¹ ã«å¯Ÿãäžè¬çãªãã°ã€ã³ã®æµãã§ãã°ã€ã³ãèŠæ±ãããšã Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ã«ãªã¯ãšã¹ãããªãã€ã¬ã¯ãããŸãã Web ãµãŒãã¹ ãã èªèšŒãµãŒãã¹ ãžã®ãªãã€ã¬ã¯ãã® URL ã¯ä»¥äžã®ãããªæãã§ãã HTTP / 1.1 302 Found Location: https://server.example.com/authorize? response_type=code & client_id = s6BhdRkqt3 & redirect_uri = https%3A%2F%2Fclient.example.org%2Fcb & scope = openid%20profile & state = af0ifjsldkj response_type ã§ OIDC ã®ã©ã®èªèšŒãããŒã䜿ãããæå®ããŸãã redirect_uri ã¯ã èªèšŒãµãŒãã¹ ã§ã®èªèšŒãæåãããšãã® Web ãµãŒãã¹ ã«ã³ãŒã«ããã¯ãã URL ã§ããããã¯äºåã«èªèšŒãµãŒãã¹ã«ç»é²ããŠããå¿
èŠããããŸãã scope ã«ã¯èªèšŒã®å
容ãèšå®ããŸããopenid ã¯å¿
é ã§ãä»ã«ã¯ OAuth2 ã®ã¢ã¯ã»ã¹ããŒã¯ã³ã䜿ã£ãŠååŸã§ãããŠãŒã¶ãŒå±æ§æ
å ±ãæå®ããŸãã scope ã§æå®ã§ãããŠãŒã¶ãŒå±æ§æ
å ±ã¯ä»¥äžã®ãšããã§ãã ïŒ å
¬åŒããåŒçš ïŒ ãŠãŒã¶ãŒã®èªèšŒã§ãã䜿ãããããªãæ°åãããã¡ãŒã«ã¢ãã¬ã¹ããªã©åºæ¬çãªå±æ§æ
å ±ãå®çŸ©ãããŠããŸãã state 㯠CSRF 察çãªã©ã®ããã®ã©ã³ãã å€ã§ããèªèšŒãããŒãéå§ãããã³ã« Web ãµãŒãã¹ ãçºè¡ãããªã¯ãšã¹ããšã³ãŒã«ããã¯ã®éã§å€ãç¶æãããŸãã ä»ã«ãããã€ãã®ãã©ã¡ãŒã¿ïŒnonce ãªã©ïŒãå®çŸ©ãããŠãããå¿
èŠã«å¿ããŠå©çšããŸãã Step.2: ãŠãŒã¶ãŒèªèšŒãšèªèšŒã³ãŒãã®çºè¡ èªèšŒãµãŒãã¹ ã§ã¯èªèšŒææ®µã«å¿ããŠãã°ã€ã³ ID ã»ãã¹ã¯ãŒãã®å
¥åãã©ãŒã ãªã©ã衚瀺ãã ãŠãŒã¶ãŒ ããèªèšŒæ
å ±ãååŸããŠèªèšŒåŠçãè¡ããŸãã èªèšŒãµãŒãã¹ ã¯ãŠãŒã¶ãŒã®èªèšŒã«æåãããšãèªèšŒã³ãŒããçºè¡ãã ãŠãŒã¶ãŒ ã Web ãµãŒãã¹ ã«ãªãã€ã¬ã¯ããããŸãã HTTP / 1.1 302 Found Location: https://client.example.org/cb? code=SplxlOBeZQQYbYS6WxSbIA & state = af0ifjsldkj ãªãã€ã¬ã¯ãå
ã«ã€ããŠã èªèšŒãµãŒã㹠㯠Step.1 ã§åãåã£ã redirect url ã èªèšŒãµãŒãã¹ ã«äºãç»é²ãããŠãã URL ãšåèŽããããšãæ€èšŒããå¿
èŠããããŸãã_Web ãµãŒãã¹ ã®ãªãããŸããé²ãããã§ãã ãŸã Web ãµãŒãã¹ åŽã§ èªèšŒãµãŒãã¹ ããã®ã¬ã¹ãã³ã¹ã§ããããšã確èªã§ãããããstate ããã©ã¡ãŒã¿ã«å«ããŸãã ãªããèªèšŒã«å€±æããå Žåã¯äžèšã®ããã«èªèšŒãšã©ãŒããå
容ããã©ã¡ãŒã¿ãŒã«å ã㊠Web ãµãŒãã¹ã«ãªãã€ã¬ã¯ããããŸãã HTTP / 1.1 302 Found Location: https://client.example.org/cb? error=invalid_request & error_description = Unsupported%20response_type%20value & state = af0ifjsldkj Step.3: èªèšŒçµæã®ååŸ Step.2 ã§ Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ããã®ãªãã€ã¬ã¯ããåããèªèšŒã³ãŒããååŸãããšããã®èªèšŒã³ãŒããå©çšã㊠èªèšŒãµãŒãã¹ ã«å¯ŸããŠèªèšŒçµææ
å ±ïŒID ããŒã¯ã³ãªã©ïŒãååŸããŸãã Web ãµãŒãã¹ ãã èªèšŒãµãŒãã¹ ãžã®èªèšŒçµæååŸãªã¯ãšã¹ãã¯ä»¥äžã®ãããªåœ¢åŒã«ãªããŸãã POST /token HTTP / 1.1 Host: server.example.com Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW Content-Type: application/x-www-form-urlencoded grant_type=authorization_code&code=SplxlOBeZQQYbYS6WxSbIA & redirect_uri = https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb èªèšŒã³ãŒããéä¿¡ããå¿
èŠããããããPOST ã¡ãœããã§ãªã¯ãšã¹ãããŸãããŸãã¯ã©ã€ã¢ã³ã ID ãšã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ããã«ãã BASIC èªèšŒãè¡ããŸãã ãã®ãªã¯ãšã¹ãã§ã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå¿
èŠã«ãªãã®ã§ããããã㯠èªèšŒãµãŒãã¹ ã«ãšã£ãŠ Web ãµãŒãã¹ ã®æ£åœæ§ãæ€èšŒããããã®éèŠãªãã©ã¡ãŒã¿ã§ãããå®å
šã«ç®¡çãããå¿
èŠããããŸãã SinglePageApplication ã®ããã«ãŠãŒã¶ãŒåŽã«ããã¢ããªã±ãŒã·ã§ã³ã§ OIDC ãåŠçããå Žåã«ã¯ããã®ã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå®å
šã«ç®¡çãããä¿èšŒããªããããAuthenticationCodeFlow ã§ã¯ãªã ImplicitFlow ãªã©ãå©çšããå¿
èŠããããŸãã Web ãµãŒãã¹ ããã®ãªã¯ãšã¹ããåãåã£ã èªèšŒãµãŒã㹠㯠grant_type ã« Step.1 ã§æå®ããåŠçãããŒã«è©²åœããæ
å ±ãæž¡ããèªèšŒã³ãŒãïŒ code ïŒãšåãã㊠èªèšŒãµãŒãã¹ ã«ãªã¯ãšã¹ãã®æ€èšŒããããŸãã èªèšŒãµãŒãã¹ ã¯ãªã¯ãšã¹ãã®æ€èšŒã«æåãããšã Web ãµãŒãã¹ ã«å¯ŸãèªèšŒçµæãšã㊠ID ããŒã¯ã³çãè¿åŽããŸãã HTTP / 1.1 200 OK Content-Type: application/json Cache-Control: no-cache, no-store Pragma: no-cache { "access_token" : "SlAV32hkKG" , "token_type" : "Bearer" , "expires_in" : 3600 , "refresh_token" : "tGzv3JOkF0XG5Qx2TlKWIA" , "id_token" : "eyJ0 ... NiJ9.eyJ1c ... I6IjIifX0.DeWt4Qu ... ZXso" } access_token 㯠èªèšŒãµãŒãã¹ ã§ç®¡çããŠãããŠãŒã¶ãŒå±æ§æ
å ±ãååŸããããã® OAuth2 ããŒã¯ã³ã§ãã refresh_token 㯠èªèšŒãµãŒãã¹ ãã access_token ãåçºè¡ããéã«å©çšããŸãã Step.4: èªèšŒçµæã®æ€èšŒ Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹*ããååŸãã ID ããŒã¯ã³ãæ€èšŒããŸããID ããŒã¯ã³ã¯åè¿°ã®éã JWT ã§è¡šçŸãããŠããã*èªèšŒãµãŒãã¹_ã®å
¬ééµãçšããŠæ€èšŒããããšãã§ããŸãã æé 㯠ãã¡ã ãã確èªãã ãããä»ã«ãåèãªã³ã¯ã玹ä»ããŠãããŸãã https://qiita.com/bobunderson/items/d48f89e2b3e6ad9f9c4c https://qiita.com/TakahikoKawasaki/items/8f0e422c7edd2d220e06 äžèšã¯ ID ããŒã¯ã³ã«å«ãŸããèªèšŒæ
å ±ã®äŸã§ãã { "iss" : "https://server.example.com" , "sub" : "24400320" , "aud" : "s6BhdRkqt3" , "exp" : 1311281970 , "iat" : 1311280970 } ãã®ãã¡ sub ã èªèšŒãµãŒãã¹ ã§ç®¡çãããŠãã ãŠãŒã¶ãŒ ã®èå¥åã§ãã iss 㯠èªèšŒãµãŒãã¹ ãaud 㯠Web ãµãŒãã¹ ã®ã¯ã©ã€ã¢ã³ã ID ã«ãªããŸãã expãiat ã¯ããããèªèšŒã®æå¹æéãšèªèšŒããã¿ã€ã ã¹ã¿ã³ãã§ãã Web ãµãŒã㹠㯠ID ããŒã¯ã³ãæ£ããå
容ã§ããããšã確èªã§ããã°ãããããã°ã€ã³ã»ãã·ã§ã³ãšçŽã¥ããŠä¿ç®¡ããŸãã 以äžã§èªèšŒåŠçã¯å®äºã§ãã ãŠãŒã¶ãŒå±æ§æ
å ±ã®ååŸ ãŠãŒã¶ãŒèªèšŒåŸã Web ãµãŒãã¹ ããŠãŒã¶ãŒåãªã©ã®ãŠãŒã¶ãŒå±æ§æ
å ±ãå¿
èŠã«ãªã£ãå ŽåãStep.3 ã§ååŸãã access_token ãå©çšã èªèšŒãµãŒãã¹ ã«å¯ŸããŠãŠãŒã¶ãŒå±æ§æ
å ±ããªã¯ãšã¹ãããŸãã GET /userinfo HTTP / 1.1 Host: server.example.com Authorization: Bearer SlAV32hkKG ãã®ãªã¯ãšã¹ãã«ãããStep.1 ã® scope ã§æå®ãããŠãŒã¶ãŒå±æ§æ
å ±ãååŸã§ããŸãã ãŸãšã 以äžå°ãé·ããªããŸãããããŠãŒã¶ãŒèªèšŒãš OpenID Connectãç¹ã«åºæ¬ã® AuthenticationCodeFlow ã«ã€ããŠè§£èª¬ããŸãããéãããçºè¡šæéã®äžã§ã®è§£èª¬ã®ããå³å¯ãããé°å²æ°ãéèŠããå
容ãšãªããŸãããããæ°ã¥ãã®ç¹ãªã©ããã°ãç¥ããããã ããã°ãšæããŸãã ãµãŒãã¹ã®èŠä»¶ããã§ãŒãºã«ãã£ãŠ OIDC ãåãå
¥ãããã©ããã¯æ§ã
ã§ããããŠãŒã¶ãŒèªèšŒã®å®è£
ãèªåã§å®è£
ãã¡ã³ããã³ã¹ããŠããã ãã§ãªããAmazon Cognito ãªã©ã®äŸ¿å©ãªèªèšŒãµãŒãã¹ãå©çšããŠããããšãéžæè¢ã®äžã€ãšããŠæ€èšããŠã¿ãŠãè¯ããããããŸããã ãããŠããã䟿å©ãªèªèšŒãµãŒãã¹ãããŸã䜿ãããªãããã«ãããã®èæ¯ã«ãã OIDC ã®ä»æ§ãææ³ãããããèªèšŒã®ä»çµã¿ã«ã€ããŠç«ã¡è¿ã£ãŠã¿ããšãçè§£ãäžæ®µãšæ·±ãŸãããšããããŸãã www.medley.jp www.medley.jp
ããã«ã¡ã¯ãéçºæ¬éšã®ãšã³ãžãã¢ã®é¶Žã§ãã ä»åã¯å
æã«è¡ã£ã瀟å
ã®ååŒ·äŒ TechLunch ã®å
容ãã玹ä»ãããŠããã ããŸãã ã€ã³ãã Web ãµãŒãã¹ã§ã¯ããŠãŒã¶ãŒã«ã¢ã«ãŠã³ããäœã£ãŠãããããã°ã€ã³ãããŠãµãŒãã¹ãå©çšããŠãããããšãããŠãŒã¶ãŒèªèšŒãå©çšãããµãŒãã¹ãå€ãããšæããŸãã Web ãµãŒãã¹ãéçºããåŽãšããŠã¯ããµãŒãã¹ããšã«éœåºŠãŠãŒã¶ãŒèªèšŒã®ä»çµã¿ãæ§ç¯ããå¿
èŠããããŸãããã»ãã¥ãªãã£å¯Ÿçã®èгç¹ããèæ
®ããããšãå€ããå°å³ã«éçºã®å·¥æ°ãããã£ãŠããŸããŸãã ãŸãæè¿ã§ã¯ã Amazon Cognito ã Firebase Authentication ã Auth0 ãªã©ããŠãŒã¶ãŒèªèšŒãµãŒãã¹ãããã€ããªãªãŒã¹ããããŠãŒã¶ãŒèªèšŒã®æ©èœããããã®å€éšãµãŒãã¹ã«ä»»ããŠéçºã®æéãçããšããéžæè¢ãåããããã«ãªã£ãŠããŠããŸãã èªåèªèº«ããã€ãŠæ
åœãããããžã§ã¯ãã§ãŠãŒã¶ãŒèªèšŒã®ä»çµã¿ã Amazon Cognito ã«ãŸãããŠã·ã¹ãã ãæ§ç¯ããããšããããŸããã ããããåœæã¯ç¹ã«ãŠãŒã¶ãŒããŒã«ã®æ©èœããªãªãŒã¹ãããŠéããªãããšããããSDK ã®åäœããµãŒãã¹ã®ä»æ§ã®çè§£ã«ããªãæéåã£ãããšãèŠããŠããŸãã ãŠãŒã¶ãŒèªèšŒãµãŒãã¹ã§ã¯ OpenID Connect ãšãã仿§ã«æºæ ããŠããããšãå€ãã®ã§ãããããããèªåã«ãšã£ãŠãã®ä»æ§ã®çè§£ãçãã ã£ãããšãåå ã®äžã€ã ã£ããšæããŸãã ããã§ä»åã¯ããŠãŒã¶ãŒèªèšŒãš OpenID Connect ã®ä»çµã¿ã«ã€ããŠæ¹ããŠå匷ãçŽããã®ã§ããã®å
容ãç°¡åã«è§£èª¬ããããŠããã ãããšæããŸãã ãŠãŒã¶ãŒèªèšŒãšã¯ ãŠãŒã¶ãŒèªèšŒã®åã«ãããããèªèšŒãšã¯ã©ãããæäœã®ããšãæãã®ã§ããããã ã¿ããªå€§å¥œã Wikipedia å
ç ã«ãããšã以äžã®ãããªèšèŒããããŸãã èªèšŒïŒã«ããããïŒãšã¯ãäœãã«ãã£ãŠãå¯Ÿè±¡ã®æ£åœæ§ã確èªããè¡çºãæãã èªèšŒè¡çºã¯èªèšŒå¯Ÿè±¡ãã£ãŠåé¡ãããèªèšŒå¯Ÿè±¡ã人éã§ããå Žåã«ã¯çžæèªèšŒïŒæ¬äººèªèšŒïŒãã¡ãã»ãŒãžã§ããå Žåã«ã¯ã¡ãã»ãŒãžèªèšŒãæå»ã®å Žåã«ã¯æå»èªèšŒãšåŒã¶ã åã«èªèšŒãšèšã£ãå Žåã«ã¯çžæèªèšŒãæãå Žåãå€ãã ãŠãŒã¶ãŒèªèšŒã¯ Web ãµãŒãã¹ã«ãšã£ãŠãªã¯ãšã¹ããéä¿¡ããŠããçžæã®æ£åœæ§ãèªèšŒããããšãªã®ã§ãçžæèªèšŒã® 1 ã€ã§ããã ããã«çžæèªèšŒã®èªèšŒæ¹æ³ãšã㊠2 éãã®æ¹æ³ããããŸãã 第 1 ã®æ¹æ³ã¯ã被èªèšŒè
ãèªèšŒè
ã«ãç§å¯éµããã£ãŠããããšã«ãã£ãŠåŸãããäœããã®èœåã®èšŒæãè¡ãæ¹æ³ã§ããã第 2 ã®æ¹æ³ã¯ã被èªèšŒè
ãèªèšŒè
ã«ã被èªèšŒè
ã®å
¬ééµã«å¯Ÿå¿ããç§å¯éµã®ç¥èã®èšŒæãè¡ãæ¹æ³ã§ããã ãŠãŒã¶ãŒèªèšŒã®å Žåãå€ãã¯ãã®ç¬¬ 1 ã®æ¹æ³ã§ã®èªèšŒã§ããã°ã€ã³æã«ãŠãŒã¶ãŒ ID ã«å ããŠããã®ãç§å¯éµããšããŠã¢ã«ãŠã³ãäœææã«ç»é²ããŠããããã¹ã¯ãŒããå
¥åããããšã§ãŠãŒã¶ãŒèªèšŒãè¡ã£ãŠããããšæããŸãã Web ãµãŒãã¹ã§ã®ãŠãŒã¶ãŒèªèšŒ Web ãµãŒãã¹ã§æ±ãæ
å ±ã®ç§å¿æ§ãé«ããªãã°ãªãã»ã©ããã®ãç§å¯éµããæ¬åœã«ãã®ãŠãŒã¶ãŒã«ããæäŸã§ããªãæ
å ±ã§ããããšãæ±ããããŸãã äžè¿°ã®ãããªãã¹ã¯ãŒãã«ããèªèšŒã®å Žåããã¹ã¯ãŒããæšæž¬ããããªã©ããŠæªæã®ãã第äžè
ã«ã¢ã«ãŠã³ããä¹ã£åãããŠããŸãäºä»¶ã¯ããè³ã«ããŸãã ããã»ãã¥ãªãã£ãé«ããããããã¹ã¯ãŒã以å€ã®èªèšŒãå€èŠçŽ èªèšŒãªã©ãçšããäºãå¢ããŠããŸããã ãŸããã»ãã¥ãªãã£ã®èгç¹ã ãã§ãªãå©äŸ¿æ§ã®èгç¹ãããããã¹ã¯ãŒãå
¥åã®ä»£ããã«æçŽèªèšŒãé¡èªèšŒã«ãããã°ã€ã³ãããããã¯åçš® SNS ã¢ã«ãŠã³ãã«ãããã°ã€ã³ãå¢ããŠããŠããŸããèªç€Ÿã®è€æ°ã®ãµãŒãã¹ã飿ºã§ãããããŠãŒã¶ãŒã«å
±é ID ãæäŸãããããšãã£ãã±ãŒã¹ããããããããŸããã æè¿ã§ã¯ãã¹ã¯ãŒãã¬ã¹èªèšŒã WebAuthn ãæ³šç®ãããŠããŸãããä»åã¯ç޹ä»ã¯å²æããŸããããã¹ã¯ãŒãã¬ã¹èªèšŒã®äžã€ã§ãã FIDO èªèšŒ ã¯ãåè¿°ã®ã被èªèšŒè
ãèªèšŒè
ã«ã被èªèšŒè
ã®å
¬ééµã«å¯Ÿå¿ããç§å¯éµã®ç¥èã®èšŒæãè¡ãæ¹æ³ããå©çšããèªèšŒæ¹åŒã®ããã§ããïŒ ref1 , ref2 ïŒ ãã®ããã«ãã»ãã¥ãªãã£ã®èгç¹ããŠãŒã¶ãŒå©äŸ¿æ§ã®èгç¹ãªã©ã«ãããWeb ãµãŒãã¹ã«ããããŠãŒã¶ãŒèªèšŒæ©èœã¯ 1 åäœã£ããçµããã§ã¯ãªããææµã«å¿ããŠé©å®æ¹ä¿®ããå¿
èŠãåºãŠããããšãããããšæããŸãã ããããç¹ã«ãŠãŒã¶ãŒèªèšŒãã¡ã€ã³ã®ãµãŒãã¹ãšå¯çµåããŠããå Žåãªã©ã§ã¯ãèªèšŒã®ååŸãªã©èªèšŒåŠçãã®ãã®ã ãã§ãªããã®åšèŸºã®åŠçãžã®åœ±é¿ç¯å²ãç¡èŠã§ããªãå ŽåãããããŠãŒã¶ãŒèªèšŒã®æ¹ä¿®ã«å·¥æ°ãæã£ãããããã£ãŠããŸã£ããã察å¿ãæ»ã£ãŠããŸãããšããããããããŸããã ãããªãšããèªèšŒãµãŒãã¹ãã¡ã€ã³ã®ãµãŒãã¹ãšåãé¢ãããšã§ããæè»ãªãŠãŒã¶ãŒèªèšŒææ®µãæäŸã§ãããããOpenID Connect ã®å°å
¥ãæ€èšããŠã¿ãŠãè¯ããããããŸããã OpenID Connect ãšã¯ OpenID Connect(以éãOIDC)ã«ã€ããŠãæ¬å®¶ãµã€ãã§ã¯ä»¥äžã®ããã«èª¬æãããŠããŸãã OpenID Connect 1.0 ã¯, OAuth 2.0 ãããã³ã«ã®äžã«ã·ã³ãã«ãªã¢ã€ãã³ãã£ãã£ã¬ã€ã€ãŒãä»äžãããã®ã§ãã. ãã®ãããã³ã«ã¯ Client ã Authorization Server ã®èªèšŒçµæã«åºã¥ã㊠End-User ã®ã¢ã€ãã³ãã£ãã£ãæ€èšŒå¯èœã«ãã. ãŸãåæã« End-User ã®å¿
èŠæäœéã®ãããã£ãŒã«æ
å ±ã, çžäºéçšå¯èœã〠RESTful ãªåœ¢ã§ååŸããããšãå¯èœã«ãã. ãã®ä»æ§ã¯, OpenID Connect ã®äž»èŠãªæ©èœã§ãã OAuth 2.0 äžã§ End-User ã®æ
å ±äŒéã®ããã«ã¯ã¬ãŒã ãçšããèªèšŒæ©èœãå®çŸ©ãã. ãã®ä»æ§ã¯ãŸã, OpenID Connect ãå©çšããããã® Security, Privacy Considerations ã説æãã. ïŒ æ¥æ¬èª , è±èª ïŒ å人çã«ã¯ãã¡ã€ã³ã®ãµãŒãã¹ãšèªèšŒãµãŒãã¹ãåãé¢ããŠéçšããããšãæ³å®ããŠä»æ§ãèŠå®ãããŠããç¹ãéèŠãšèããŸãã OIDC ãå©çšããããšã§ããŠãŒã¶ãŒèªèšŒãããæè»ã«æ¹ä¿®ãããæ°ããèªèšŒæ¹æ³ã«å¯Ÿå¿ãããããããšããããããªãããšãæåŸ
ãããããã§ãã ãªããOIDC ã®ä»æ§ã«ã¯èªèšŒææ®µèªäœïŒãã¹ã¯ãŒãèªèšŒãå€èŠçŽ èªèšŒãªã©ïŒã«é¢ããŠã¯èŠå®ãããŠãããããããŸã§èªèšŒãµãŒãã¹ã«ããèªèšŒçµæã®ååŸæ¹æ³ãæ±ãæ¹ã«ã€ããŠãèŠå®ãããŠããŸãã ãŸããæ§ã
ãªãŠãŒã¹ã±ãŒã¹ã«å¯Ÿå¿ã§ããããããã€ãã®åŠçãããŒããªãã·ã§ãã«ãªèšå®ãæäŸãããŠããŸããããã®åé¢ã»ãã¥ãªãã£ã®ç¢ºä¿ã¯å®è£
è
ã«å§ããããŠããããŠãŒã¹ã±ãŒã¹ã«å¿ããŠé©åãªå®è£
ãè¡ãå¿
èŠããããŸãã åè¿°ãããŠãŒã¶ãŒèªèšŒãµãŒãã¹ã§ãã Amazon Cognito ã FirebaseAuthentication ãªã©ã¯ãèªèšŒææ®µãæšæºã§ããã€ãæäŸãããŠãããå ããŠããã¯ãšã³ããš SDK ã« OIDC åºæã®ã»ãã¥ã¢ãªå®è£
ãæœãããŠãããããéçºè
ã¯æå°éã®èšå®ã ãã§ãŠãŒã¶ãŒèªèšŒæ©èœãå©çšã§ããããã«ãªããŸãã䟿å©ã§ããã åŠçãããŒã®è§£èª¬ ããŠãOIDC ã®å
·äœçãªåŠçã«ã€ããŠè§£èª¬ããŠããããšæããŸãã ãŸãç»å Žäººç©ã§ãã OpenID ProviderïŒOPïŒïŒèªèšŒèªå¯ãè¡ããµãŒãã¹ããŠãŒã¶ãŒèªèšŒæ
å ±ïŒèå¥åããã¹ã¯ãŒããªã©ïŒã管çããããèªèšŒã«é¢ãããŠãŒã¶ãŒå±æ§æ
å ±ïŒæ°åããŠãŒã¶ãŒåãªã©ïŒãä¿æããã RelyingPartyïŒRPïŒïŒ ã¢ã¯ã»ã¹å
ã®ãŠãŒã¶ãŒã®èªèšŒãšãŠãŒã¶ãŒå±æ§æ
å ±ãèŠæ±ãããµãŒãã¹ããŠãŒã¶ãŒããã®ãªã¯ãšã¹ãã«å¯Ÿã OP ã«ããèªèšŒçµæãä¿¡é ŒïŒrelyïŒããŠãªãœãŒã¹ãžã®ã¢ã¯ã»ã¹ãèš±å¯ããïŒäŸãã°ãã€ããŒãžã衚瀺ãããªã©ïŒã EndUserïŒãã°ã€ã³ãããŠãµãŒãã¹ãå©çšããããšããŠãããŠãŒã¶ãŒã åºæ¬çãªçšèªãå
ã«ç°¡åã«ç޹ä»ããŠãããŸãã ã¯ã©ã€ã¢ã³ã IDïŒOpenID Provider ã§ç®¡çãããRelyingParty ã®è奿
å ±ã ã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ããïŒOpenID Provider ã RelyingParty ããšã«çºè¡ããç§å¯éµã èªèšŒã³ãŒãïŒåŸè¿°ãã AuthorizationCodeFlow ã§ OpenID Provider ãçºè¡ããçåœã®ãã¹ã¯ãŒãã®ãããªãã®ã ID ããŒã¯ã³ïŒOpenID Provider ããçºè¡ãããããŠãŒã¶ãŒã«ããèªèšŒãè¡ã£ã蚌ææ
å ±ã JSON Web Token(JWT) ã§è¡šçŸãããæ€èšŒã«ããæ¹ããæ€ç¥ããããšãã§ãããèªèšŒã®å
容ïŒOpenID ProviderããŠãŒã¶ãŒèå¥åãRelyingParty ã®ã¯ã©ã€ã¢ã³ã IDãæå¹æéãªã©ïŒããŠãŒã¶ãŒå±æ§æ
å ±ãæ ŒçŽãããã ã¢ã¯ã»ã¹ããŒã¯ã³:OpenID Provider ãä¿æãããŠãŒã¶ãŒå±æ§æ
å ±ã«å¯Ÿãã¢ã¯ã»ã¹ããããã® OAuth2 ã®èªå¯ããŒã¯ã³ã OIDC ã®åŠçãããŒã¯å€§ããåã㊠3 çš®é¡ãèŠå®ãããŠããŸãã AuthorizationCodeFlowïŒèªèšŒæåæã« OpenID Provider ã RelyingParty ã«å¯ŸãèªèšŒã³ãŒããçºè¡ããRelyingParty ã¯ãããçšã㊠OpenID Provider ãã ID ããŒã¯ã³çãååŸãããRelyingParty ããµãŒããŒãµã€ãã¢ããªã±ãŒã·ã§ã³ã§ãOpenID Provider ããçºè¡ãããã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå®å
šã«ç®¡çããããšãã§ããå Žåãªã©ã«çšããããã ImplicitFlowïŒèªèšŒã³ãŒãã䜿ããèªèšŒçµæã®ã¬ã¹ãã³ã¹ã§ ID ããŒã¯ã³çãååŸãããRelyingParty ãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã®å Žåãªã©ãã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå®å
šã«ç®¡çã§ããªãå Žåãªã©ã«çšããããã HybridFlowïŒAuthorizationCodeFlow ãš ImplicitFlow ã®çµã¿åããã ãããã®ãããŒã®éãã¯ä»¥äžã®è¡šã®ãšããã§ãã ïŒ å
¬åŒããåŒçš ïŒ ä»åã¯ã å
¬åŒ ã ãã¡ãã®è§£èª¬èšäº ãªã©ãåç
§ããªãããåºæ¬ã®åŠçãããŒã§ãã AuthorizationCodeFlow ã«ã€ããŠè§£èª¬ããŸãã ç°¡ç¥åã®ãããã€ã¡ãŒãžéèŠã§ç»å Žäººç©ã¯ã ãŠãŒã¶ãŒ ããïŒãŠãŒã¶ãŒã«ãµãŒãã¹ãæäŸããïŒ Web ãµãŒãã¹ ãã èªèšŒãµãŒãã¹ ããšè¡šçŸããããšã«ããŸãã 倧ãŸãã«ã¯ä»¥äžã®ã¹ãããã§åŠçãè¡ãããŸãã ãŠãŒã¶ãŒ ããã®ã¢ã¯ã»ã¹ã«å¯Ÿãã Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ã«ãŠãŒã¶ãŒèªèšŒãèŠæ±ãã èªèšŒãµãŒãã¹ ã¯ãŠãŒã¶ãŒèªèšŒãè¡ããèªèšŒã³ãŒããçºè¡ããŠã ãŠãŒã¶ãŒ ã Web ãµãŒãã¹ ã«ãªãã€ã¬ã¯ãããã Web ãµãŒã㹠㯠2 ã§ååŸããèªèšŒã³ãŒããçšã㊠èªèšŒãµãŒãã¹ ã« ID ããŒã¯ã³çããªã¯ãšã¹ããã Web ãµãŒã㹠㯠3 ã§ååŸãã ID ããŒã¯ã³ãæ€èšŒãã ãŠãŒã¶ãŒ ã®èå¥åãååŸãã Step.0 : äºåæºå ããããã Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ããã¯ã©ã€ã¢ã³ã ID ãšã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããååŸãä¿æããŠãããŸãã Step.1: ãŠãŒã¶ãŒèªèšŒã®èŠæ± ãŠãŒã¶ãŒ ã Web ãµãŒãã¹ ã«å¯Ÿãäžè¬çãªãã°ã€ã³ã®æµãã§ãã°ã€ã³ãèŠæ±ãããšã Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ã«ãªã¯ãšã¹ãããªãã€ã¬ã¯ãããŸãã Web ãµãŒãã¹ ãã èªèšŒãµãŒãã¹ ãžã®ãªãã€ã¬ã¯ãã® URL ã¯ä»¥äžã®ãããªæãã§ãã HTTP / 1.1 302 Found Location: https://server.example.com/authorize? response_type=code & client_id = s6BhdRkqt3 & redirect_uri = https%3A%2F%2Fclient.example.org%2Fcb & scope = openid%20profile & state = af0ifjsldkj response_type ã§ OIDC ã®ã©ã®èªèšŒãããŒã䜿ãããæå®ããŸãã redirect_uri ã¯ã èªèšŒãµãŒãã¹ ã§ã®èªèšŒãæåãããšãã® Web ãµãŒãã¹ ã«ã³ãŒã«ããã¯ãã URL ã§ããããã¯äºåã«èªèšŒãµãŒãã¹ã«ç»é²ããŠããå¿
èŠããããŸãã scope ã«ã¯èªèšŒã®å
容ãèšå®ããŸããopenid ã¯å¿
é ã§ãä»ã«ã¯ OAuth2 ã®ã¢ã¯ã»ã¹ããŒã¯ã³ã䜿ã£ãŠååŸã§ãããŠãŒã¶ãŒå±æ§æ
å ±ãæå®ããŸãã scope ã§æå®ã§ãããŠãŒã¶ãŒå±æ§æ
å ±ã¯ä»¥äžã®ãšããã§ãã ïŒ å
¬åŒããåŒçš ïŒ ãŠãŒã¶ãŒã®èªèšŒã§ãã䜿ãããããªãæ°åãããã¡ãŒã«ã¢ãã¬ã¹ããªã©åºæ¬çãªå±æ§æ
å ±ãå®çŸ©ãããŠããŸãã state 㯠CSRF 察çãªã©ã®ããã®ã©ã³ãã å€ã§ããèªèšŒãããŒãéå§ãããã³ã« Web ãµãŒãã¹ ãçºè¡ãããªã¯ãšã¹ããšã³ãŒã«ããã¯ã®éã§å€ãç¶æãããŸãã ä»ã«ãããã€ãã®ãã©ã¡ãŒã¿ïŒnonce ãªã©ïŒãå®çŸ©ãããŠãããå¿
èŠã«å¿ããŠå©çšããŸãã Step.2: ãŠãŒã¶ãŒèªèšŒãšèªèšŒã³ãŒãã®çºè¡ èªèšŒãµãŒãã¹ ã§ã¯èªèšŒææ®µã«å¿ããŠãã°ã€ã³ ID ã»ãã¹ã¯ãŒãã®å
¥åãã©ãŒã ãªã©ã衚瀺ãã ãŠãŒã¶ãŒ ããèªèšŒæ
å ±ãååŸããŠèªèšŒåŠçãè¡ããŸãã èªèšŒãµãŒãã¹ ã¯ãŠãŒã¶ãŒã®èªèšŒã«æåãããšãèªèšŒã³ãŒããçºè¡ãã ãŠãŒã¶ãŒ ã Web ãµãŒãã¹ ã«ãªãã€ã¬ã¯ããããŸãã HTTP / 1.1 302 Found Location: https://client.example.org/cb? code=SplxlOBeZQQYbYS6WxSbIA & state = af0ifjsldkj ãªãã€ã¬ã¯ãå
ã«ã€ããŠã èªèšŒãµãŒã㹠㯠Step.1 ã§åãåã£ã redirect url ã èªèšŒãµãŒãã¹ ã«äºãç»é²ãããŠãã URL ãšåèŽããããšãæ€èšŒããå¿
èŠããããŸãã_Web ãµãŒãã¹ ã®ãªãããŸããé²ãããã§ãã ãŸã Web ãµãŒãã¹ åŽã§ èªèšŒãµãŒãã¹ ããã®ã¬ã¹ãã³ã¹ã§ããããšã確èªã§ãããããstate ããã©ã¡ãŒã¿ã«å«ããŸãã ãªããèªèšŒã«å€±æããå Žåã¯äžèšã®ããã«èªèšŒãšã©ãŒããå
容ããã©ã¡ãŒã¿ãŒã«å ã㊠Web ãµãŒãã¹ã«ãªãã€ã¬ã¯ããããŸãã HTTP / 1.1 302 Found Location: https://client.example.org/cb? error=invalid_request & error_description = Unsupported%20response_type%20value & state = af0ifjsldkj Step.3: èªèšŒçµæã®ååŸ Step.2 ã§ Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ããã®ãªãã€ã¬ã¯ããåããèªèšŒã³ãŒããååŸãããšããã®èªèšŒã³ãŒããå©çšã㊠èªèšŒãµãŒãã¹ ã«å¯ŸããŠèªèšŒçµææ
å ±ïŒID ããŒã¯ã³ãªã©ïŒãååŸããŸãã Web ãµãŒãã¹ ãã èªèšŒãµãŒãã¹ ãžã®èªèšŒçµæååŸãªã¯ãšã¹ãã¯ä»¥äžã®ãããªåœ¢åŒã«ãªããŸãã POST /token HTTP / 1.1 Host: server.example.com Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW Content-Type: application/x-www-form-urlencoded grant_type=authorization_code&code=SplxlOBeZQQYbYS6WxSbIA & redirect_uri = https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb èªèšŒã³ãŒããéä¿¡ããå¿
èŠããããããPOST ã¡ãœããã§ãªã¯ãšã¹ãããŸãããŸãã¯ã©ã€ã¢ã³ã ID ãšã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ããã«ãã BASIC èªèšŒãè¡ããŸãã ãã®ãªã¯ãšã¹ãã§ã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå¿
èŠã«ãªãã®ã§ããããã㯠èªèšŒãµãŒãã¹ ã«ãšã£ãŠ Web ãµãŒãã¹ ã®æ£åœæ§ãæ€èšŒããããã®éèŠãªãã©ã¡ãŒã¿ã§ãããå®å
šã«ç®¡çãããå¿
èŠããããŸãã SinglePageApplication ã®ããã«ãŠãŒã¶ãŒåŽã«ããã¢ããªã±ãŒã·ã§ã³ã§ OIDC ãåŠçããå Žåã«ã¯ããã®ã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå®å
šã«ç®¡çãããä¿èšŒããªããããAuthenticationCodeFlow ã§ã¯ãªã ImplicitFlow ãªã©ãå©çšããå¿
èŠããããŸãã Web ãµãŒãã¹ ããã®ãªã¯ãšã¹ããåãåã£ã èªèšŒãµãŒã㹠㯠grant_type ã« Step.1 ã§æå®ããåŠçãããŒã«è©²åœããæ
å ±ãæž¡ããèªèšŒã³ãŒãïŒ code ïŒãšåãã㊠èªèšŒãµãŒãã¹ ã«ãªã¯ãšã¹ãã®æ€èšŒããããŸãã èªèšŒãµãŒãã¹ ã¯ãªã¯ãšã¹ãã®æ€èšŒã«æåãããšã Web ãµãŒãã¹ ã«å¯ŸãèªèšŒçµæãšã㊠ID ããŒã¯ã³çãè¿åŽããŸãã HTTP / 1.1 200 OK Content-Type: application/json Cache-Control: no-cache, no-store Pragma: no-cache { "access_token" : "SlAV32hkKG" , "token_type" : "Bearer" , "expires_in" : 3600 , "refresh_token" : "tGzv3JOkF0XG5Qx2TlKWIA" , "id_token" : "eyJ0 ... NiJ9.eyJ1c ... I6IjIifX0.DeWt4Qu ... ZXso" } access_token 㯠èªèšŒãµãŒãã¹ ã§ç®¡çããŠãããŠãŒã¶ãŒå±æ§æ
å ±ãååŸããããã® OAuth2 ããŒã¯ã³ã§ãã refresh_token 㯠èªèšŒãµãŒãã¹ ãã access_token ãåçºè¡ããéã«å©çšããŸãã Step.4: èªèšŒçµæã®æ€èšŒ Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹*ããååŸãã ID ããŒã¯ã³ãæ€èšŒããŸããID ããŒã¯ã³ã¯åè¿°ã®éã JWT ã§è¡šçŸãããŠããã*èªèšŒãµãŒãã¹_ã®å
¬ééµãçšããŠæ€èšŒããããšãã§ããŸãã æé 㯠ãã¡ã ãã確èªãã ãããä»ã«ãåèãªã³ã¯ã玹ä»ããŠãããŸãã https://qiita.com/bobunderson/items/d48f89e2b3e6ad9f9c4c https://qiita.com/TakahikoKawasaki/items/8f0e422c7edd2d220e06 äžèšã¯ ID ããŒã¯ã³ã«å«ãŸããèªèšŒæ
å ±ã®äŸã§ãã { "iss" : "https://server.example.com" , "sub" : "24400320" , "aud" : "s6BhdRkqt3" , "exp" : 1311281970 , "iat" : 1311280970 } ãã®ãã¡ sub ã èªèšŒãµãŒãã¹ ã§ç®¡çãããŠãã ãŠãŒã¶ãŒ ã®èå¥åã§ãã iss 㯠èªèšŒãµãŒãã¹ ãaud 㯠Web ãµãŒãã¹ ã®ã¯ã©ã€ã¢ã³ã ID ã«ãªããŸãã expãiat ã¯ããããèªèšŒã®æå¹æéãšèªèšŒããã¿ã€ã ã¹ã¿ã³ãã§ãã Web ãµãŒã㹠㯠ID ããŒã¯ã³ãæ£ããå
容ã§ããããšã確èªã§ããã°ãããããã°ã€ã³ã»ãã·ã§ã³ãšçŽã¥ããŠä¿ç®¡ããŸãã 以äžã§èªèšŒåŠçã¯å®äºã§ãã ãŠãŒã¶ãŒå±æ§æ
å ±ã®ååŸ ãŠãŒã¶ãŒèªèšŒåŸã Web ãµãŒãã¹ ããŠãŒã¶ãŒåãªã©ã®ãŠãŒã¶ãŒå±æ§æ
å ±ãå¿
èŠã«ãªã£ãå ŽåãStep.3 ã§ååŸãã access_token ãå©çšã èªèšŒãµãŒãã¹ ã«å¯ŸããŠãŠãŒã¶ãŒå±æ§æ
å ±ããªã¯ãšã¹ãããŸãã GET /userinfo HTTP / 1.1 Host: server.example.com Authorization: Bearer SlAV32hkKG ãã®ãªã¯ãšã¹ãã«ãããStep.1 ã® scope ã§æå®ãããŠãŒã¶ãŒå±æ§æ
å ±ãååŸã§ããŸãã ãŸãšã 以äžå°ãé·ããªããŸãããããŠãŒã¶ãŒèªèšŒãš OpenID Connectãç¹ã«åºæ¬ã® AuthenticationCodeFlow ã«ã€ããŠè§£èª¬ããŸãããéãããçºè¡šæéã®äžã§ã®è§£èª¬ã®ããå³å¯ãããé°å²æ°ãéèŠããå
容ãšãªããŸãããããæ°ã¥ãã®ç¹ãªã©ããã°ãç¥ããããã ããã°ãšæããŸãã ãµãŒãã¹ã®èŠä»¶ããã§ãŒãºã«ãã£ãŠ OIDC ãåãå
¥ãããã©ããã¯æ§ã
ã§ããããŠãŒã¶ãŒèªèšŒã®å®è£
ãèªåã§å®è£
ãã¡ã³ããã³ã¹ããŠããã ãã§ãªããAmazon Cognito ãªã©ã®äŸ¿å©ãªèªèšŒãµãŒãã¹ãå©çšããŠããããšãéžæè¢ã®äžã€ãšããŠæ€èšããŠã¿ãŠãè¯ããããããŸããã ãããŠããã䟿å©ãªèªèšŒãµãŒãã¹ãããŸã䜿ãããªãããã«ãããã®èæ¯ã«ãã OIDC ã®ä»æ§ãææ³ãããããèªèšŒã®ä»çµã¿ã«ã€ããŠç«ã¡è¿ã£ãŠã¿ããšãçè§£ãäžæ®µãšæ·±ãŸãããšããããŸãã www.medley.jp www.medley.jp
ããã«ã¡ã¯ãéçºæ¬éšã®ãšã³ãžãã¢ã®é¶Žã§ãã ä»åã¯å
æã«è¡ã£ã瀟å
ã®ååŒ·äŒ TechLunch ã®å
容ãã玹ä»ãããŠããã ããŸãã ã€ã³ãã Web ãµãŒãã¹ã§ã¯ããŠãŒã¶ãŒã«ã¢ã«ãŠã³ããäœã£ãŠãããããã°ã€ã³ãããŠãµãŒãã¹ãå©çšããŠãããããšãããŠãŒã¶ãŒèªèšŒãå©çšãããµãŒãã¹ãå€ãããšæããŸãã Web ãµãŒãã¹ãéçºããåŽãšããŠã¯ããµãŒãã¹ããšã«éœåºŠãŠãŒã¶ãŒèªèšŒã®ä»çµã¿ãæ§ç¯ããå¿
èŠããããŸãããã»ãã¥ãªãã£å¯Ÿçã®èгç¹ããèæ
®ããããšãå€ããå°å³ã«éçºã®å·¥æ°ãããã£ãŠããŸããŸãã ãŸãæè¿ã§ã¯ã Amazon Cognito ã Firebase Authentication ã Auth0 ãªã©ããŠãŒã¶ãŒèªèšŒãµãŒãã¹ãããã€ããªãªãŒã¹ããããŠãŒã¶ãŒèªèšŒã®æ©èœããããã®å€éšãµãŒãã¹ã«ä»»ããŠéçºã®æéãçããšããéžæè¢ãåããããã«ãªã£ãŠããŠããŸãã èªåèªèº«ããã€ãŠæ
åœãããããžã§ã¯ãã§ãŠãŒã¶ãŒèªèšŒã®ä»çµã¿ã Amazon Cognito ã«ãŸãããŠã·ã¹ãã ãæ§ç¯ããããšããããŸããã ããããåœæã¯ç¹ã«ãŠãŒã¶ãŒããŒã«ã®æ©èœããªãªãŒã¹ãããŠéããªãããšããããSDK ã®åäœããµãŒãã¹ã®ä»æ§ã®çè§£ã«ããªãæéåã£ãããšãèŠããŠããŸãã ãŠãŒã¶ãŒèªèšŒãµãŒãã¹ã§ã¯ OpenID Connect ãšãã仿§ã«æºæ ããŠããããšãå€ãã®ã§ãããããããèªåã«ãšã£ãŠãã®ä»æ§ã®çè§£ãçãã ã£ãããšãåå ã®äžã€ã ã£ããšæããŸãã ããã§ä»åã¯ããŠãŒã¶ãŒèªèšŒãš OpenID Connect ã®ä»çµã¿ã«ã€ããŠæ¹ããŠå匷ãçŽããã®ã§ããã®å
容ãç°¡åã«è§£èª¬ããããŠããã ãããšæããŸãã ãŠãŒã¶ãŒèªèšŒãšã¯ ãŠãŒã¶ãŒèªèšŒã®åã«ãããããèªèšŒãšã¯ã©ãããæäœã®ããšãæãã®ã§ããããã ã¿ããªå€§å¥œã Wikipedia å
ç ã«ãããšã以äžã®ãããªèšèŒããããŸãã èªèšŒïŒã«ããããïŒãšã¯ãäœãã«ãã£ãŠãå¯Ÿè±¡ã®æ£åœæ§ã確èªããè¡çºãæãã èªèšŒè¡çºã¯èªèšŒå¯Ÿè±¡ãã£ãŠåé¡ãããèªèšŒå¯Ÿè±¡ã人éã§ããå Žåã«ã¯çžæèªèšŒïŒæ¬äººèªèšŒïŒãã¡ãã»ãŒãžã§ããå Žåã«ã¯ã¡ãã»ãŒãžèªèšŒãæå»ã®å Žåã«ã¯æå»èªèšŒãšåŒã¶ã åã«èªèšŒãšèšã£ãå Žåã«ã¯çžæèªèšŒãæãå Žåãå€ãã ãŠãŒã¶ãŒèªèšŒã¯ Web ãµãŒãã¹ã«ãšã£ãŠãªã¯ãšã¹ããéä¿¡ããŠããçžæã®æ£åœæ§ãèªèšŒããããšãªã®ã§ãçžæèªèšŒã® 1 ã€ã§ããã ããã«çžæèªèšŒã®èªèšŒæ¹æ³ãšã㊠2 éãã®æ¹æ³ããããŸãã 第 1 ã®æ¹æ³ã¯ã被èªèšŒè
ãèªèšŒè
ã«ãç§å¯éµããã£ãŠããããšã«ãã£ãŠåŸãããäœããã®èœåã®èšŒæãè¡ãæ¹æ³ã§ããã第 2 ã®æ¹æ³ã¯ã被èªèšŒè
ãèªèšŒè
ã«ã被èªèšŒè
ã®å
¬ééµã«å¯Ÿå¿ããç§å¯éµã®ç¥èã®èšŒæãè¡ãæ¹æ³ã§ããã ãŠãŒã¶ãŒèªèšŒã®å Žåãå€ãã¯ãã®ç¬¬ 1 ã®æ¹æ³ã§ã®èªèšŒã§ããã°ã€ã³æã«ãŠãŒã¶ãŒ ID ã«å ããŠããã®ãç§å¯éµããšããŠã¢ã«ãŠã³ãäœææã«ç»é²ããŠããããã¹ã¯ãŒããå
¥åããããšã§ãŠãŒã¶ãŒèªèšŒãè¡ã£ãŠããããšæããŸãã Web ãµãŒãã¹ã§ã®ãŠãŒã¶ãŒèªèšŒ Web ãµãŒãã¹ã§æ±ãæ
å ±ã®ç§å¿æ§ãé«ããªãã°ãªãã»ã©ããã®ãç§å¯éµããæ¬åœã«ãã®ãŠãŒã¶ãŒã«ããæäŸã§ããªãæ
å ±ã§ããããšãæ±ããããŸãã äžè¿°ã®ãããªãã¹ã¯ãŒãã«ããèªèšŒã®å Žåããã¹ã¯ãŒããæšæž¬ããããªã©ããŠæªæã®ãã第äžè
ã«ã¢ã«ãŠã³ããä¹ã£åãããŠããŸãäºä»¶ã¯ããè³ã«ããŸãã ããã»ãã¥ãªãã£ãé«ããããããã¹ã¯ãŒã以å€ã®èªèšŒãå€èŠçŽ èªèšŒãªã©ãçšããäºãå¢ããŠããŸããã ãŸããã»ãã¥ãªãã£ã®èгç¹ã ãã§ãªãå©äŸ¿æ§ã®èгç¹ãããããã¹ã¯ãŒãå
¥åã®ä»£ããã«æçŽèªèšŒãé¡èªèšŒã«ãããã°ã€ã³ãããããã¯åçš® SNS ã¢ã«ãŠã³ãã«ãããã°ã€ã³ãå¢ããŠããŠããŸããèªç€Ÿã®è€æ°ã®ãµãŒãã¹ã飿ºã§ãããããŠãŒã¶ãŒã«å
±é ID ãæäŸãããããšãã£ãã±ãŒã¹ããããããããŸããã æè¿ã§ã¯ãã¹ã¯ãŒãã¬ã¹èªèšŒã WebAuthn ãæ³šç®ãããŠããŸãããä»åã¯ç޹ä»ã¯å²æããŸããããã¹ã¯ãŒãã¬ã¹èªèšŒã®äžã€ã§ãã FIDO èªèšŒ ã¯ãåè¿°ã®ã被èªèšŒè
ãèªèšŒè
ã«ã被èªèšŒè
ã®å
¬ééµã«å¯Ÿå¿ããç§å¯éµã®ç¥èã®èšŒæãè¡ãæ¹æ³ããå©çšããèªèšŒæ¹åŒã®ããã§ããïŒ ref1 , ref2 ïŒ ãã®ããã«ãã»ãã¥ãªãã£ã®èгç¹ããŠãŒã¶ãŒå©äŸ¿æ§ã®èгç¹ãªã©ã«ãããWeb ãµãŒãã¹ã«ããããŠãŒã¶ãŒèªèšŒæ©èœã¯ 1 åäœã£ããçµããã§ã¯ãªããææµã«å¿ããŠé©å®æ¹ä¿®ããå¿
èŠãåºãŠããããšãããããšæããŸãã ããããç¹ã«ãŠãŒã¶ãŒèªèšŒãã¡ã€ã³ã®ãµãŒãã¹ãšå¯çµåããŠããå Žåãªã©ã§ã¯ãèªèšŒã®ååŸãªã©èªèšŒåŠçãã®ãã®ã ãã§ãªããã®åšèŸºã®åŠçãžã®åœ±é¿ç¯å²ãç¡èŠã§ããªãå ŽåãããããŠãŒã¶ãŒèªèšŒã®æ¹ä¿®ã«å·¥æ°ãæã£ãããããã£ãŠããŸã£ããã察å¿ãæ»ã£ãŠããŸãããšããããããããŸããã ãããªãšããèªèšŒãµãŒãã¹ãã¡ã€ã³ã®ãµãŒãã¹ãšåãé¢ãããšã§ããæè»ãªãŠãŒã¶ãŒèªèšŒææ®µãæäŸã§ãããããOpenID Connect ã®å°å
¥ãæ€èšããŠã¿ãŠãè¯ããããããŸããã OpenID Connect ãšã¯ OpenID Connect(以éãOIDC)ã«ã€ããŠãæ¬å®¶ãµã€ãã§ã¯ä»¥äžã®ããã«èª¬æãããŠããŸãã OpenID Connect 1.0 ã¯, OAuth 2.0 ãããã³ã«ã®äžã«ã·ã³ãã«ãªã¢ã€ãã³ãã£ãã£ã¬ã€ã€ãŒãä»äžãããã®ã§ãã. ãã®ãããã³ã«ã¯ Client ã Authorization Server ã®èªèšŒçµæã«åºã¥ã㊠End-User ã®ã¢ã€ãã³ãã£ãã£ãæ€èšŒå¯èœã«ãã. ãŸãåæã« End-User ã®å¿
èŠæäœéã®ãããã£ãŒã«æ
å ±ã, çžäºéçšå¯èœã〠RESTful ãªåœ¢ã§ååŸããããšãå¯èœã«ãã. ãã®ä»æ§ã¯, OpenID Connect ã®äž»èŠãªæ©èœã§ãã OAuth 2.0 äžã§ End-User ã®æ
å ±äŒéã®ããã«ã¯ã¬ãŒã ãçšããèªèšŒæ©èœãå®çŸ©ãã. ãã®ä»æ§ã¯ãŸã, OpenID Connect ãå©çšããããã® Security, Privacy Considerations ã説æãã. ïŒ æ¥æ¬èª , è±èª ïŒ å人çã«ã¯ãã¡ã€ã³ã®ãµãŒãã¹ãšèªèšŒãµãŒãã¹ãåãé¢ããŠéçšããããšãæ³å®ããŠä»æ§ãèŠå®ãããŠããç¹ãéèŠãšèããŸãã OIDC ãå©çšããããšã§ããŠãŒã¶ãŒèªèšŒãããæè»ã«æ¹ä¿®ãããæ°ããèªèšŒæ¹æ³ã«å¯Ÿå¿ãããããããšããããããªãããšãæåŸ
ãããããã§ãã ãªããOIDC ã®ä»æ§ã«ã¯èªèšŒææ®µèªäœïŒãã¹ã¯ãŒãèªèšŒãå€èŠçŽ èªèšŒãªã©ïŒã«é¢ããŠã¯èŠå®ãããŠãããããããŸã§èªèšŒãµãŒãã¹ã«ããèªèšŒçµæã®ååŸæ¹æ³ãæ±ãæ¹ã«ã€ããŠãèŠå®ãããŠããŸãã ãŸããæ§ã
ãªãŠãŒã¹ã±ãŒã¹ã«å¯Ÿå¿ã§ããããããã€ãã®åŠçãããŒããªãã·ã§ãã«ãªèšå®ãæäŸãããŠããŸããããã®åé¢ã»ãã¥ãªãã£ã®ç¢ºä¿ã¯å®è£
è
ã«å§ããããŠããããŠãŒã¹ã±ãŒã¹ã«å¿ããŠé©åãªå®è£
ãè¡ãå¿
èŠããããŸãã åè¿°ãããŠãŒã¶ãŒèªèšŒãµãŒãã¹ã§ãã Amazon Cognito ã FirebaseAuthentication ãªã©ã¯ãèªèšŒææ®µãæšæºã§ããã€ãæäŸãããŠãããå ããŠããã¯ãšã³ããš SDK ã« OIDC åºæã®ã»ãã¥ã¢ãªå®è£
ãæœãããŠãããããéçºè
ã¯æå°éã®èšå®ã ãã§ãŠãŒã¶ãŒèªèšŒæ©èœãå©çšã§ããããã«ãªããŸãã䟿å©ã§ããã åŠçãããŒã®è§£èª¬ ããŠãOIDC ã®å
·äœçãªåŠçã«ã€ããŠè§£èª¬ããŠããããšæããŸãã ãŸãç»å Žäººç©ã§ãã OpenID ProviderïŒOPïŒïŒèªèšŒèªå¯ãè¡ããµãŒãã¹ããŠãŒã¶ãŒèªèšŒæ
å ±ïŒèå¥åããã¹ã¯ãŒããªã©ïŒã管çããããèªèšŒã«é¢ãããŠãŒã¶ãŒå±æ§æ
å ±ïŒæ°åããŠãŒã¶ãŒåãªã©ïŒãä¿æããã RelyingPartyïŒRPïŒïŒ ã¢ã¯ã»ã¹å
ã®ãŠãŒã¶ãŒã®èªèšŒãšãŠãŒã¶ãŒå±æ§æ
å ±ãèŠæ±ãããµãŒãã¹ããŠãŒã¶ãŒããã®ãªã¯ãšã¹ãã«å¯Ÿã OP ã«ããèªèšŒçµæãä¿¡é ŒïŒrelyïŒããŠãªãœãŒã¹ãžã®ã¢ã¯ã»ã¹ãèš±å¯ããïŒäŸãã°ãã€ããŒãžã衚瀺ãããªã©ïŒã EndUserïŒãã°ã€ã³ãããŠãµãŒãã¹ãå©çšããããšããŠãããŠãŒã¶ãŒã åºæ¬çãªçšèªãå
ã«ç°¡åã«ç޹ä»ããŠãããŸãã ã¯ã©ã€ã¢ã³ã IDïŒOpenID Provider ã§ç®¡çãããRelyingParty ã®è奿
å ±ã ã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ããïŒOpenID Provider ã RelyingParty ããšã«çºè¡ããç§å¯éµã èªèšŒã³ãŒãïŒåŸè¿°ãã AuthorizationCodeFlow ã§ OpenID Provider ãçºè¡ããçåœã®ãã¹ã¯ãŒãã®ãããªãã®ã ID ããŒã¯ã³ïŒOpenID Provider ããçºè¡ãããããŠãŒã¶ãŒã«ããèªèšŒãè¡ã£ã蚌ææ
å ±ã JSON Web Token(JWT) ã§è¡šçŸãããæ€èšŒã«ããæ¹ããæ€ç¥ããããšãã§ãããèªèšŒã®å
容ïŒOpenID ProviderããŠãŒã¶ãŒèå¥åãRelyingParty ã®ã¯ã©ã€ã¢ã³ã IDãæå¹æéãªã©ïŒããŠãŒã¶ãŒå±æ§æ
å ±ãæ ŒçŽãããã ã¢ã¯ã»ã¹ããŒã¯ã³:OpenID Provider ãä¿æãããŠãŒã¶ãŒå±æ§æ
å ±ã«å¯Ÿãã¢ã¯ã»ã¹ããããã® OAuth2 ã®èªå¯ããŒã¯ã³ã OIDC ã®åŠçãããŒã¯å€§ããåã㊠3 çš®é¡ãèŠå®ãããŠããŸãã AuthorizationCodeFlowïŒèªèšŒæåæã« OpenID Provider ã RelyingParty ã«å¯ŸãèªèšŒã³ãŒããçºè¡ããRelyingParty ã¯ãããçšã㊠OpenID Provider ãã ID ããŒã¯ã³çãååŸãããRelyingParty ããµãŒããŒãµã€ãã¢ããªã±ãŒã·ã§ã³ã§ãOpenID Provider ããçºè¡ãããã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå®å
šã«ç®¡çããããšãã§ããå Žåãªã©ã«çšããããã ImplicitFlowïŒèªèšŒã³ãŒãã䜿ããèªèšŒçµæã®ã¬ã¹ãã³ã¹ã§ ID ããŒã¯ã³çãååŸãããRelyingParty ãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã®å Žåãªã©ãã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå®å
šã«ç®¡çã§ããªãå Žåãªã©ã«çšããããã HybridFlowïŒAuthorizationCodeFlow ãš ImplicitFlow ã®çµã¿åããã ãããã®ãããŒã®éãã¯ä»¥äžã®è¡šã®ãšããã§ãã ïŒ å
¬åŒããåŒçš ïŒ ä»åã¯ã å
¬åŒ ã ãã¡ãã®è§£èª¬èšäº ãªã©ãåç
§ããªãããåºæ¬ã®åŠçãããŒã§ãã AuthorizationCodeFlow ã«ã€ããŠè§£èª¬ããŸãã ç°¡ç¥åã®ãããã€ã¡ãŒãžéèŠã§ç»å Žäººç©ã¯ã ãŠãŒã¶ãŒ ããïŒãŠãŒã¶ãŒã«ãµãŒãã¹ãæäŸããïŒ Web ãµãŒãã¹ ãã èªèšŒãµãŒãã¹ ããšè¡šçŸããããšã«ããŸãã 倧ãŸãã«ã¯ä»¥äžã®ã¹ãããã§åŠçãè¡ãããŸãã ãŠãŒã¶ãŒ ããã®ã¢ã¯ã»ã¹ã«å¯Ÿãã Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ã«ãŠãŒã¶ãŒèªèšŒãèŠæ±ãã èªèšŒãµãŒãã¹ ã¯ãŠãŒã¶ãŒèªèšŒãè¡ããèªèšŒã³ãŒããçºè¡ããŠã ãŠãŒã¶ãŒ ã Web ãµãŒãã¹ ã«ãªãã€ã¬ã¯ãããã Web ãµãŒã㹠㯠2 ã§ååŸããèªèšŒã³ãŒããçšã㊠èªèšŒãµãŒãã¹ ã« ID ããŒã¯ã³çããªã¯ãšã¹ããã Web ãµãŒã㹠㯠3 ã§ååŸãã ID ããŒã¯ã³ãæ€èšŒãã ãŠãŒã¶ãŒ ã®èå¥åãååŸãã Step.0 : äºåæºå ããããã Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ããã¯ã©ã€ã¢ã³ã ID ãšã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããååŸãä¿æããŠãããŸãã Step.1: ãŠãŒã¶ãŒèªèšŒã®èŠæ± ãŠãŒã¶ãŒ ã Web ãµãŒãã¹ ã«å¯Ÿãäžè¬çãªãã°ã€ã³ã®æµãã§ãã°ã€ã³ãèŠæ±ãããšã Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ã«ãªã¯ãšã¹ãããªãã€ã¬ã¯ãããŸãã Web ãµãŒãã¹ ãã èªèšŒãµãŒãã¹ ãžã®ãªãã€ã¬ã¯ãã® URL ã¯ä»¥äžã®ãããªæãã§ãã HTTP / 1.1 302 Found Location: https://server.example.com/authorize? response_type=code & client_id = s6BhdRkqt3 & redirect_uri = https%3A%2F%2Fclient.example.org%2Fcb & scope = openid%20profile & state = af0ifjsldkj response_type ã§ OIDC ã®ã©ã®èªèšŒãããŒã䜿ãããæå®ããŸãã redirect_uri ã¯ã èªèšŒãµãŒãã¹ ã§ã®èªèšŒãæåãããšãã® Web ãµãŒãã¹ ã«ã³ãŒã«ããã¯ãã URL ã§ããããã¯äºåã«èªèšŒãµãŒãã¹ã«ç»é²ããŠããå¿
èŠããããŸãã scope ã«ã¯èªèšŒã®å
容ãèšå®ããŸããopenid ã¯å¿
é ã§ãä»ã«ã¯ OAuth2 ã®ã¢ã¯ã»ã¹ããŒã¯ã³ã䜿ã£ãŠååŸã§ãããŠãŒã¶ãŒå±æ§æ
å ±ãæå®ããŸãã scope ã§æå®ã§ãããŠãŒã¶ãŒå±æ§æ
å ±ã¯ä»¥äžã®ãšããã§ãã ïŒ å
¬åŒããåŒçš ïŒ ãŠãŒã¶ãŒã®èªèšŒã§ãã䜿ãããããªãæ°åãããã¡ãŒã«ã¢ãã¬ã¹ããªã©åºæ¬çãªå±æ§æ
å ±ãå®çŸ©ãããŠããŸãã state 㯠CSRF 察çãªã©ã®ããã®ã©ã³ãã å€ã§ããèªèšŒãããŒãéå§ãããã³ã« Web ãµãŒãã¹ ãçºè¡ãããªã¯ãšã¹ããšã³ãŒã«ããã¯ã®éã§å€ãç¶æãããŸãã ä»ã«ãããã€ãã®ãã©ã¡ãŒã¿ïŒnonce ãªã©ïŒãå®çŸ©ãããŠãããå¿
èŠã«å¿ããŠå©çšããŸãã Step.2: ãŠãŒã¶ãŒèªèšŒãšèªèšŒã³ãŒãã®çºè¡ èªèšŒãµãŒãã¹ ã§ã¯èªèšŒææ®µã«å¿ããŠãã°ã€ã³ ID ã»ãã¹ã¯ãŒãã®å
¥åãã©ãŒã ãªã©ã衚瀺ãã ãŠãŒã¶ãŒ ããèªèšŒæ
å ±ãååŸããŠèªèšŒåŠçãè¡ããŸãã èªèšŒãµãŒãã¹ ã¯ãŠãŒã¶ãŒã®èªèšŒã«æåãããšãèªèšŒã³ãŒããçºè¡ãã ãŠãŒã¶ãŒ ã Web ãµãŒãã¹ ã«ãªãã€ã¬ã¯ããããŸãã HTTP / 1.1 302 Found Location: https://client.example.org/cb? code=SplxlOBeZQQYbYS6WxSbIA & state = af0ifjsldkj ãªãã€ã¬ã¯ãå
ã«ã€ããŠã èªèšŒãµãŒã㹠㯠Step.1 ã§åãåã£ã redirect url ã èªèšŒãµãŒãã¹ ã«äºãç»é²ãããŠãã URL ãšåèŽããããšãæ€èšŒããå¿
èŠããããŸãã_Web ãµãŒãã¹ ã®ãªãããŸããé²ãããã§ãã ãŸã Web ãµãŒãã¹ åŽã§ èªèšŒãµãŒãã¹ ããã®ã¬ã¹ãã³ã¹ã§ããããšã確èªã§ãããããstate ããã©ã¡ãŒã¿ã«å«ããŸãã ãªããèªèšŒã«å€±æããå Žåã¯äžèšã®ããã«èªèšŒãšã©ãŒããå
容ããã©ã¡ãŒã¿ãŒã«å ã㊠Web ãµãŒãã¹ã«ãªãã€ã¬ã¯ããããŸãã HTTP / 1.1 302 Found Location: https://client.example.org/cb? error=invalid_request & error_description = Unsupported%20response_type%20value & state = af0ifjsldkj Step.3: èªèšŒçµæã®ååŸ Step.2 ã§ Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ããã®ãªãã€ã¬ã¯ããåããèªèšŒã³ãŒããååŸãããšããã®èªèšŒã³ãŒããå©çšã㊠èªèšŒãµãŒãã¹ ã«å¯ŸããŠèªèšŒçµææ
å ±ïŒID ããŒã¯ã³ãªã©ïŒãååŸããŸãã Web ãµãŒãã¹ ãã èªèšŒãµãŒãã¹ ãžã®èªèšŒçµæååŸãªã¯ãšã¹ãã¯ä»¥äžã®ãããªåœ¢åŒã«ãªããŸãã POST /token HTTP / 1.1 Host: server.example.com Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW Content-Type: application/x-www-form-urlencoded grant_type=authorization_code&code=SplxlOBeZQQYbYS6WxSbIA & redirect_uri = https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb èªèšŒã³ãŒããéä¿¡ããå¿
èŠããããããPOST ã¡ãœããã§ãªã¯ãšã¹ãããŸãããŸãã¯ã©ã€ã¢ã³ã ID ãšã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ããã«ãã BASIC èªèšŒãè¡ããŸãã ãã®ãªã¯ãšã¹ãã§ã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå¿
èŠã«ãªãã®ã§ããããã㯠èªèšŒãµãŒãã¹ ã«ãšã£ãŠ Web ãµãŒãã¹ ã®æ£åœæ§ãæ€èšŒããããã®éèŠãªãã©ã¡ãŒã¿ã§ãããå®å
šã«ç®¡çãããå¿
èŠããããŸãã SinglePageApplication ã®ããã«ãŠãŒã¶ãŒåŽã«ããã¢ããªã±ãŒã·ã§ã³ã§ OIDC ãåŠçããå Žåã«ã¯ããã®ã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå®å
šã«ç®¡çãããä¿èšŒããªããããAuthenticationCodeFlow ã§ã¯ãªã ImplicitFlow ãªã©ãå©çšããå¿
èŠããããŸãã Web ãµãŒãã¹ ããã®ãªã¯ãšã¹ããåãåã£ã èªèšŒãµãŒã㹠㯠grant_type ã« Step.1 ã§æå®ããåŠçãããŒã«è©²åœããæ
å ±ãæž¡ããèªèšŒã³ãŒãïŒ code ïŒãšåãã㊠èªèšŒãµãŒãã¹ ã«ãªã¯ãšã¹ãã®æ€èšŒããããŸãã èªèšŒãµãŒãã¹ ã¯ãªã¯ãšã¹ãã®æ€èšŒã«æåãããšã Web ãµãŒãã¹ ã«å¯ŸãèªèšŒçµæãšã㊠ID ããŒã¯ã³çãè¿åŽããŸãã HTTP / 1.1 200 OK Content-Type: application/json Cache-Control: no-cache, no-store Pragma: no-cache { "access_token" : "SlAV32hkKG" , "token_type" : "Bearer" , "expires_in" : 3600 , "refresh_token" : "tGzv3JOkF0XG5Qx2TlKWIA" , "id_token" : "eyJ0 ... NiJ9.eyJ1c ... I6IjIifX0.DeWt4Qu ... ZXso" } access_token 㯠èªèšŒãµãŒãã¹ ã§ç®¡çããŠãããŠãŒã¶ãŒå±æ§æ
å ±ãååŸããããã® OAuth2 ããŒã¯ã³ã§ãã refresh_token 㯠èªèšŒãµãŒãã¹ ãã access_token ãåçºè¡ããéã«å©çšããŸãã Step.4: èªèšŒçµæã®æ€èšŒ Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹*ããååŸãã ID ããŒã¯ã³ãæ€èšŒããŸããID ããŒã¯ã³ã¯åè¿°ã®éã JWT ã§è¡šçŸãããŠããã*èªèšŒãµãŒãã¹_ã®å
¬ééµãçšããŠæ€èšŒããããšãã§ããŸãã æé 㯠ãã¡ã ãã確èªãã ãããä»ã«ãåèãªã³ã¯ã玹ä»ããŠãããŸãã https://qiita.com/bobunderson/items/d48f89e2b3e6ad9f9c4c https://qiita.com/TakahikoKawasaki/items/8f0e422c7edd2d220e06 äžèšã¯ ID ããŒã¯ã³ã«å«ãŸããèªèšŒæ
å ±ã®äŸã§ãã { "iss" : "https://server.example.com" , "sub" : "24400320" , "aud" : "s6BhdRkqt3" , "exp" : 1311281970 , "iat" : 1311280970 } ãã®ãã¡ sub ã èªèšŒãµãŒãã¹ ã§ç®¡çãããŠãã ãŠãŒã¶ãŒ ã®èå¥åã§ãã iss 㯠èªèšŒãµãŒãã¹ ãaud 㯠Web ãµãŒãã¹ ã®ã¯ã©ã€ã¢ã³ã ID ã«ãªããŸãã expãiat ã¯ããããèªèšŒã®æå¹æéãšèªèšŒããã¿ã€ã ã¹ã¿ã³ãã§ãã Web ãµãŒã㹠㯠ID ããŒã¯ã³ãæ£ããå
容ã§ããããšã確èªã§ããã°ãããããã°ã€ã³ã»ãã·ã§ã³ãšçŽã¥ããŠä¿ç®¡ããŸãã 以äžã§èªèšŒåŠçã¯å®äºã§ãã ãŠãŒã¶ãŒå±æ§æ
å ±ã®ååŸ ãŠãŒã¶ãŒèªèšŒåŸã Web ãµãŒãã¹ ããŠãŒã¶ãŒåãªã©ã®ãŠãŒã¶ãŒå±æ§æ
å ±ãå¿
èŠã«ãªã£ãå ŽåãStep.3 ã§ååŸãã access_token ãå©çšã èªèšŒãµãŒãã¹ ã«å¯ŸããŠãŠãŒã¶ãŒå±æ§æ
å ±ããªã¯ãšã¹ãããŸãã GET /userinfo HTTP / 1.1 Host: server.example.com Authorization: Bearer SlAV32hkKG ãã®ãªã¯ãšã¹ãã«ãããStep.1 ã® scope ã§æå®ãããŠãŒã¶ãŒå±æ§æ
å ±ãååŸã§ããŸãã ãŸãšã 以äžå°ãé·ããªããŸãããããŠãŒã¶ãŒèªèšŒãš OpenID Connectãç¹ã«åºæ¬ã® AuthenticationCodeFlow ã«ã€ããŠè§£èª¬ããŸãããéãããçºè¡šæéã®äžã§ã®è§£èª¬ã®ããå³å¯ãããé°å²æ°ãéèŠããå
容ãšãªããŸãããããæ°ã¥ãã®ç¹ãªã©ããã°ãç¥ããããã ããã°ãšæããŸãã ãµãŒãã¹ã®èŠä»¶ããã§ãŒãºã«ãã£ãŠ OIDC ãåãå
¥ãããã©ããã¯æ§ã
ã§ããããŠãŒã¶ãŒèªèšŒã®å®è£
ãèªåã§å®è£
ãã¡ã³ããã³ã¹ããŠããã ãã§ãªããAmazon Cognito ãªã©ã®äŸ¿å©ãªèªèšŒãµãŒãã¹ãå©çšããŠããããšãéžæè¢ã®äžã€ãšããŠæ€èšããŠã¿ãŠãè¯ããããããŸããã ãããŠããã䟿å©ãªèªèšŒãµãŒãã¹ãããŸã䜿ãããªãããã«ãããã®èæ¯ã«ãã OIDC ã®ä»æ§ãææ³ãããããèªèšŒã®ä»çµã¿ã«ã€ããŠç«ã¡è¿ã£ãŠã¿ããšãçè§£ãäžæ®µãšæ·±ãŸãããšããããŸãã www.medley.jp www.medley.jp
ããã«ã¡ã¯ãéçºæ¬éšã®ãšã³ãžãã¢ã®é¶Žã§ãã ä»åã¯å
æã«è¡ã£ã瀟å
ã®ååŒ·äŒ TechLunch ã®å
容ãã玹ä»ãããŠããã ããŸãã ã€ã³ãã Web ãµãŒãã¹ã§ã¯ããŠãŒã¶ãŒã«ã¢ã«ãŠã³ããäœã£ãŠãããããã°ã€ã³ãããŠãµãŒãã¹ãå©çšããŠãããããšãããŠãŒã¶ãŒèªèšŒãå©çšãããµãŒãã¹ãå€ãããšæããŸãã Web ãµãŒãã¹ãéçºããåŽãšããŠã¯ããµãŒãã¹ããšã«éœåºŠãŠãŒã¶ãŒèªèšŒã®ä»çµã¿ãæ§ç¯ããå¿
èŠããããŸãããã»ãã¥ãªãã£å¯Ÿçã®èгç¹ããèæ
®ããããšãå€ããå°å³ã«éçºã®å·¥æ°ãããã£ãŠããŸããŸãã ãŸãæè¿ã§ã¯ã Amazon Cognito ã Firebase Authentication ã Auth0 ãªã©ããŠãŒã¶ãŒèªèšŒãµãŒãã¹ãããã€ããªãªãŒã¹ããããŠãŒã¶ãŒèªèšŒã®æ©èœããããã®å€éšãµãŒãã¹ã«ä»»ããŠéçºã®æéãçããšããéžæè¢ãåããããã«ãªã£ãŠããŠããŸãã èªåèªèº«ããã€ãŠæ
åœãããããžã§ã¯ãã§ãŠãŒã¶ãŒèªèšŒã®ä»çµã¿ã Amazon Cognito ã«ãŸãããŠã·ã¹ãã ãæ§ç¯ããããšããããŸããã ããããåœæã¯ç¹ã«ãŠãŒã¶ãŒããŒã«ã®æ©èœããªãªãŒã¹ãããŠéããªãããšããããSDK ã®åäœããµãŒãã¹ã®ä»æ§ã®çè§£ã«ããªãæéåã£ãããšãèŠããŠããŸãã ãŠãŒã¶ãŒèªèšŒãµãŒãã¹ã§ã¯ OpenID Connect ãšãã仿§ã«æºæ ããŠããããšãå€ãã®ã§ãããããããèªåã«ãšã£ãŠãã®ä»æ§ã®çè§£ãçãã ã£ãããšãåå ã®äžã€ã ã£ããšæããŸãã ããã§ä»åã¯ããŠãŒã¶ãŒèªèšŒãš OpenID Connect ã®ä»çµã¿ã«ã€ããŠæ¹ããŠå匷ãçŽããã®ã§ããã®å
容ãç°¡åã«è§£èª¬ããããŠããã ãããšæããŸãã ãŠãŒã¶ãŒèªèšŒãšã¯ ãŠãŒã¶ãŒèªèšŒã®åã«ãããããèªèšŒãšã¯ã©ãããæäœã®ããšãæãã®ã§ããããã ã¿ããªå€§å¥œã Wikipedia å
ç ã«ãããšã以äžã®ãããªèšèŒããããŸãã èªèšŒïŒã«ããããïŒãšã¯ãäœãã«ãã£ãŠãå¯Ÿè±¡ã®æ£åœæ§ã確èªããè¡çºãæãã èªèšŒè¡çºã¯èªèšŒå¯Ÿè±¡ãã£ãŠåé¡ãããèªèšŒå¯Ÿè±¡ã人éã§ããå Žåã«ã¯çžæèªèšŒïŒæ¬äººèªèšŒïŒãã¡ãã»ãŒãžã§ããå Žåã«ã¯ã¡ãã»ãŒãžèªèšŒãæå»ã®å Žåã«ã¯æå»èªèšŒãšåŒã¶ã åã«èªèšŒãšèšã£ãå Žåã«ã¯çžæèªèšŒãæãå Žåãå€ãã ãŠãŒã¶ãŒèªèšŒã¯ Web ãµãŒãã¹ã«ãšã£ãŠãªã¯ãšã¹ããéä¿¡ããŠããçžæã®æ£åœæ§ãèªèšŒããããšãªã®ã§ãçžæèªèšŒã® 1 ã€ã§ããã ããã«çžæèªèšŒã®èªèšŒæ¹æ³ãšã㊠2 éãã®æ¹æ³ããããŸãã 第 1 ã®æ¹æ³ã¯ã被èªèšŒè
ãèªèšŒè
ã«ãç§å¯éµããã£ãŠããããšã«ãã£ãŠåŸãããäœããã®èœåã®èšŒæãè¡ãæ¹æ³ã§ããã第 2 ã®æ¹æ³ã¯ã被èªèšŒè
ãèªèšŒè
ã«ã被èªèšŒè
ã®å
¬ééµã«å¯Ÿå¿ããç§å¯éµã®ç¥èã®èšŒæãè¡ãæ¹æ³ã§ããã ãŠãŒã¶ãŒèªèšŒã®å Žåãå€ãã¯ãã®ç¬¬ 1 ã®æ¹æ³ã§ã®èªèšŒã§ããã°ã€ã³æã«ãŠãŒã¶ãŒ ID ã«å ããŠããã®ãç§å¯éµããšããŠã¢ã«ãŠã³ãäœææã«ç»é²ããŠããããã¹ã¯ãŒããå
¥åããããšã§ãŠãŒã¶ãŒèªèšŒãè¡ã£ãŠããããšæããŸãã Web ãµãŒãã¹ã§ã®ãŠãŒã¶ãŒèªèšŒ Web ãµãŒãã¹ã§æ±ãæ
å ±ã®ç§å¿æ§ãé«ããªãã°ãªãã»ã©ããã®ãç§å¯éµããæ¬åœã«ãã®ãŠãŒã¶ãŒã«ããæäŸã§ããªãæ
å ±ã§ããããšãæ±ããããŸãã äžè¿°ã®ãããªãã¹ã¯ãŒãã«ããèªèšŒã®å Žåããã¹ã¯ãŒããæšæž¬ããããªã©ããŠæªæã®ãã第äžè
ã«ã¢ã«ãŠã³ããä¹ã£åãããŠããŸãäºä»¶ã¯ããè³ã«ããŸãã ããã»ãã¥ãªãã£ãé«ããããããã¹ã¯ãŒã以å€ã®èªèšŒãå€èŠçŽ èªèšŒãªã©ãçšããäºãå¢ããŠããŸããã ãŸããã»ãã¥ãªãã£ã®èгç¹ã ãã§ãªãå©äŸ¿æ§ã®èгç¹ãããããã¹ã¯ãŒãå
¥åã®ä»£ããã«æçŽèªèšŒãé¡èªèšŒã«ãããã°ã€ã³ãããããã¯åçš® SNS ã¢ã«ãŠã³ãã«ãããã°ã€ã³ãå¢ããŠããŠããŸããèªç€Ÿã®è€æ°ã®ãµãŒãã¹ã飿ºã§ãããããŠãŒã¶ãŒã«å
±é ID ãæäŸãããããšãã£ãã±ãŒã¹ããããããããŸããã æè¿ã§ã¯ãã¹ã¯ãŒãã¬ã¹èªèšŒã WebAuthn ãæ³šç®ãããŠããŸãããä»åã¯ç޹ä»ã¯å²æããŸããããã¹ã¯ãŒãã¬ã¹èªèšŒã®äžã€ã§ãã FIDO èªèšŒ ã¯ãåè¿°ã®ã被èªèšŒè
ãèªèšŒè
ã«ã被èªèšŒè
ã®å
¬ééµã«å¯Ÿå¿ããç§å¯éµã®ç¥èã®èšŒæãè¡ãæ¹æ³ããå©çšããèªèšŒæ¹åŒã®ããã§ããïŒ ref1 , ref2 ïŒ ãã®ããã«ãã»ãã¥ãªãã£ã®èгç¹ããŠãŒã¶ãŒå©äŸ¿æ§ã®èгç¹ãªã©ã«ãããWeb ãµãŒãã¹ã«ããããŠãŒã¶ãŒèªèšŒæ©èœã¯ 1 åäœã£ããçµããã§ã¯ãªããææµã«å¿ããŠé©å®æ¹ä¿®ããå¿
èŠãåºãŠããããšãããããšæããŸãã ããããç¹ã«ãŠãŒã¶ãŒèªèšŒãã¡ã€ã³ã®ãµãŒãã¹ãšå¯çµåããŠããå Žåãªã©ã§ã¯ãèªèšŒã®ååŸãªã©èªèšŒåŠçãã®ãã®ã ãã§ãªããã®åšèŸºã®åŠçãžã®åœ±é¿ç¯å²ãç¡èŠã§ããªãå ŽåãããããŠãŒã¶ãŒèªèšŒã®æ¹ä¿®ã«å·¥æ°ãæã£ãããããã£ãŠããŸã£ããã察å¿ãæ»ã£ãŠããŸãããšããããããããŸããã ãããªãšããèªèšŒãµãŒãã¹ãã¡ã€ã³ã®ãµãŒãã¹ãšåãé¢ãããšã§ããæè»ãªãŠãŒã¶ãŒèªèšŒææ®µãæäŸã§ãããããOpenID Connect ã®å°å
¥ãæ€èšããŠã¿ãŠãè¯ããããããŸããã OpenID Connect ãšã¯ OpenID Connect(以éãOIDC)ã«ã€ããŠãæ¬å®¶ãµã€ãã§ã¯ä»¥äžã®ããã«èª¬æãããŠããŸãã OpenID Connect 1.0 ã¯, OAuth 2.0 ãããã³ã«ã®äžã«ã·ã³ãã«ãªã¢ã€ãã³ãã£ãã£ã¬ã€ã€ãŒãä»äžãããã®ã§ãã. ãã®ãããã³ã«ã¯ Client ã Authorization Server ã®èªèšŒçµæã«åºã¥ã㊠End-User ã®ã¢ã€ãã³ãã£ãã£ãæ€èšŒå¯èœã«ãã. ãŸãåæã« End-User ã®å¿
èŠæäœéã®ãããã£ãŒã«æ
å ±ã, çžäºéçšå¯èœã〠RESTful ãªåœ¢ã§ååŸããããšãå¯èœã«ãã. ãã®ä»æ§ã¯, OpenID Connect ã®äž»èŠãªæ©èœã§ãã OAuth 2.0 äžã§ End-User ã®æ
å ±äŒéã®ããã«ã¯ã¬ãŒã ãçšããèªèšŒæ©èœãå®çŸ©ãã. ãã®ä»æ§ã¯ãŸã, OpenID Connect ãå©çšããããã® Security, Privacy Considerations ã説æãã. ïŒ æ¥æ¬èª , è±èª ïŒ å人çã«ã¯ãã¡ã€ã³ã®ãµãŒãã¹ãšèªèšŒãµãŒãã¹ãåãé¢ããŠéçšããããšãæ³å®ããŠä»æ§ãèŠå®ãããŠããç¹ãéèŠãšèããŸãã OIDC ãå©çšããããšã§ããŠãŒã¶ãŒèªèšŒãããæè»ã«æ¹ä¿®ãããæ°ããèªèšŒæ¹æ³ã«å¯Ÿå¿ãããããããšããããããªãããšãæåŸ
ãããããã§ãã ãªããOIDC ã®ä»æ§ã«ã¯èªèšŒææ®µèªäœïŒãã¹ã¯ãŒãèªèšŒãå€èŠçŽ èªèšŒãªã©ïŒã«é¢ããŠã¯èŠå®ãããŠãããããããŸã§èªèšŒãµãŒãã¹ã«ããèªèšŒçµæã®ååŸæ¹æ³ãæ±ãæ¹ã«ã€ããŠãèŠå®ãããŠããŸãã ãŸããæ§ã
ãªãŠãŒã¹ã±ãŒã¹ã«å¯Ÿå¿ã§ããããããã€ãã®åŠçãããŒããªãã·ã§ãã«ãªèšå®ãæäŸãããŠããŸããããã®åé¢ã»ãã¥ãªãã£ã®ç¢ºä¿ã¯å®è£
è
ã«å§ããããŠããããŠãŒã¹ã±ãŒã¹ã«å¿ããŠé©åãªå®è£
ãè¡ãå¿
èŠããããŸãã åè¿°ãããŠãŒã¶ãŒèªèšŒãµãŒãã¹ã§ãã Amazon Cognito ã FirebaseAuthentication ãªã©ã¯ãèªèšŒææ®µãæšæºã§ããã€ãæäŸãããŠãããå ããŠããã¯ãšã³ããš SDK ã« OIDC åºæã®ã»ãã¥ã¢ãªå®è£
ãæœãããŠãããããéçºè
ã¯æå°éã®èšå®ã ãã§ãŠãŒã¶ãŒèªèšŒæ©èœãå©çšã§ããããã«ãªããŸãã䟿å©ã§ããã åŠçãããŒã®è§£èª¬ ããŠãOIDC ã®å
·äœçãªåŠçã«ã€ããŠè§£èª¬ããŠããããšæããŸãã ãŸãç»å Žäººç©ã§ãã OpenID ProviderïŒOPïŒïŒèªèšŒèªå¯ãè¡ããµãŒãã¹ããŠãŒã¶ãŒèªèšŒæ
å ±ïŒèå¥åããã¹ã¯ãŒããªã©ïŒã管çããããèªèšŒã«é¢ãããŠãŒã¶ãŒå±æ§æ
å ±ïŒæ°åããŠãŒã¶ãŒåãªã©ïŒãä¿æããã RelyingPartyïŒRPïŒïŒ ã¢ã¯ã»ã¹å
ã®ãŠãŒã¶ãŒã®èªèšŒãšãŠãŒã¶ãŒå±æ§æ
å ±ãèŠæ±ãããµãŒãã¹ããŠãŒã¶ãŒããã®ãªã¯ãšã¹ãã«å¯Ÿã OP ã«ããèªèšŒçµæãä¿¡é ŒïŒrelyïŒããŠãªãœãŒã¹ãžã®ã¢ã¯ã»ã¹ãèš±å¯ããïŒäŸãã°ãã€ããŒãžã衚瀺ãããªã©ïŒã EndUserïŒãã°ã€ã³ãããŠãµãŒãã¹ãå©çšããããšããŠãããŠãŒã¶ãŒã åºæ¬çãªçšèªãå
ã«ç°¡åã«ç޹ä»ããŠãããŸãã ã¯ã©ã€ã¢ã³ã IDïŒOpenID Provider ã§ç®¡çãããRelyingParty ã®è奿
å ±ã ã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ããïŒOpenID Provider ã RelyingParty ããšã«çºè¡ããç§å¯éµã èªèšŒã³ãŒãïŒåŸè¿°ãã AuthorizationCodeFlow ã§ OpenID Provider ãçºè¡ããçåœã®ãã¹ã¯ãŒãã®ãããªãã®ã ID ããŒã¯ã³ïŒOpenID Provider ããçºè¡ãããããŠãŒã¶ãŒã«ããèªèšŒãè¡ã£ã蚌ææ
å ±ã JSON Web Token(JWT) ã§è¡šçŸãããæ€èšŒã«ããæ¹ããæ€ç¥ããããšãã§ãããèªèšŒã®å
容ïŒOpenID ProviderããŠãŒã¶ãŒèå¥åãRelyingParty ã®ã¯ã©ã€ã¢ã³ã IDãæå¹æéãªã©ïŒããŠãŒã¶ãŒå±æ§æ
å ±ãæ ŒçŽãããã ã¢ã¯ã»ã¹ããŒã¯ã³:OpenID Provider ãä¿æãããŠãŒã¶ãŒå±æ§æ
å ±ã«å¯Ÿãã¢ã¯ã»ã¹ããããã® OAuth2 ã®èªå¯ããŒã¯ã³ã OIDC ã®åŠçãããŒã¯å€§ããåã㊠3 çš®é¡ãèŠå®ãããŠããŸãã AuthorizationCodeFlowïŒèªèšŒæåæã« OpenID Provider ã RelyingParty ã«å¯ŸãèªèšŒã³ãŒããçºè¡ããRelyingParty ã¯ãããçšã㊠OpenID Provider ãã ID ããŒã¯ã³çãååŸãããRelyingParty ããµãŒããŒãµã€ãã¢ããªã±ãŒã·ã§ã³ã§ãOpenID Provider ããçºè¡ãããã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå®å
šã«ç®¡çããããšãã§ããå Žåãªã©ã«çšããããã ImplicitFlowïŒèªèšŒã³ãŒãã䜿ããèªèšŒçµæã®ã¬ã¹ãã³ã¹ã§ ID ããŒã¯ã³çãååŸãããRelyingParty ãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã®å Žåãªã©ãã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå®å
šã«ç®¡çã§ããªãå Žåãªã©ã«çšããããã HybridFlowïŒAuthorizationCodeFlow ãš ImplicitFlow ã®çµã¿åããã ãããã®ãããŒã®éãã¯ä»¥äžã®è¡šã®ãšããã§ãã ïŒ å
¬åŒããåŒçš ïŒ ä»åã¯ã å
¬åŒ ã ãã¡ãã®è§£èª¬èšäº ãªã©ãåç
§ããªãããåºæ¬ã®åŠçãããŒã§ãã AuthorizationCodeFlow ã«ã€ããŠè§£èª¬ããŸãã ç°¡ç¥åã®ãããã€ã¡ãŒãžéèŠã§ç»å Žäººç©ã¯ã ãŠãŒã¶ãŒ ããïŒãŠãŒã¶ãŒã«ãµãŒãã¹ãæäŸããïŒ Web ãµãŒãã¹ ãã èªèšŒãµãŒãã¹ ããšè¡šçŸããããšã«ããŸãã 倧ãŸãã«ã¯ä»¥äžã®ã¹ãããã§åŠçãè¡ãããŸãã ãŠãŒã¶ãŒ ããã®ã¢ã¯ã»ã¹ã«å¯Ÿãã Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ã«ãŠãŒã¶ãŒèªèšŒãèŠæ±ãã èªèšŒãµãŒãã¹ ã¯ãŠãŒã¶ãŒèªèšŒãè¡ããèªèšŒã³ãŒããçºè¡ããŠã ãŠãŒã¶ãŒ ã Web ãµãŒãã¹ ã«ãªãã€ã¬ã¯ãããã Web ãµãŒã㹠㯠2 ã§ååŸããèªèšŒã³ãŒããçšã㊠èªèšŒãµãŒãã¹ ã« ID ããŒã¯ã³çããªã¯ãšã¹ããã Web ãµãŒã㹠㯠3 ã§ååŸãã ID ããŒã¯ã³ãæ€èšŒãã ãŠãŒã¶ãŒ ã®èå¥åãååŸãã Step.0 : äºåæºå ããããã Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ããã¯ã©ã€ã¢ã³ã ID ãšã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããååŸãä¿æããŠãããŸãã Step.1: ãŠãŒã¶ãŒèªèšŒã®èŠæ± ãŠãŒã¶ãŒ ã Web ãµãŒãã¹ ã«å¯Ÿãäžè¬çãªãã°ã€ã³ã®æµãã§ãã°ã€ã³ãèŠæ±ãããšã Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ã«ãªã¯ãšã¹ãããªãã€ã¬ã¯ãããŸãã Web ãµãŒãã¹ ãã èªèšŒãµãŒãã¹ ãžã®ãªãã€ã¬ã¯ãã® URL ã¯ä»¥äžã®ãããªæãã§ãã HTTP / 1.1 302 Found Location: https://server.example.com/authorize? response_type=code & client_id = s6BhdRkqt3 & redirect_uri = https%3A%2F%2Fclient.example.org%2Fcb & scope = openid%20profile & state = af0ifjsldkj response_type ã§ OIDC ã®ã©ã®èªèšŒãããŒã䜿ãããæå®ããŸãã redirect_uri ã¯ã èªèšŒãµãŒãã¹ ã§ã®èªèšŒãæåãããšãã® Web ãµãŒãã¹ ã«ã³ãŒã«ããã¯ãã URL ã§ããããã¯äºåã«èªèšŒãµãŒãã¹ã«ç»é²ããŠããå¿
èŠããããŸãã scope ã«ã¯èªèšŒã®å
容ãèšå®ããŸããopenid ã¯å¿
é ã§ãä»ã«ã¯ OAuth2 ã®ã¢ã¯ã»ã¹ããŒã¯ã³ã䜿ã£ãŠååŸã§ãããŠãŒã¶ãŒå±æ§æ
å ±ãæå®ããŸãã scope ã§æå®ã§ãããŠãŒã¶ãŒå±æ§æ
å ±ã¯ä»¥äžã®ãšããã§ãã ïŒ å
¬åŒããåŒçš ïŒ ãŠãŒã¶ãŒã®èªèšŒã§ãã䜿ãããããªãæ°åãããã¡ãŒã«ã¢ãã¬ã¹ããªã©åºæ¬çãªå±æ§æ
å ±ãå®çŸ©ãããŠããŸãã state 㯠CSRF 察çãªã©ã®ããã®ã©ã³ãã å€ã§ããèªèšŒãããŒãéå§ãããã³ã« Web ãµãŒãã¹ ãçºè¡ãããªã¯ãšã¹ããšã³ãŒã«ããã¯ã®éã§å€ãç¶æãããŸãã ä»ã«ãããã€ãã®ãã©ã¡ãŒã¿ïŒnonce ãªã©ïŒãå®çŸ©ãããŠãããå¿
èŠã«å¿ããŠå©çšããŸãã Step.2: ãŠãŒã¶ãŒèªèšŒãšèªèšŒã³ãŒãã®çºè¡ èªèšŒãµãŒãã¹ ã§ã¯èªèšŒææ®µã«å¿ããŠãã°ã€ã³ ID ã»ãã¹ã¯ãŒãã®å
¥åãã©ãŒã ãªã©ã衚瀺ãã ãŠãŒã¶ãŒ ããèªèšŒæ
å ±ãååŸããŠèªèšŒåŠçãè¡ããŸãã èªèšŒãµãŒãã¹ ã¯ãŠãŒã¶ãŒã®èªèšŒã«æåãããšãèªèšŒã³ãŒããçºè¡ãã ãŠãŒã¶ãŒ ã Web ãµãŒãã¹ ã«ãªãã€ã¬ã¯ããããŸãã HTTP / 1.1 302 Found Location: https://client.example.org/cb? code=SplxlOBeZQQYbYS6WxSbIA & state = af0ifjsldkj ãªãã€ã¬ã¯ãå
ã«ã€ããŠã èªèšŒãµãŒã㹠㯠Step.1 ã§åãåã£ã redirect url ã èªèšŒãµãŒãã¹ ã«äºãç»é²ãããŠãã URL ãšåèŽããããšãæ€èšŒããå¿
èŠããããŸãã_Web ãµãŒãã¹ ã®ãªãããŸããé²ãããã§ãã ãŸã Web ãµãŒãã¹ åŽã§ èªèšŒãµãŒãã¹ ããã®ã¬ã¹ãã³ã¹ã§ããããšã確èªã§ãããããstate ããã©ã¡ãŒã¿ã«å«ããŸãã ãªããèªèšŒã«å€±æããå Žåã¯äžèšã®ããã«èªèšŒãšã©ãŒããå
容ããã©ã¡ãŒã¿ãŒã«å ã㊠Web ãµãŒãã¹ã«ãªãã€ã¬ã¯ããããŸãã HTTP / 1.1 302 Found Location: https://client.example.org/cb? error=invalid_request & error_description = Unsupported%20response_type%20value & state = af0ifjsldkj Step.3: èªèšŒçµæã®ååŸ Step.2 ã§ Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ããã®ãªãã€ã¬ã¯ããåããèªèšŒã³ãŒããååŸãããšããã®èªèšŒã³ãŒããå©çšã㊠èªèšŒãµãŒãã¹ ã«å¯ŸããŠèªèšŒçµææ
å ±ïŒID ããŒã¯ã³ãªã©ïŒãååŸããŸãã Web ãµãŒãã¹ ãã èªèšŒãµãŒãã¹ ãžã®èªèšŒçµæååŸãªã¯ãšã¹ãã¯ä»¥äžã®ãããªåœ¢åŒã«ãªããŸãã POST /token HTTP / 1.1 Host: server.example.com Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW Content-Type: application/x-www-form-urlencoded grant_type=authorization_code&code=SplxlOBeZQQYbYS6WxSbIA & redirect_uri = https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb èªèšŒã³ãŒããéä¿¡ããå¿
èŠããããããPOST ã¡ãœããã§ãªã¯ãšã¹ãããŸãããŸãã¯ã©ã€ã¢ã³ã ID ãšã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ããã«ãã BASIC èªèšŒãè¡ããŸãã ãã®ãªã¯ãšã¹ãã§ã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå¿
èŠã«ãªãã®ã§ããããã㯠èªèšŒãµãŒãã¹ ã«ãšã£ãŠ Web ãµãŒãã¹ ã®æ£åœæ§ãæ€èšŒããããã®éèŠãªãã©ã¡ãŒã¿ã§ãããå®å
šã«ç®¡çãããå¿
èŠããããŸãã SinglePageApplication ã®ããã«ãŠãŒã¶ãŒåŽã«ããã¢ããªã±ãŒã·ã§ã³ã§ OIDC ãåŠçããå Žåã«ã¯ããã®ã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå®å
šã«ç®¡çãããä¿èšŒããªããããAuthenticationCodeFlow ã§ã¯ãªã ImplicitFlow ãªã©ãå©çšããå¿
èŠããããŸãã Web ãµãŒãã¹ ããã®ãªã¯ãšã¹ããåãåã£ã èªèšŒãµãŒã㹠㯠grant_type ã« Step.1 ã§æå®ããåŠçãããŒã«è©²åœããæ
å ±ãæž¡ããèªèšŒã³ãŒãïŒ code ïŒãšåãã㊠èªèšŒãµãŒãã¹ ã«ãªã¯ãšã¹ãã®æ€èšŒããããŸãã èªèšŒãµãŒãã¹ ã¯ãªã¯ãšã¹ãã®æ€èšŒã«æåãããšã Web ãµãŒãã¹ ã«å¯ŸãèªèšŒçµæãšã㊠ID ããŒã¯ã³çãè¿åŽããŸãã HTTP / 1.1 200 OK Content-Type: application/json Cache-Control: no-cache, no-store Pragma: no-cache { "access_token" : "SlAV32hkKG" , "token_type" : "Bearer" , "expires_in" : 3600 , "refresh_token" : "tGzv3JOkF0XG5Qx2TlKWIA" , "id_token" : "eyJ0 ... NiJ9.eyJ1c ... I6IjIifX0.DeWt4Qu ... ZXso" } access_token 㯠èªèšŒãµãŒãã¹ ã§ç®¡çããŠãããŠãŒã¶ãŒå±æ§æ
å ±ãååŸããããã® OAuth2 ããŒã¯ã³ã§ãã refresh_token 㯠èªèšŒãµãŒãã¹ ãã access_token ãåçºè¡ããéã«å©çšããŸãã Step.4: èªèšŒçµæã®æ€èšŒ Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹*ããååŸãã ID ããŒã¯ã³ãæ€èšŒããŸããID ããŒã¯ã³ã¯åè¿°ã®éã JWT ã§è¡šçŸãããŠããã*èªèšŒãµãŒãã¹_ã®å
¬ééµãçšããŠæ€èšŒããããšãã§ããŸãã æé 㯠ãã¡ã ãã確èªãã ãããä»ã«ãåèãªã³ã¯ã玹ä»ããŠãããŸãã https://qiita.com/bobunderson/items/d48f89e2b3e6ad9f9c4c https://qiita.com/TakahikoKawasaki/items/8f0e422c7edd2d220e06 äžèšã¯ ID ããŒã¯ã³ã«å«ãŸããèªèšŒæ
å ±ã®äŸã§ãã { "iss" : "https://server.example.com" , "sub" : "24400320" , "aud" : "s6BhdRkqt3" , "exp" : 1311281970 , "iat" : 1311280970 } ãã®ãã¡ sub ã èªèšŒãµãŒãã¹ ã§ç®¡çãããŠãã ãŠãŒã¶ãŒ ã®èå¥åã§ãã iss 㯠èªèšŒãµãŒãã¹ ãaud 㯠Web ãµãŒãã¹ ã®ã¯ã©ã€ã¢ã³ã ID ã«ãªããŸãã expãiat ã¯ããããèªèšŒã®æå¹æéãšèªèšŒããã¿ã€ã ã¹ã¿ã³ãã§ãã Web ãµãŒã㹠㯠ID ããŒã¯ã³ãæ£ããå
容ã§ããããšã確èªã§ããã°ãããããã°ã€ã³ã»ãã·ã§ã³ãšçŽã¥ããŠä¿ç®¡ããŸãã 以äžã§èªèšŒåŠçã¯å®äºã§ãã ãŠãŒã¶ãŒå±æ§æ
å ±ã®ååŸ ãŠãŒã¶ãŒèªèšŒåŸã Web ãµãŒãã¹ ããŠãŒã¶ãŒåãªã©ã®ãŠãŒã¶ãŒå±æ§æ
å ±ãå¿
èŠã«ãªã£ãå ŽåãStep.3 ã§ååŸãã access_token ãå©çšã èªèšŒãµãŒãã¹ ã«å¯ŸããŠãŠãŒã¶ãŒå±æ§æ
å ±ããªã¯ãšã¹ãããŸãã GET /userinfo HTTP / 1.1 Host: server.example.com Authorization: Bearer SlAV32hkKG ãã®ãªã¯ãšã¹ãã«ãããStep.1 ã® scope ã§æå®ãããŠãŒã¶ãŒå±æ§æ
å ±ãååŸã§ããŸãã ãŸãšã 以äžå°ãé·ããªããŸãããããŠãŒã¶ãŒèªèšŒãš OpenID Connectãç¹ã«åºæ¬ã® AuthenticationCodeFlow ã«ã€ããŠè§£èª¬ããŸãããéãããçºè¡šæéã®äžã§ã®è§£èª¬ã®ããå³å¯ãããé°å²æ°ãéèŠããå
容ãšãªããŸãããããæ°ã¥ãã®ç¹ãªã©ããã°ãç¥ããããã ããã°ãšæããŸãã ãµãŒãã¹ã®èŠä»¶ããã§ãŒãºã«ãã£ãŠ OIDC ãåãå
¥ãããã©ããã¯æ§ã
ã§ããããŠãŒã¶ãŒèªèšŒã®å®è£
ãèªåã§å®è£
ãã¡ã³ããã³ã¹ããŠããã ãã§ãªããAmazon Cognito ãªã©ã®äŸ¿å©ãªèªèšŒãµãŒãã¹ãå©çšããŠããããšãéžæè¢ã®äžã€ãšããŠæ€èšããŠã¿ãŠãè¯ããããããŸããã ãããŠããã䟿å©ãªèªèšŒãµãŒãã¹ãããŸã䜿ãããªãããã«ãããã®èæ¯ã«ãã OIDC ã®ä»æ§ãææ³ãããããèªèšŒã®ä»çµã¿ã«ã€ããŠç«ã¡è¿ã£ãŠã¿ããšãçè§£ãäžæ®µãšæ·±ãŸãããšããããŸãã www.medley.jp www.medley.jp
ããã«ã¡ã¯ãéçºæ¬éšã®ãšã³ãžãã¢ã®é¶Žã§ãã ä»åã¯å
æã«è¡ã£ã瀟å
ã®ååŒ·äŒ TechLunch ã®å
容ãã玹ä»ãããŠããã ããŸãã ã€ã³ãã Web ãµãŒãã¹ã§ã¯ããŠãŒã¶ãŒã«ã¢ã«ãŠã³ããäœã£ãŠãããããã°ã€ã³ãããŠãµãŒãã¹ãå©çšããŠãããããšãããŠãŒã¶ãŒèªèšŒãå©çšãããµãŒãã¹ãå€ãããšæããŸãã Web ãµãŒãã¹ãéçºããåŽãšããŠã¯ããµãŒãã¹ããšã«éœåºŠãŠãŒã¶ãŒèªèšŒã®ä»çµã¿ãæ§ç¯ããå¿
èŠããããŸãããã»ãã¥ãªãã£å¯Ÿçã®èгç¹ããèæ
®ããããšãå€ããå°å³ã«éçºã®å·¥æ°ãããã£ãŠããŸããŸãã ãŸãæè¿ã§ã¯ã Amazon Cognito ã Firebase Authentication ã Auth0 ãªã©ããŠãŒã¶ãŒèªèšŒãµãŒãã¹ãããã€ããªãªãŒã¹ããããŠãŒã¶ãŒèªèšŒã®æ©èœããããã®å€éšãµãŒãã¹ã«ä»»ããŠéçºã®æéãçããšããéžæè¢ãåããããã«ãªã£ãŠããŠããŸãã èªåèªèº«ããã€ãŠæ
åœãããããžã§ã¯ãã§ãŠãŒã¶ãŒèªèšŒã®ä»çµã¿ã Amazon Cognito ã«ãŸãããŠã·ã¹ãã ãæ§ç¯ããããšããããŸããã ããããåœæã¯ç¹ã«ãŠãŒã¶ãŒããŒã«ã®æ©èœããªãªãŒã¹ãããŠéããªãããšããããSDK ã®åäœããµãŒãã¹ã®ä»æ§ã®çè§£ã«ããªãæéåã£ãããšãèŠããŠããŸãã ãŠãŒã¶ãŒèªèšŒãµãŒãã¹ã§ã¯ OpenID Connect ãšãã仿§ã«æºæ ããŠããããšãå€ãã®ã§ãããããããèªåã«ãšã£ãŠãã®ä»æ§ã®çè§£ãçãã ã£ãããšãåå ã®äžã€ã ã£ããšæããŸãã ããã§ä»åã¯ããŠãŒã¶ãŒèªèšŒãš OpenID Connect ã®ä»çµã¿ã«ã€ããŠæ¹ããŠå匷ãçŽããã®ã§ããã®å
容ãç°¡åã«è§£èª¬ããããŠããã ãããšæããŸãã ãŠãŒã¶ãŒèªèšŒãšã¯ ãŠãŒã¶ãŒèªèšŒã®åã«ãããããèªèšŒãšã¯ã©ãããæäœã®ããšãæãã®ã§ããããã ã¿ããªå€§å¥œã Wikipedia å
ç ã«ãããšã以äžã®ãããªèšèŒããããŸãã èªèšŒïŒã«ããããïŒãšã¯ãäœãã«ãã£ãŠãå¯Ÿè±¡ã®æ£åœæ§ã確èªããè¡çºãæãã èªèšŒè¡çºã¯èªèšŒå¯Ÿè±¡ãã£ãŠåé¡ãããèªèšŒå¯Ÿè±¡ã人éã§ããå Žåã«ã¯çžæèªèšŒïŒæ¬äººèªèšŒïŒãã¡ãã»ãŒãžã§ããå Žåã«ã¯ã¡ãã»ãŒãžèªèšŒãæå»ã®å Žåã«ã¯æå»èªèšŒãšåŒã¶ã åã«èªèšŒãšèšã£ãå Žåã«ã¯çžæèªèšŒãæãå Žåãå€ãã ãŠãŒã¶ãŒèªèšŒã¯ Web ãµãŒãã¹ã«ãšã£ãŠãªã¯ãšã¹ããéä¿¡ããŠããçžæã®æ£åœæ§ãèªèšŒããããšãªã®ã§ãçžæèªèšŒã® 1 ã€ã§ããã ããã«çžæèªèšŒã®èªèšŒæ¹æ³ãšã㊠2 éãã®æ¹æ³ããããŸãã 第 1 ã®æ¹æ³ã¯ã被èªèšŒè
ãèªèšŒè
ã«ãç§å¯éµããã£ãŠããããšã«ãã£ãŠåŸãããäœããã®èœåã®èšŒæãè¡ãæ¹æ³ã§ããã第 2 ã®æ¹æ³ã¯ã被èªèšŒè
ãèªèšŒè
ã«ã被èªèšŒè
ã®å
¬ééµã«å¯Ÿå¿ããç§å¯éµã®ç¥èã®èšŒæãè¡ãæ¹æ³ã§ããã ãŠãŒã¶ãŒèªèšŒã®å Žåãå€ãã¯ãã®ç¬¬ 1 ã®æ¹æ³ã§ã®èªèšŒã§ããã°ã€ã³æã«ãŠãŒã¶ãŒ ID ã«å ããŠããã®ãç§å¯éµããšããŠã¢ã«ãŠã³ãäœææã«ç»é²ããŠããããã¹ã¯ãŒããå
¥åããããšã§ãŠãŒã¶ãŒèªèšŒãè¡ã£ãŠããããšæããŸãã Web ãµãŒãã¹ã§ã®ãŠãŒã¶ãŒèªèšŒ Web ãµãŒãã¹ã§æ±ãæ
å ±ã®ç§å¿æ§ãé«ããªãã°ãªãã»ã©ããã®ãç§å¯éµããæ¬åœã«ãã®ãŠãŒã¶ãŒã«ããæäŸã§ããªãæ
å ±ã§ããããšãæ±ããããŸãã äžè¿°ã®ãããªãã¹ã¯ãŒãã«ããèªèšŒã®å Žåããã¹ã¯ãŒããæšæž¬ããããªã©ããŠæªæã®ãã第äžè
ã«ã¢ã«ãŠã³ããä¹ã£åãããŠããŸãäºä»¶ã¯ããè³ã«ããŸãã ããã»ãã¥ãªãã£ãé«ããããããã¹ã¯ãŒã以å€ã®èªèšŒãå€èŠçŽ èªèšŒãªã©ãçšããäºãå¢ããŠããŸããã ãŸããã»ãã¥ãªãã£ã®èгç¹ã ãã§ãªãå©äŸ¿æ§ã®èгç¹ãããããã¹ã¯ãŒãå
¥åã®ä»£ããã«æçŽèªèšŒãé¡èªèšŒã«ãããã°ã€ã³ãããããã¯åçš® SNS ã¢ã«ãŠã³ãã«ãããã°ã€ã³ãå¢ããŠããŠããŸããèªç€Ÿã®è€æ°ã®ãµãŒãã¹ã飿ºã§ãããããŠãŒã¶ãŒã«å
±é ID ãæäŸãããããšãã£ãã±ãŒã¹ããããããããŸããã æè¿ã§ã¯ãã¹ã¯ãŒãã¬ã¹èªèšŒã WebAuthn ãæ³šç®ãããŠããŸãããä»åã¯ç޹ä»ã¯å²æããŸããããã¹ã¯ãŒãã¬ã¹èªèšŒã®äžã€ã§ãã FIDO èªèšŒ ã¯ãåè¿°ã®ã被èªèšŒè
ãèªèšŒè
ã«ã被èªèšŒè
ã®å
¬ééµã«å¯Ÿå¿ããç§å¯éµã®ç¥èã®èšŒæãè¡ãæ¹æ³ããå©çšããèªèšŒæ¹åŒã®ããã§ããïŒ ref1 , ref2 ïŒ ãã®ããã«ãã»ãã¥ãªãã£ã®èгç¹ããŠãŒã¶ãŒå©äŸ¿æ§ã®èгç¹ãªã©ã«ãããWeb ãµãŒãã¹ã«ããããŠãŒã¶ãŒèªèšŒæ©èœã¯ 1 åäœã£ããçµããã§ã¯ãªããææµã«å¿ããŠé©å®æ¹ä¿®ããå¿
èŠãåºãŠããããšãããããšæããŸãã ããããç¹ã«ãŠãŒã¶ãŒèªèšŒãã¡ã€ã³ã®ãµãŒãã¹ãšå¯çµåããŠããå Žåãªã©ã§ã¯ãèªèšŒã®ååŸãªã©èªèšŒåŠçãã®ãã®ã ãã§ãªããã®åšèŸºã®åŠçãžã®åœ±é¿ç¯å²ãç¡èŠã§ããªãå ŽåãããããŠãŒã¶ãŒèªèšŒã®æ¹ä¿®ã«å·¥æ°ãæã£ãããããã£ãŠããŸã£ããã察å¿ãæ»ã£ãŠããŸãããšããããããããŸããã ãããªãšããèªèšŒãµãŒãã¹ãã¡ã€ã³ã®ãµãŒãã¹ãšåãé¢ãããšã§ããæè»ãªãŠãŒã¶ãŒèªèšŒææ®µãæäŸã§ãããããOpenID Connect ã®å°å
¥ãæ€èšããŠã¿ãŠãè¯ããããããŸããã OpenID Connect ãšã¯ OpenID Connect(以éãOIDC)ã«ã€ããŠãæ¬å®¶ãµã€ãã§ã¯ä»¥äžã®ããã«èª¬æãããŠããŸãã OpenID Connect 1.0 ã¯, OAuth 2.0 ãããã³ã«ã®äžã«ã·ã³ãã«ãªã¢ã€ãã³ãã£ãã£ã¬ã€ã€ãŒãä»äžãããã®ã§ãã. ãã®ãããã³ã«ã¯ Client ã Authorization Server ã®èªèšŒçµæã«åºã¥ã㊠End-User ã®ã¢ã€ãã³ãã£ãã£ãæ€èšŒå¯èœã«ãã. ãŸãåæã« End-User ã®å¿
èŠæäœéã®ãããã£ãŒã«æ
å ±ã, çžäºéçšå¯èœã〠RESTful ãªåœ¢ã§ååŸããããšãå¯èœã«ãã. ãã®ä»æ§ã¯, OpenID Connect ã®äž»èŠãªæ©èœã§ãã OAuth 2.0 äžã§ End-User ã®æ
å ±äŒéã®ããã«ã¯ã¬ãŒã ãçšããèªèšŒæ©èœãå®çŸ©ãã. ãã®ä»æ§ã¯ãŸã, OpenID Connect ãå©çšããããã® Security, Privacy Considerations ã説æãã. ïŒ æ¥æ¬èª , è±èª ïŒ å人çã«ã¯ãã¡ã€ã³ã®ãµãŒãã¹ãšèªèšŒãµãŒãã¹ãåãé¢ããŠéçšããããšãæ³å®ããŠä»æ§ãèŠå®ãããŠããç¹ãéèŠãšèããŸãã OIDC ãå©çšããããšã§ããŠãŒã¶ãŒèªèšŒãããæè»ã«æ¹ä¿®ãããæ°ããèªèšŒæ¹æ³ã«å¯Ÿå¿ãããããããšããããããªãããšãæåŸ
ãããããã§ãã ãªããOIDC ã®ä»æ§ã«ã¯èªèšŒææ®µèªäœïŒãã¹ã¯ãŒãèªèšŒãå€èŠçŽ èªèšŒãªã©ïŒã«é¢ããŠã¯èŠå®ãããŠãããããããŸã§èªèšŒãµãŒãã¹ã«ããèªèšŒçµæã®ååŸæ¹æ³ãæ±ãæ¹ã«ã€ããŠãèŠå®ãããŠããŸãã ãŸããæ§ã
ãªãŠãŒã¹ã±ãŒã¹ã«å¯Ÿå¿ã§ããããããã€ãã®åŠçãããŒããªãã·ã§ãã«ãªèšå®ãæäŸãããŠããŸããããã®åé¢ã»ãã¥ãªãã£ã®ç¢ºä¿ã¯å®è£
è
ã«å§ããããŠããããŠãŒã¹ã±ãŒã¹ã«å¿ããŠé©åãªå®è£
ãè¡ãå¿
èŠããããŸãã åè¿°ãããŠãŒã¶ãŒèªèšŒãµãŒãã¹ã§ãã Amazon Cognito ã FirebaseAuthentication ãªã©ã¯ãèªèšŒææ®µãæšæºã§ããã€ãæäŸãããŠãããå ããŠããã¯ãšã³ããš SDK ã« OIDC åºæã®ã»ãã¥ã¢ãªå®è£
ãæœãããŠãããããéçºè
ã¯æå°éã®èšå®ã ãã§ãŠãŒã¶ãŒèªèšŒæ©èœãå©çšã§ããããã«ãªããŸãã䟿å©ã§ããã åŠçãããŒã®è§£èª¬ ããŠãOIDC ã®å
·äœçãªåŠçã«ã€ããŠè§£èª¬ããŠããããšæããŸãã ãŸãç»å Žäººç©ã§ãã OpenID ProviderïŒOPïŒïŒèªèšŒèªå¯ãè¡ããµãŒãã¹ããŠãŒã¶ãŒèªèšŒæ
å ±ïŒèå¥åããã¹ã¯ãŒããªã©ïŒã管çããããèªèšŒã«é¢ãããŠãŒã¶ãŒå±æ§æ
å ±ïŒæ°åããŠãŒã¶ãŒåãªã©ïŒãä¿æããã RelyingPartyïŒRPïŒïŒ ã¢ã¯ã»ã¹å
ã®ãŠãŒã¶ãŒã®èªèšŒãšãŠãŒã¶ãŒå±æ§æ
å ±ãèŠæ±ãããµãŒãã¹ããŠãŒã¶ãŒããã®ãªã¯ãšã¹ãã«å¯Ÿã OP ã«ããèªèšŒçµæãä¿¡é ŒïŒrelyïŒããŠãªãœãŒã¹ãžã®ã¢ã¯ã»ã¹ãèš±å¯ããïŒäŸãã°ãã€ããŒãžã衚瀺ãããªã©ïŒã EndUserïŒãã°ã€ã³ãããŠãµãŒãã¹ãå©çšããããšããŠãããŠãŒã¶ãŒã åºæ¬çãªçšèªãå
ã«ç°¡åã«ç޹ä»ããŠãããŸãã ã¯ã©ã€ã¢ã³ã IDïŒOpenID Provider ã§ç®¡çãããRelyingParty ã®è奿
å ±ã ã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ããïŒOpenID Provider ã RelyingParty ããšã«çºè¡ããç§å¯éµã èªèšŒã³ãŒãïŒåŸè¿°ãã AuthorizationCodeFlow ã§ OpenID Provider ãçºè¡ããçåœã®ãã¹ã¯ãŒãã®ãããªãã®ã ID ããŒã¯ã³ïŒOpenID Provider ããçºè¡ãããããŠãŒã¶ãŒã«ããèªèšŒãè¡ã£ã蚌ææ
å ±ã JSON Web Token(JWT) ã§è¡šçŸãããæ€èšŒã«ããæ¹ããæ€ç¥ããããšãã§ãããèªèšŒã®å
容ïŒOpenID ProviderããŠãŒã¶ãŒèå¥åãRelyingParty ã®ã¯ã©ã€ã¢ã³ã IDãæå¹æéãªã©ïŒããŠãŒã¶ãŒå±æ§æ
å ±ãæ ŒçŽãããã ã¢ã¯ã»ã¹ããŒã¯ã³:OpenID Provider ãä¿æãããŠãŒã¶ãŒå±æ§æ
å ±ã«å¯Ÿãã¢ã¯ã»ã¹ããããã® OAuth2 ã®èªå¯ããŒã¯ã³ã OIDC ã®åŠçãããŒã¯å€§ããåã㊠3 çš®é¡ãèŠå®ãããŠããŸãã AuthorizationCodeFlowïŒèªèšŒæåæã« OpenID Provider ã RelyingParty ã«å¯ŸãèªèšŒã³ãŒããçºè¡ããRelyingParty ã¯ãããçšã㊠OpenID Provider ãã ID ããŒã¯ã³çãååŸãããRelyingParty ããµãŒããŒãµã€ãã¢ããªã±ãŒã·ã§ã³ã§ãOpenID Provider ããçºè¡ãããã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå®å
šã«ç®¡çããããšãã§ããå Žåãªã©ã«çšããããã ImplicitFlowïŒèªèšŒã³ãŒãã䜿ããèªèšŒçµæã®ã¬ã¹ãã³ã¹ã§ ID ããŒã¯ã³çãååŸãããRelyingParty ãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã®å Žåãªã©ãã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå®å
šã«ç®¡çã§ããªãå Žåãªã©ã«çšããããã HybridFlowïŒAuthorizationCodeFlow ãš ImplicitFlow ã®çµã¿åããã ãããã®ãããŒã®éãã¯ä»¥äžã®è¡šã®ãšããã§ãã ïŒ å
¬åŒããåŒçš ïŒ ä»åã¯ã å
¬åŒ ã ãã¡ãã®è§£èª¬èšäº ãªã©ãåç
§ããªãããåºæ¬ã®åŠçãããŒã§ãã AuthorizationCodeFlow ã«ã€ããŠè§£èª¬ããŸãã ç°¡ç¥åã®ãããã€ã¡ãŒãžéèŠã§ç»å Žäººç©ã¯ã ãŠãŒã¶ãŒ ããïŒãŠãŒã¶ãŒã«ãµãŒãã¹ãæäŸããïŒ Web ãµãŒãã¹ ãã èªèšŒãµãŒãã¹ ããšè¡šçŸããããšã«ããŸãã 倧ãŸãã«ã¯ä»¥äžã®ã¹ãããã§åŠçãè¡ãããŸãã ãŠãŒã¶ãŒ ããã®ã¢ã¯ã»ã¹ã«å¯Ÿãã Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ã«ãŠãŒã¶ãŒèªèšŒãèŠæ±ãã èªèšŒãµãŒãã¹ ã¯ãŠãŒã¶ãŒèªèšŒãè¡ããèªèšŒã³ãŒããçºè¡ããŠã ãŠãŒã¶ãŒ ã Web ãµãŒãã¹ ã«ãªãã€ã¬ã¯ãããã Web ãµãŒã㹠㯠2 ã§ååŸããèªèšŒã³ãŒããçšã㊠èªèšŒãµãŒãã¹ ã« ID ããŒã¯ã³çããªã¯ãšã¹ããã Web ãµãŒã㹠㯠3 ã§ååŸãã ID ããŒã¯ã³ãæ€èšŒãã ãŠãŒã¶ãŒ ã®èå¥åãååŸãã Step.0 : äºåæºå ããããã Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ããã¯ã©ã€ã¢ã³ã ID ãšã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããååŸãä¿æããŠãããŸãã Step.1: ãŠãŒã¶ãŒèªèšŒã®èŠæ± ãŠãŒã¶ãŒ ã Web ãµãŒãã¹ ã«å¯Ÿãäžè¬çãªãã°ã€ã³ã®æµãã§ãã°ã€ã³ãèŠæ±ãããšã Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ã«ãªã¯ãšã¹ãããªãã€ã¬ã¯ãããŸãã Web ãµãŒãã¹ ãã èªèšŒãµãŒãã¹ ãžã®ãªãã€ã¬ã¯ãã® URL ã¯ä»¥äžã®ãããªæãã§ãã HTTP / 1.1 302 Found Location: https://server.example.com/authorize? response_type=code & client_id = s6BhdRkqt3 & redirect_uri = https%3A%2F%2Fclient.example.org%2Fcb & scope = openid%20profile & state = af0ifjsldkj response_type ã§ OIDC ã®ã©ã®èªèšŒãããŒã䜿ãããæå®ããŸãã redirect_uri ã¯ã èªèšŒãµãŒãã¹ ã§ã®èªèšŒãæåãããšãã® Web ãµãŒãã¹ ã«ã³ãŒã«ããã¯ãã URL ã§ããããã¯äºåã«èªèšŒãµãŒãã¹ã«ç»é²ããŠããå¿
èŠããããŸãã scope ã«ã¯èªèšŒã®å
容ãèšå®ããŸããopenid ã¯å¿
é ã§ãä»ã«ã¯ OAuth2 ã®ã¢ã¯ã»ã¹ããŒã¯ã³ã䜿ã£ãŠååŸã§ãããŠãŒã¶ãŒå±æ§æ
å ±ãæå®ããŸãã scope ã§æå®ã§ãããŠãŒã¶ãŒå±æ§æ
å ±ã¯ä»¥äžã®ãšããã§ãã ïŒ å
¬åŒããåŒçš ïŒ ãŠãŒã¶ãŒã®èªèšŒã§ãã䜿ãããããªãæ°åãããã¡ãŒã«ã¢ãã¬ã¹ããªã©åºæ¬çãªå±æ§æ
å ±ãå®çŸ©ãããŠããŸãã state 㯠CSRF 察çãªã©ã®ããã®ã©ã³ãã å€ã§ããèªèšŒãããŒãéå§ãããã³ã« Web ãµãŒãã¹ ãçºè¡ãããªã¯ãšã¹ããšã³ãŒã«ããã¯ã®éã§å€ãç¶æãããŸãã ä»ã«ãããã€ãã®ãã©ã¡ãŒã¿ïŒnonce ãªã©ïŒãå®çŸ©ãããŠãããå¿
èŠã«å¿ããŠå©çšããŸãã Step.2: ãŠãŒã¶ãŒèªèšŒãšèªèšŒã³ãŒãã®çºè¡ èªèšŒãµãŒãã¹ ã§ã¯èªèšŒææ®µã«å¿ããŠãã°ã€ã³ ID ã»ãã¹ã¯ãŒãã®å
¥åãã©ãŒã ãªã©ã衚瀺ãã ãŠãŒã¶ãŒ ããèªèšŒæ
å ±ãååŸããŠèªèšŒåŠçãè¡ããŸãã èªèšŒãµãŒãã¹ ã¯ãŠãŒã¶ãŒã®èªèšŒã«æåãããšãèªèšŒã³ãŒããçºè¡ãã ãŠãŒã¶ãŒ ã Web ãµãŒãã¹ ã«ãªãã€ã¬ã¯ããããŸãã HTTP / 1.1 302 Found Location: https://client.example.org/cb? code=SplxlOBeZQQYbYS6WxSbIA & state = af0ifjsldkj ãªãã€ã¬ã¯ãå
ã«ã€ããŠã èªèšŒãµãŒã㹠㯠Step.1 ã§åãåã£ã redirect url ã èªèšŒãµãŒãã¹ ã«äºãç»é²ãããŠãã URL ãšåèŽããããšãæ€èšŒããå¿
èŠããããŸãã_Web ãµãŒãã¹ ã®ãªãããŸããé²ãããã§ãã ãŸã Web ãµãŒãã¹ åŽã§ èªèšŒãµãŒãã¹ ããã®ã¬ã¹ãã³ã¹ã§ããããšã確èªã§ãããããstate ããã©ã¡ãŒã¿ã«å«ããŸãã ãªããèªèšŒã«å€±æããå Žåã¯äžèšã®ããã«èªèšŒãšã©ãŒããå
容ããã©ã¡ãŒã¿ãŒã«å ã㊠Web ãµãŒãã¹ã«ãªãã€ã¬ã¯ããããŸãã HTTP / 1.1 302 Found Location: https://client.example.org/cb? error=invalid_request & error_description = Unsupported%20response_type%20value & state = af0ifjsldkj Step.3: èªèšŒçµæã®ååŸ Step.2 ã§ Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ããã®ãªãã€ã¬ã¯ããåããèªèšŒã³ãŒããååŸãããšããã®èªèšŒã³ãŒããå©çšã㊠èªèšŒãµãŒãã¹ ã«å¯ŸããŠèªèšŒçµææ
å ±ïŒID ããŒã¯ã³ãªã©ïŒãååŸããŸãã Web ãµãŒãã¹ ãã èªèšŒãµãŒãã¹ ãžã®èªèšŒçµæååŸãªã¯ãšã¹ãã¯ä»¥äžã®ãããªåœ¢åŒã«ãªããŸãã POST /token HTTP / 1.1 Host: server.example.com Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW Content-Type: application/x-www-form-urlencoded grant_type=authorization_code&code=SplxlOBeZQQYbYS6WxSbIA & redirect_uri = https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb èªèšŒã³ãŒããéä¿¡ããå¿
èŠããããããPOST ã¡ãœããã§ãªã¯ãšã¹ãããŸãããŸãã¯ã©ã€ã¢ã³ã ID ãšã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ããã«ãã BASIC èªèšŒãè¡ããŸãã ãã®ãªã¯ãšã¹ãã§ã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå¿
èŠã«ãªãã®ã§ããããã㯠èªèšŒãµãŒãã¹ ã«ãšã£ãŠ Web ãµãŒãã¹ ã®æ£åœæ§ãæ€èšŒããããã®éèŠãªãã©ã¡ãŒã¿ã§ãããå®å
šã«ç®¡çãããå¿
èŠããããŸãã SinglePageApplication ã®ããã«ãŠãŒã¶ãŒåŽã«ããã¢ããªã±ãŒã·ã§ã³ã§ OIDC ãåŠçããå Žåã«ã¯ããã®ã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå®å
šã«ç®¡çãããä¿èšŒããªããããAuthenticationCodeFlow ã§ã¯ãªã ImplicitFlow ãªã©ãå©çšããå¿
èŠããããŸãã Web ãµãŒãã¹ ããã®ãªã¯ãšã¹ããåãåã£ã èªèšŒãµãŒã㹠㯠grant_type ã« Step.1 ã§æå®ããåŠçãããŒã«è©²åœããæ
å ±ãæž¡ããèªèšŒã³ãŒãïŒ code ïŒãšåãã㊠èªèšŒãµãŒãã¹ ã«ãªã¯ãšã¹ãã®æ€èšŒããããŸãã èªèšŒãµãŒãã¹ ã¯ãªã¯ãšã¹ãã®æ€èšŒã«æåãããšã Web ãµãŒãã¹ ã«å¯ŸãèªèšŒçµæãšã㊠ID ããŒã¯ã³çãè¿åŽããŸãã HTTP / 1.1 200 OK Content-Type: application/json Cache-Control: no-cache, no-store Pragma: no-cache { "access_token" : "SlAV32hkKG" , "token_type" : "Bearer" , "expires_in" : 3600 , "refresh_token" : "tGzv3JOkF0XG5Qx2TlKWIA" , "id_token" : "eyJ0 ... NiJ9.eyJ1c ... I6IjIifX0.DeWt4Qu ... ZXso" } access_token 㯠èªèšŒãµãŒãã¹ ã§ç®¡çããŠãããŠãŒã¶ãŒå±æ§æ
å ±ãååŸããããã® OAuth2 ããŒã¯ã³ã§ãã refresh_token 㯠èªèšŒãµãŒãã¹ ãã access_token ãåçºè¡ããéã«å©çšããŸãã Step.4: èªèšŒçµæã®æ€èšŒ Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹*ããååŸãã ID ããŒã¯ã³ãæ€èšŒããŸããID ããŒã¯ã³ã¯åè¿°ã®éã JWT ã§è¡šçŸãããŠããã*èªèšŒãµãŒãã¹_ã®å
¬ééµãçšããŠæ€èšŒããããšãã§ããŸãã æé 㯠ãã¡ã ãã確èªãã ãããä»ã«ãåèãªã³ã¯ã玹ä»ããŠãããŸãã https://qiita.com/bobunderson/items/d48f89e2b3e6ad9f9c4c https://qiita.com/TakahikoKawasaki/items/8f0e422c7edd2d220e06 äžèšã¯ ID ããŒã¯ã³ã«å«ãŸããèªèšŒæ
å ±ã®äŸã§ãã { "iss" : "https://server.example.com" , "sub" : "24400320" , "aud" : "s6BhdRkqt3" , "exp" : 1311281970 , "iat" : 1311280970 } ãã®ãã¡ sub ã èªèšŒãµãŒãã¹ ã§ç®¡çãããŠãã ãŠãŒã¶ãŒ ã®èå¥åã§ãã iss 㯠èªèšŒãµãŒãã¹ ãaud 㯠Web ãµãŒãã¹ ã®ã¯ã©ã€ã¢ã³ã ID ã«ãªããŸãã expãiat ã¯ããããèªèšŒã®æå¹æéãšèªèšŒããã¿ã€ã ã¹ã¿ã³ãã§ãã Web ãµãŒã㹠㯠ID ããŒã¯ã³ãæ£ããå
容ã§ããããšã確èªã§ããã°ãããããã°ã€ã³ã»ãã·ã§ã³ãšçŽã¥ããŠä¿ç®¡ããŸãã 以äžã§èªèšŒåŠçã¯å®äºã§ãã ãŠãŒã¶ãŒå±æ§æ
å ±ã®ååŸ ãŠãŒã¶ãŒèªèšŒåŸã Web ãµãŒãã¹ ããŠãŒã¶ãŒåãªã©ã®ãŠãŒã¶ãŒå±æ§æ
å ±ãå¿
èŠã«ãªã£ãå ŽåãStep.3 ã§ååŸãã access_token ãå©çšã èªèšŒãµãŒãã¹ ã«å¯ŸããŠãŠãŒã¶ãŒå±æ§æ
å ±ããªã¯ãšã¹ãããŸãã GET /userinfo HTTP / 1.1 Host: server.example.com Authorization: Bearer SlAV32hkKG ãã®ãªã¯ãšã¹ãã«ãããStep.1 ã® scope ã§æå®ãããŠãŒã¶ãŒå±æ§æ
å ±ãååŸã§ããŸãã ãŸãšã 以äžå°ãé·ããªããŸãããããŠãŒã¶ãŒèªèšŒãš OpenID Connectãç¹ã«åºæ¬ã® AuthenticationCodeFlow ã«ã€ããŠè§£èª¬ããŸãããéãããçºè¡šæéã®äžã§ã®è§£èª¬ã®ããå³å¯ãããé°å²æ°ãéèŠããå
容ãšãªããŸãããããæ°ã¥ãã®ç¹ãªã©ããã°ãç¥ããããã ããã°ãšæããŸãã ãµãŒãã¹ã®èŠä»¶ããã§ãŒãºã«ãã£ãŠ OIDC ãåãå
¥ãããã©ããã¯æ§ã
ã§ããããŠãŒã¶ãŒèªèšŒã®å®è£
ãèªåã§å®è£
ãã¡ã³ããã³ã¹ããŠããã ãã§ãªããAmazon Cognito ãªã©ã®äŸ¿å©ãªèªèšŒãµãŒãã¹ãå©çšããŠããããšãéžæè¢ã®äžã€ãšããŠæ€èšããŠã¿ãŠãè¯ããããããŸããã ãããŠããã䟿å©ãªèªèšŒãµãŒãã¹ãããŸã䜿ãããªãããã«ãããã®èæ¯ã«ãã OIDC ã®ä»æ§ãææ³ãããããèªèšŒã®ä»çµã¿ã«ã€ããŠç«ã¡è¿ã£ãŠã¿ããšãçè§£ãäžæ®µãšæ·±ãŸãããšããããŸãã www.medley.jp www.medley.jp
ããã«ã¡ã¯ãéçºæ¬éšã®ãšã³ãžãã¢ã®é¶Žã§ãã ä»åã¯å
æã«è¡ã£ã瀟å
ã®ååŒ·äŒ TechLunch ã®å
容ãã玹ä»ãããŠããã ããŸãã ã€ã³ãã Web ãµãŒãã¹ã§ã¯ããŠãŒã¶ãŒã«ã¢ã«ãŠã³ããäœã£ãŠãããããã°ã€ã³ãããŠãµãŒãã¹ãå©çšããŠãããããšãããŠãŒã¶ãŒèªèšŒãå©çšãããµãŒãã¹ãå€ãããšæããŸãã Web ãµãŒãã¹ãéçºããåŽãšããŠã¯ããµãŒãã¹ããšã«éœåºŠãŠãŒã¶ãŒèªèšŒã®ä»çµã¿ãæ§ç¯ããå¿
èŠããããŸãããã»ãã¥ãªãã£å¯Ÿçã®èгç¹ããèæ
®ããããšãå€ããå°å³ã«éçºã®å·¥æ°ãããã£ãŠããŸããŸãã ãŸãæè¿ã§ã¯ã Amazon Cognito ã Firebase Authentication ã Auth0 ãªã©ããŠãŒã¶ãŒèªèšŒãµãŒãã¹ãããã€ããªãªãŒã¹ããããŠãŒã¶ãŒèªèšŒã®æ©èœããããã®å€éšãµãŒãã¹ã«ä»»ããŠéçºã®æéãçããšããéžæè¢ãåããããã«ãªã£ãŠããŠããŸãã èªåèªèº«ããã€ãŠæ
åœãããããžã§ã¯ãã§ãŠãŒã¶ãŒèªèšŒã®ä»çµã¿ã Amazon Cognito ã«ãŸãããŠã·ã¹ãã ãæ§ç¯ããããšããããŸããã ããããåœæã¯ç¹ã«ãŠãŒã¶ãŒããŒã«ã®æ©èœããªãªãŒã¹ãããŠéããªãããšããããSDK ã®åäœããµãŒãã¹ã®ä»æ§ã®çè§£ã«ããªãæéåã£ãããšãèŠããŠããŸãã ãŠãŒã¶ãŒèªèšŒãµãŒãã¹ã§ã¯ OpenID Connect ãšãã仿§ã«æºæ ããŠããããšãå€ãã®ã§ãããããããèªåã«ãšã£ãŠãã®ä»æ§ã®çè§£ãçãã ã£ãããšãåå ã®äžã€ã ã£ããšæããŸãã ããã§ä»åã¯ããŠãŒã¶ãŒèªèšŒãš OpenID Connect ã®ä»çµã¿ã«ã€ããŠæ¹ããŠå匷ãçŽããã®ã§ããã®å
容ãç°¡åã«è§£èª¬ããããŠããã ãããšæããŸãã ãŠãŒã¶ãŒèªèšŒãšã¯ ãŠãŒã¶ãŒèªèšŒã®åã«ãããããèªèšŒãšã¯ã©ãããæäœã®ããšãæãã®ã§ããããã ã¿ããªå€§å¥œã Wikipedia å
ç ã«ãããšã以äžã®ãããªèšèŒããããŸãã èªèšŒïŒã«ããããïŒãšã¯ãäœãã«ãã£ãŠãå¯Ÿè±¡ã®æ£åœæ§ã確èªããè¡çºãæãã èªèšŒè¡çºã¯èªèšŒå¯Ÿè±¡ãã£ãŠåé¡ãããèªèšŒå¯Ÿè±¡ã人éã§ããå Žåã«ã¯çžæèªèšŒïŒæ¬äººèªèšŒïŒãã¡ãã»ãŒãžã§ããå Žåã«ã¯ã¡ãã»ãŒãžèªèšŒãæå»ã®å Žåã«ã¯æå»èªèšŒãšåŒã¶ã åã«èªèšŒãšèšã£ãå Žåã«ã¯çžæèªèšŒãæãå Žåãå€ãã ãŠãŒã¶ãŒèªèšŒã¯ Web ãµãŒãã¹ã«ãšã£ãŠãªã¯ãšã¹ããéä¿¡ããŠããçžæã®æ£åœæ§ãèªèšŒããããšãªã®ã§ãçžæèªèšŒã® 1 ã€ã§ããã ããã«çžæèªèšŒã®èªèšŒæ¹æ³ãšã㊠2 éãã®æ¹æ³ããããŸãã 第 1 ã®æ¹æ³ã¯ã被èªèšŒè
ãèªèšŒè
ã«ãç§å¯éµããã£ãŠããããšã«ãã£ãŠåŸãããäœããã®èœåã®èšŒæãè¡ãæ¹æ³ã§ããã第 2 ã®æ¹æ³ã¯ã被èªèšŒè
ãèªèšŒè
ã«ã被èªèšŒè
ã®å
¬ééµã«å¯Ÿå¿ããç§å¯éµã®ç¥èã®èšŒæãè¡ãæ¹æ³ã§ããã ãŠãŒã¶ãŒèªèšŒã®å Žåãå€ãã¯ãã®ç¬¬ 1 ã®æ¹æ³ã§ã®èªèšŒã§ããã°ã€ã³æã«ãŠãŒã¶ãŒ ID ã«å ããŠããã®ãç§å¯éµããšããŠã¢ã«ãŠã³ãäœææã«ç»é²ããŠããããã¹ã¯ãŒããå
¥åããããšã§ãŠãŒã¶ãŒèªèšŒãè¡ã£ãŠããããšæããŸãã Web ãµãŒãã¹ã§ã®ãŠãŒã¶ãŒèªèšŒ Web ãµãŒãã¹ã§æ±ãæ
å ±ã®ç§å¿æ§ãé«ããªãã°ãªãã»ã©ããã®ãç§å¯éµããæ¬åœã«ãã®ãŠãŒã¶ãŒã«ããæäŸã§ããªãæ
å ±ã§ããããšãæ±ããããŸãã äžè¿°ã®ãããªãã¹ã¯ãŒãã«ããèªèšŒã®å Žåããã¹ã¯ãŒããæšæž¬ããããªã©ããŠæªæã®ãã第äžè
ã«ã¢ã«ãŠã³ããä¹ã£åãããŠããŸãäºä»¶ã¯ããè³ã«ããŸãã ããã»ãã¥ãªãã£ãé«ããããããã¹ã¯ãŒã以å€ã®èªèšŒãå€èŠçŽ èªèšŒãªã©ãçšããäºãå¢ããŠããŸããã ãŸããã»ãã¥ãªãã£ã®èгç¹ã ãã§ãªãå©äŸ¿æ§ã®èгç¹ãããããã¹ã¯ãŒãå
¥åã®ä»£ããã«æçŽèªèšŒãé¡èªèšŒã«ãããã°ã€ã³ãããããã¯åçš® SNS ã¢ã«ãŠã³ãã«ãããã°ã€ã³ãå¢ããŠããŠããŸããèªç€Ÿã®è€æ°ã®ãµãŒãã¹ã飿ºã§ãããããŠãŒã¶ãŒã«å
±é ID ãæäŸãããããšãã£ãã±ãŒã¹ããããããããŸããã æè¿ã§ã¯ãã¹ã¯ãŒãã¬ã¹èªèšŒã WebAuthn ãæ³šç®ãããŠããŸãããä»åã¯ç޹ä»ã¯å²æããŸããããã¹ã¯ãŒãã¬ã¹èªèšŒã®äžã€ã§ãã FIDO èªèšŒ ã¯ãåè¿°ã®ã被èªèšŒè
ãèªèšŒè
ã«ã被èªèšŒè
ã®å
¬ééµã«å¯Ÿå¿ããç§å¯éµã®ç¥èã®èšŒæãè¡ãæ¹æ³ããå©çšããèªèšŒæ¹åŒã®ããã§ããïŒ ref1 , ref2 ïŒ ãã®ããã«ãã»ãã¥ãªãã£ã®èгç¹ããŠãŒã¶ãŒå©äŸ¿æ§ã®èгç¹ãªã©ã«ãããWeb ãµãŒãã¹ã«ããããŠãŒã¶ãŒèªèšŒæ©èœã¯ 1 åäœã£ããçµããã§ã¯ãªããææµã«å¿ããŠé©å®æ¹ä¿®ããå¿
èŠãåºãŠããããšãããããšæããŸãã ããããç¹ã«ãŠãŒã¶ãŒèªèšŒãã¡ã€ã³ã®ãµãŒãã¹ãšå¯çµåããŠããå Žåãªã©ã§ã¯ãèªèšŒã®ååŸãªã©èªèšŒåŠçãã®ãã®ã ãã§ãªããã®åšèŸºã®åŠçãžã®åœ±é¿ç¯å²ãç¡èŠã§ããªãå ŽåãããããŠãŒã¶ãŒèªèšŒã®æ¹ä¿®ã«å·¥æ°ãæã£ãããããã£ãŠããŸã£ããã察å¿ãæ»ã£ãŠããŸãããšããããããããŸããã ãããªãšããèªèšŒãµãŒãã¹ãã¡ã€ã³ã®ãµãŒãã¹ãšåãé¢ãããšã§ããæè»ãªãŠãŒã¶ãŒèªèšŒææ®µãæäŸã§ãããããOpenID Connect ã®å°å
¥ãæ€èšããŠã¿ãŠãè¯ããããããŸããã OpenID Connect ãšã¯ OpenID Connect(以éãOIDC)ã«ã€ããŠãæ¬å®¶ãµã€ãã§ã¯ä»¥äžã®ããã«èª¬æãããŠããŸãã OpenID Connect 1.0 ã¯, OAuth 2.0 ãããã³ã«ã®äžã«ã·ã³ãã«ãªã¢ã€ãã³ãã£ãã£ã¬ã€ã€ãŒãä»äžãããã®ã§ãã. ãã®ãããã³ã«ã¯ Client ã Authorization Server ã®èªèšŒçµæã«åºã¥ã㊠End-User ã®ã¢ã€ãã³ãã£ãã£ãæ€èšŒå¯èœã«ãã. ãŸãåæã« End-User ã®å¿
èŠæäœéã®ãããã£ãŒã«æ
å ±ã, çžäºéçšå¯èœã〠RESTful ãªåœ¢ã§ååŸããããšãå¯èœã«ãã. ãã®ä»æ§ã¯, OpenID Connect ã®äž»èŠãªæ©èœã§ãã OAuth 2.0 äžã§ End-User ã®æ
å ±äŒéã®ããã«ã¯ã¬ãŒã ãçšããèªèšŒæ©èœãå®çŸ©ãã. ãã®ä»æ§ã¯ãŸã, OpenID Connect ãå©çšããããã® Security, Privacy Considerations ã説æãã. ïŒ æ¥æ¬èª , è±èª ïŒ å人çã«ã¯ãã¡ã€ã³ã®ãµãŒãã¹ãšèªèšŒãµãŒãã¹ãåãé¢ããŠéçšããããšãæ³å®ããŠä»æ§ãèŠå®ãããŠããç¹ãéèŠãšèããŸãã OIDC ãå©çšããããšã§ããŠãŒã¶ãŒèªèšŒãããæè»ã«æ¹ä¿®ãããæ°ããèªèšŒæ¹æ³ã«å¯Ÿå¿ãããããããšããããããªãããšãæåŸ
ãããããã§ãã ãªããOIDC ã®ä»æ§ã«ã¯èªèšŒææ®µèªäœïŒãã¹ã¯ãŒãèªèšŒãå€èŠçŽ èªèšŒãªã©ïŒã«é¢ããŠã¯èŠå®ãããŠãããããããŸã§èªèšŒãµãŒãã¹ã«ããèªèšŒçµæã®ååŸæ¹æ³ãæ±ãæ¹ã«ã€ããŠãèŠå®ãããŠããŸãã ãŸããæ§ã
ãªãŠãŒã¹ã±ãŒã¹ã«å¯Ÿå¿ã§ããããããã€ãã®åŠçãããŒããªãã·ã§ãã«ãªèšå®ãæäŸãããŠããŸããããã®åé¢ã»ãã¥ãªãã£ã®ç¢ºä¿ã¯å®è£
è
ã«å§ããããŠããããŠãŒã¹ã±ãŒã¹ã«å¿ããŠé©åãªå®è£
ãè¡ãå¿
èŠããããŸãã åè¿°ãããŠãŒã¶ãŒèªèšŒãµãŒãã¹ã§ãã Amazon Cognito ã FirebaseAuthentication ãªã©ã¯ãèªèšŒææ®µãæšæºã§ããã€ãæäŸãããŠãããå ããŠããã¯ãšã³ããš SDK ã« OIDC åºæã®ã»ãã¥ã¢ãªå®è£
ãæœãããŠãããããéçºè
ã¯æå°éã®èšå®ã ãã§ãŠãŒã¶ãŒèªèšŒæ©èœãå©çšã§ããããã«ãªããŸãã䟿å©ã§ããã åŠçãããŒã®è§£èª¬ ããŠãOIDC ã®å
·äœçãªåŠçã«ã€ããŠè§£èª¬ããŠããããšæããŸãã ãŸãç»å Žäººç©ã§ãã OpenID ProviderïŒOPïŒïŒèªèšŒèªå¯ãè¡ããµãŒãã¹ããŠãŒã¶ãŒèªèšŒæ
å ±ïŒèå¥åããã¹ã¯ãŒããªã©ïŒã管çããããèªèšŒã«é¢ãããŠãŒã¶ãŒå±æ§æ
å ±ïŒæ°åããŠãŒã¶ãŒåãªã©ïŒãä¿æããã RelyingPartyïŒRPïŒïŒ ã¢ã¯ã»ã¹å
ã®ãŠãŒã¶ãŒã®èªèšŒãšãŠãŒã¶ãŒå±æ§æ
å ±ãèŠæ±ãããµãŒãã¹ããŠãŒã¶ãŒããã®ãªã¯ãšã¹ãã«å¯Ÿã OP ã«ããèªèšŒçµæãä¿¡é ŒïŒrelyïŒããŠãªãœãŒã¹ãžã®ã¢ã¯ã»ã¹ãèš±å¯ããïŒäŸãã°ãã€ããŒãžã衚瀺ãããªã©ïŒã EndUserïŒãã°ã€ã³ãããŠãµãŒãã¹ãå©çšããããšããŠãããŠãŒã¶ãŒã åºæ¬çãªçšèªãå
ã«ç°¡åã«ç޹ä»ããŠãããŸãã ã¯ã©ã€ã¢ã³ã IDïŒOpenID Provider ã§ç®¡çãããRelyingParty ã®è奿
å ±ã ã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ããïŒOpenID Provider ã RelyingParty ããšã«çºè¡ããç§å¯éµã èªèšŒã³ãŒãïŒåŸè¿°ãã AuthorizationCodeFlow ã§ OpenID Provider ãçºè¡ããçåœã®ãã¹ã¯ãŒãã®ãããªãã®ã ID ããŒã¯ã³ïŒOpenID Provider ããçºè¡ãããããŠãŒã¶ãŒã«ããèªèšŒãè¡ã£ã蚌ææ
å ±ã JSON Web Token(JWT) ã§è¡šçŸãããæ€èšŒã«ããæ¹ããæ€ç¥ããããšãã§ãããèªèšŒã®å
容ïŒOpenID ProviderããŠãŒã¶ãŒèå¥åãRelyingParty ã®ã¯ã©ã€ã¢ã³ã IDãæå¹æéãªã©ïŒããŠãŒã¶ãŒå±æ§æ
å ±ãæ ŒçŽãããã ã¢ã¯ã»ã¹ããŒã¯ã³:OpenID Provider ãä¿æãããŠãŒã¶ãŒå±æ§æ
å ±ã«å¯Ÿãã¢ã¯ã»ã¹ããããã® OAuth2 ã®èªå¯ããŒã¯ã³ã OIDC ã®åŠçãããŒã¯å€§ããåã㊠3 çš®é¡ãèŠå®ãããŠããŸãã AuthorizationCodeFlowïŒèªèšŒæåæã« OpenID Provider ã RelyingParty ã«å¯ŸãèªèšŒã³ãŒããçºè¡ããRelyingParty ã¯ãããçšã㊠OpenID Provider ãã ID ããŒã¯ã³çãååŸãããRelyingParty ããµãŒããŒãµã€ãã¢ããªã±ãŒã·ã§ã³ã§ãOpenID Provider ããçºè¡ãããã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå®å
šã«ç®¡çããããšãã§ããå Žåãªã©ã«çšããããã ImplicitFlowïŒèªèšŒã³ãŒãã䜿ããèªèšŒçµæã®ã¬ã¹ãã³ã¹ã§ ID ããŒã¯ã³çãååŸãããRelyingParty ãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã®å Žåãªã©ãã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå®å
šã«ç®¡çã§ããªãå Žåãªã©ã«çšããããã HybridFlowïŒAuthorizationCodeFlow ãš ImplicitFlow ã®çµã¿åããã ãããã®ãããŒã®éãã¯ä»¥äžã®è¡šã®ãšããã§ãã ïŒ å
¬åŒããåŒçš ïŒ ä»åã¯ã å
¬åŒ ã ãã¡ãã®è§£èª¬èšäº ãªã©ãåç
§ããªãããåºæ¬ã®åŠçãããŒã§ãã AuthorizationCodeFlow ã«ã€ããŠè§£èª¬ããŸãã ç°¡ç¥åã®ãããã€ã¡ãŒãžéèŠã§ç»å Žäººç©ã¯ã ãŠãŒã¶ãŒ ããïŒãŠãŒã¶ãŒã«ãµãŒãã¹ãæäŸããïŒ Web ãµãŒãã¹ ãã èªèšŒãµãŒãã¹ ããšè¡šçŸããããšã«ããŸãã 倧ãŸãã«ã¯ä»¥äžã®ã¹ãããã§åŠçãè¡ãããŸãã ãŠãŒã¶ãŒ ããã®ã¢ã¯ã»ã¹ã«å¯Ÿãã Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ã«ãŠãŒã¶ãŒèªèšŒãèŠæ±ãã èªèšŒãµãŒãã¹ ã¯ãŠãŒã¶ãŒèªèšŒãè¡ããèªèšŒã³ãŒããçºè¡ããŠã ãŠãŒã¶ãŒ ã Web ãµãŒãã¹ ã«ãªãã€ã¬ã¯ãããã Web ãµãŒã㹠㯠2 ã§ååŸããèªèšŒã³ãŒããçšã㊠èªèšŒãµãŒãã¹ ã« ID ããŒã¯ã³çããªã¯ãšã¹ããã Web ãµãŒã㹠㯠3 ã§ååŸãã ID ããŒã¯ã³ãæ€èšŒãã ãŠãŒã¶ãŒ ã®èå¥åãååŸãã Step.0 : äºåæºå ããããã Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ããã¯ã©ã€ã¢ã³ã ID ãšã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããååŸãä¿æããŠãããŸãã Step.1: ãŠãŒã¶ãŒèªèšŒã®èŠæ± ãŠãŒã¶ãŒ ã Web ãµãŒãã¹ ã«å¯Ÿãäžè¬çãªãã°ã€ã³ã®æµãã§ãã°ã€ã³ãèŠæ±ãããšã Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ã«ãªã¯ãšã¹ãããªãã€ã¬ã¯ãããŸãã Web ãµãŒãã¹ ãã èªèšŒãµãŒãã¹ ãžã®ãªãã€ã¬ã¯ãã® URL ã¯ä»¥äžã®ãããªæãã§ãã HTTP / 1.1 302 Found Location: https://server.example.com/authorize? response_type=code & client_id = s6BhdRkqt3 & redirect_uri = https%3A%2F%2Fclient.example.org%2Fcb & scope = openid%20profile & state = af0ifjsldkj response_type ã§ OIDC ã®ã©ã®èªèšŒãããŒã䜿ãããæå®ããŸãã redirect_uri ã¯ã èªèšŒãµãŒãã¹ ã§ã®èªèšŒãæåãããšãã® Web ãµãŒãã¹ ã«ã³ãŒã«ããã¯ãã URL ã§ããããã¯äºåã«èªèšŒãµãŒãã¹ã«ç»é²ããŠããå¿
èŠããããŸãã scope ã«ã¯èªèšŒã®å
容ãèšå®ããŸããopenid ã¯å¿
é ã§ãä»ã«ã¯ OAuth2 ã®ã¢ã¯ã»ã¹ããŒã¯ã³ã䜿ã£ãŠååŸã§ãããŠãŒã¶ãŒå±æ§æ
å ±ãæå®ããŸãã scope ã§æå®ã§ãããŠãŒã¶ãŒå±æ§æ
å ±ã¯ä»¥äžã®ãšããã§ãã ïŒ å
¬åŒããåŒçš ïŒ ãŠãŒã¶ãŒã®èªèšŒã§ãã䜿ãããããªãæ°åãããã¡ãŒã«ã¢ãã¬ã¹ããªã©åºæ¬çãªå±æ§æ
å ±ãå®çŸ©ãããŠããŸãã state 㯠CSRF 察çãªã©ã®ããã®ã©ã³ãã å€ã§ããèªèšŒãããŒãéå§ãããã³ã« Web ãµãŒãã¹ ãçºè¡ãããªã¯ãšã¹ããšã³ãŒã«ããã¯ã®éã§å€ãç¶æãããŸãã ä»ã«ãããã€ãã®ãã©ã¡ãŒã¿ïŒnonce ãªã©ïŒãå®çŸ©ãããŠãããå¿
èŠã«å¿ããŠå©çšããŸãã Step.2: ãŠãŒã¶ãŒèªèšŒãšèªèšŒã³ãŒãã®çºè¡ èªèšŒãµãŒãã¹ ã§ã¯èªèšŒææ®µã«å¿ããŠãã°ã€ã³ ID ã»ãã¹ã¯ãŒãã®å
¥åãã©ãŒã ãªã©ã衚瀺ãã ãŠãŒã¶ãŒ ããèªèšŒæ
å ±ãååŸããŠèªèšŒåŠçãè¡ããŸãã èªèšŒãµãŒãã¹ ã¯ãŠãŒã¶ãŒã®èªèšŒã«æåãããšãèªèšŒã³ãŒããçºè¡ãã ãŠãŒã¶ãŒ ã Web ãµãŒãã¹ ã«ãªãã€ã¬ã¯ããããŸãã HTTP / 1.1 302 Found Location: https://client.example.org/cb? code=SplxlOBeZQQYbYS6WxSbIA & state = af0ifjsldkj ãªãã€ã¬ã¯ãå
ã«ã€ããŠã èªèšŒãµãŒã㹠㯠Step.1 ã§åãåã£ã redirect url ã èªèšŒãµãŒãã¹ ã«äºãç»é²ãããŠãã URL ãšåèŽããããšãæ€èšŒããå¿
èŠããããŸãã_Web ãµãŒãã¹ ã®ãªãããŸããé²ãããã§ãã ãŸã Web ãµãŒãã¹ åŽã§ èªèšŒãµãŒãã¹ ããã®ã¬ã¹ãã³ã¹ã§ããããšã確èªã§ãããããstate ããã©ã¡ãŒã¿ã«å«ããŸãã ãªããèªèšŒã«å€±æããå Žåã¯äžèšã®ããã«èªèšŒãšã©ãŒããå
容ããã©ã¡ãŒã¿ãŒã«å ã㊠Web ãµãŒãã¹ã«ãªãã€ã¬ã¯ããããŸãã HTTP / 1.1 302 Found Location: https://client.example.org/cb? error=invalid_request & error_description = Unsupported%20response_type%20value & state = af0ifjsldkj Step.3: èªèšŒçµæã®ååŸ Step.2 ã§ Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ããã®ãªãã€ã¬ã¯ããåããèªèšŒã³ãŒããååŸãããšããã®èªèšŒã³ãŒããå©çšã㊠èªèšŒãµãŒãã¹ ã«å¯ŸããŠèªèšŒçµææ
å ±ïŒID ããŒã¯ã³ãªã©ïŒãååŸããŸãã Web ãµãŒãã¹ ãã èªèšŒãµãŒãã¹ ãžã®èªèšŒçµæååŸãªã¯ãšã¹ãã¯ä»¥äžã®ãããªåœ¢åŒã«ãªããŸãã POST /token HTTP / 1.1 Host: server.example.com Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW Content-Type: application/x-www-form-urlencoded grant_type=authorization_code&code=SplxlOBeZQQYbYS6WxSbIA & redirect_uri = https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb èªèšŒã³ãŒããéä¿¡ããå¿
èŠããããããPOST ã¡ãœããã§ãªã¯ãšã¹ãããŸãããŸãã¯ã©ã€ã¢ã³ã ID ãšã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ããã«ãã BASIC èªèšŒãè¡ããŸãã ãã®ãªã¯ãšã¹ãã§ã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå¿
èŠã«ãªãã®ã§ããããã㯠èªèšŒãµãŒãã¹ ã«ãšã£ãŠ Web ãµãŒãã¹ ã®æ£åœæ§ãæ€èšŒããããã®éèŠãªãã©ã¡ãŒã¿ã§ãããå®å
šã«ç®¡çãããå¿
èŠããããŸãã SinglePageApplication ã®ããã«ãŠãŒã¶ãŒåŽã«ããã¢ããªã±ãŒã·ã§ã³ã§ OIDC ãåŠçããå Žåã«ã¯ããã®ã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå®å
šã«ç®¡çãããä¿èšŒããªããããAuthenticationCodeFlow ã§ã¯ãªã ImplicitFlow ãªã©ãå©çšããå¿
èŠããããŸãã Web ãµãŒãã¹ ããã®ãªã¯ãšã¹ããåãåã£ã èªèšŒãµãŒã㹠㯠grant_type ã« Step.1 ã§æå®ããåŠçãããŒã«è©²åœããæ
å ±ãæž¡ããèªèšŒã³ãŒãïŒ code ïŒãšåãã㊠èªèšŒãµãŒãã¹ ã«ãªã¯ãšã¹ãã®æ€èšŒããããŸãã èªèšŒãµãŒãã¹ ã¯ãªã¯ãšã¹ãã®æ€èšŒã«æåãããšã Web ãµãŒãã¹ ã«å¯ŸãèªèšŒçµæãšã㊠ID ããŒã¯ã³çãè¿åŽããŸãã HTTP / 1.1 200 OK Content-Type: application/json Cache-Control: no-cache, no-store Pragma: no-cache { "access_token" : "SlAV32hkKG" , "token_type" : "Bearer" , "expires_in" : 3600 , "refresh_token" : "tGzv3JOkF0XG5Qx2TlKWIA" , "id_token" : "eyJ0 ... NiJ9.eyJ1c ... I6IjIifX0.DeWt4Qu ... ZXso" } access_token 㯠èªèšŒãµãŒãã¹ ã§ç®¡çããŠãããŠãŒã¶ãŒå±æ§æ
å ±ãååŸããããã® OAuth2 ããŒã¯ã³ã§ãã refresh_token 㯠èªèšŒãµãŒãã¹ ãã access_token ãåçºè¡ããéã«å©çšããŸãã Step.4: èªèšŒçµæã®æ€èšŒ Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹*ããååŸãã ID ããŒã¯ã³ãæ€èšŒããŸããID ããŒã¯ã³ã¯åè¿°ã®éã JWT ã§è¡šçŸãããŠããã*èªèšŒãµãŒãã¹_ã®å
¬ééµãçšããŠæ€èšŒããããšãã§ããŸãã æé 㯠ãã¡ã ãã確èªãã ãããä»ã«ãåèãªã³ã¯ã玹ä»ããŠãããŸãã https://qiita.com/bobunderson/items/d48f89e2b3e6ad9f9c4c https://qiita.com/TakahikoKawasaki/items/8f0e422c7edd2d220e06 äžèšã¯ ID ããŒã¯ã³ã«å«ãŸããèªèšŒæ
å ±ã®äŸã§ãã { "iss" : "https://server.example.com" , "sub" : "24400320" , "aud" : "s6BhdRkqt3" , "exp" : 1311281970 , "iat" : 1311280970 } ãã®ãã¡ sub ã èªèšŒãµãŒãã¹ ã§ç®¡çãããŠãã ãŠãŒã¶ãŒ ã®èå¥åã§ãã iss 㯠èªèšŒãµãŒãã¹ ãaud 㯠Web ãµãŒãã¹ ã®ã¯ã©ã€ã¢ã³ã ID ã«ãªããŸãã expãiat ã¯ããããèªèšŒã®æå¹æéãšèªèšŒããã¿ã€ã ã¹ã¿ã³ãã§ãã Web ãµãŒã㹠㯠ID ããŒã¯ã³ãæ£ããå
容ã§ããããšã確èªã§ããã°ãããããã°ã€ã³ã»ãã·ã§ã³ãšçŽã¥ããŠä¿ç®¡ããŸãã 以äžã§èªèšŒåŠçã¯å®äºã§ãã ãŠãŒã¶ãŒå±æ§æ
å ±ã®ååŸ ãŠãŒã¶ãŒèªèšŒåŸã Web ãµãŒãã¹ ããŠãŒã¶ãŒåãªã©ã®ãŠãŒã¶ãŒå±æ§æ
å ±ãå¿
èŠã«ãªã£ãå ŽåãStep.3 ã§ååŸãã access_token ãå©çšã èªèšŒãµãŒãã¹ ã«å¯ŸããŠãŠãŒã¶ãŒå±æ§æ
å ±ããªã¯ãšã¹ãããŸãã GET /userinfo HTTP / 1.1 Host: server.example.com Authorization: Bearer SlAV32hkKG ãã®ãªã¯ãšã¹ãã«ãããStep.1 ã® scope ã§æå®ãããŠãŒã¶ãŒå±æ§æ
å ±ãååŸã§ããŸãã ãŸãšã 以äžå°ãé·ããªããŸãããããŠãŒã¶ãŒèªèšŒãš OpenID Connectãç¹ã«åºæ¬ã® AuthenticationCodeFlow ã«ã€ããŠè§£èª¬ããŸãããéãããçºè¡šæéã®äžã§ã®è§£èª¬ã®ããå³å¯ãããé°å²æ°ãéèŠããå
容ãšãªããŸãããããæ°ã¥ãã®ç¹ãªã©ããã°ãç¥ããããã ããã°ãšæããŸãã ãµãŒãã¹ã®èŠä»¶ããã§ãŒãºã«ãã£ãŠ OIDC ãåãå
¥ãããã©ããã¯æ§ã
ã§ããããŠãŒã¶ãŒèªèšŒã®å®è£
ãèªåã§å®è£
ãã¡ã³ããã³ã¹ããŠããã ãã§ãªããAmazon Cognito ãªã©ã®äŸ¿å©ãªèªèšŒãµãŒãã¹ãå©çšããŠããããšãéžæè¢ã®äžã€ãšããŠæ€èšããŠã¿ãŠãè¯ããããããŸããã ãããŠããã䟿å©ãªèªèšŒãµãŒãã¹ãããŸã䜿ãããªãããã«ãããã®èæ¯ã«ãã OIDC ã®ä»æ§ãææ³ãããããèªèšŒã®ä»çµã¿ã«ã€ããŠç«ã¡è¿ã£ãŠã¿ããšãçè§£ãäžæ®µãšæ·±ãŸãããšããããŸãã www.medley.jp www.medley.jp
ããã«ã¡ã¯ãéçºæ¬éšã®ãšã³ãžãã¢ã®é¶Žã§ãã ä»åã¯å
æã«è¡ã£ã瀟å
ã®ååŒ·äŒ TechLunch ã®å
容ãã玹ä»ãããŠããã ããŸãã ã€ã³ãã Web ãµãŒãã¹ã§ã¯ããŠãŒã¶ãŒã«ã¢ã«ãŠã³ããäœã£ãŠãããããã°ã€ã³ãããŠãµãŒãã¹ãå©çšããŠãããããšãããŠãŒã¶ãŒèªèšŒãå©çšãããµãŒãã¹ãå€ãããšæããŸãã Web ãµãŒãã¹ãéçºããåŽãšããŠã¯ããµãŒãã¹ããšã«éœåºŠãŠãŒã¶ãŒèªèšŒã®ä»çµã¿ãæ§ç¯ããå¿
èŠããããŸãããã»ãã¥ãªãã£å¯Ÿçã®èгç¹ããèæ
®ããããšãå€ããå°å³ã«éçºã®å·¥æ°ãããã£ãŠããŸããŸãã ãŸãæè¿ã§ã¯ã Amazon Cognito ã Firebase Authentication ã Auth0 ãªã©ããŠãŒã¶ãŒèªèšŒãµãŒãã¹ãããã€ããªãªãŒã¹ããããŠãŒã¶ãŒèªèšŒã®æ©èœããããã®å€éšãµãŒãã¹ã«ä»»ããŠéçºã®æéãçããšããéžæè¢ãåããããã«ãªã£ãŠããŠããŸãã èªåèªèº«ããã€ãŠæ
åœãããããžã§ã¯ãã§ãŠãŒã¶ãŒèªèšŒã®ä»çµã¿ã Amazon Cognito ã«ãŸãããŠã·ã¹ãã ãæ§ç¯ããããšããããŸããã ããããåœæã¯ç¹ã«ãŠãŒã¶ãŒããŒã«ã®æ©èœããªãªãŒã¹ãããŠéããªãããšããããSDK ã®åäœããµãŒãã¹ã®ä»æ§ã®çè§£ã«ããªãæéåã£ãããšãèŠããŠããŸãã ãŠãŒã¶ãŒèªèšŒãµãŒãã¹ã§ã¯ OpenID Connect ãšãã仿§ã«æºæ ããŠããããšãå€ãã®ã§ãããããããèªåã«ãšã£ãŠãã®ä»æ§ã®çè§£ãçãã ã£ãããšãåå ã®äžã€ã ã£ããšæããŸãã ããã§ä»åã¯ããŠãŒã¶ãŒèªèšŒãš OpenID Connect ã®ä»çµã¿ã«ã€ããŠæ¹ããŠå匷ãçŽããã®ã§ããã®å
容ãç°¡åã«è§£èª¬ããããŠããã ãããšæããŸãã ãŠãŒã¶ãŒèªèšŒãšã¯ ãŠãŒã¶ãŒèªèšŒã®åã«ãããããèªèšŒãšã¯ã©ãããæäœã®ããšãæãã®ã§ããããã ã¿ããªå€§å¥œã Wikipedia å
ç ã«ãããšã以äžã®ãããªèšèŒããããŸãã èªèšŒïŒã«ããããïŒãšã¯ãäœãã«ãã£ãŠãå¯Ÿè±¡ã®æ£åœæ§ã確èªããè¡çºãæãã èªèšŒè¡çºã¯èªèšŒå¯Ÿè±¡ãã£ãŠåé¡ãããèªèšŒå¯Ÿè±¡ã人éã§ããå Žåã«ã¯çžæèªèšŒïŒæ¬äººèªèšŒïŒãã¡ãã»ãŒãžã§ããå Žåã«ã¯ã¡ãã»ãŒãžèªèšŒãæå»ã®å Žåã«ã¯æå»èªèšŒãšåŒã¶ã åã«èªèšŒãšèšã£ãå Žåã«ã¯çžæèªèšŒãæãå Žåãå€ãã ãŠãŒã¶ãŒèªèšŒã¯ Web ãµãŒãã¹ã«ãšã£ãŠãªã¯ãšã¹ããéä¿¡ããŠããçžæã®æ£åœæ§ãèªèšŒããããšãªã®ã§ãçžæèªèšŒã® 1 ã€ã§ããã ããã«çžæèªèšŒã®èªèšŒæ¹æ³ãšã㊠2 éãã®æ¹æ³ããããŸãã 第 1 ã®æ¹æ³ã¯ã被èªèšŒè
ãèªèšŒè
ã«ãç§å¯éµããã£ãŠããããšã«ãã£ãŠåŸãããäœããã®èœåã®èšŒæãè¡ãæ¹æ³ã§ããã第 2 ã®æ¹æ³ã¯ã被èªèšŒè
ãèªèšŒè
ã«ã被èªèšŒè
ã®å
¬ééµã«å¯Ÿå¿ããç§å¯éµã®ç¥èã®èšŒæãè¡ãæ¹æ³ã§ããã ãŠãŒã¶ãŒèªèšŒã®å Žåãå€ãã¯ãã®ç¬¬ 1 ã®æ¹æ³ã§ã®èªèšŒã§ããã°ã€ã³æã«ãŠãŒã¶ãŒ ID ã«å ããŠããã®ãç§å¯éµããšããŠã¢ã«ãŠã³ãäœææã«ç»é²ããŠããããã¹ã¯ãŒããå
¥åããããšã§ãŠãŒã¶ãŒèªèšŒãè¡ã£ãŠããããšæããŸãã Web ãµãŒãã¹ã§ã®ãŠãŒã¶ãŒèªèšŒ Web ãµãŒãã¹ã§æ±ãæ
å ±ã®ç§å¿æ§ãé«ããªãã°ãªãã»ã©ããã®ãç§å¯éµããæ¬åœã«ãã®ãŠãŒã¶ãŒã«ããæäŸã§ããªãæ
å ±ã§ããããšãæ±ããããŸãã äžè¿°ã®ãããªãã¹ã¯ãŒãã«ããèªèšŒã®å Žåããã¹ã¯ãŒããæšæž¬ããããªã©ããŠæªæã®ãã第äžè
ã«ã¢ã«ãŠã³ããä¹ã£åãããŠããŸãäºä»¶ã¯ããè³ã«ããŸãã ããã»ãã¥ãªãã£ãé«ããããããã¹ã¯ãŒã以å€ã®èªèšŒãå€èŠçŽ èªèšŒãªã©ãçšããäºãå¢ããŠããŸããã ãŸããã»ãã¥ãªãã£ã®èгç¹ã ãã§ãªãå©äŸ¿æ§ã®èгç¹ãããããã¹ã¯ãŒãå
¥åã®ä»£ããã«æçŽèªèšŒãé¡èªèšŒã«ãããã°ã€ã³ãããããã¯åçš® SNS ã¢ã«ãŠã³ãã«ãããã°ã€ã³ãå¢ããŠããŠããŸããèªç€Ÿã®è€æ°ã®ãµãŒãã¹ã飿ºã§ãããããŠãŒã¶ãŒã«å
±é ID ãæäŸãããããšãã£ãã±ãŒã¹ããããããããŸããã æè¿ã§ã¯ãã¹ã¯ãŒãã¬ã¹èªèšŒã WebAuthn ãæ³šç®ãããŠããŸãããä»åã¯ç޹ä»ã¯å²æããŸããããã¹ã¯ãŒãã¬ã¹èªèšŒã®äžã€ã§ãã FIDO èªèšŒ ã¯ãåè¿°ã®ã被èªèšŒè
ãèªèšŒè
ã«ã被èªèšŒè
ã®å
¬ééµã«å¯Ÿå¿ããç§å¯éµã®ç¥èã®èšŒæãè¡ãæ¹æ³ããå©çšããèªèšŒæ¹åŒã®ããã§ããïŒ ref1 , ref2 ïŒ ãã®ããã«ãã»ãã¥ãªãã£ã®èгç¹ããŠãŒã¶ãŒå©äŸ¿æ§ã®èгç¹ãªã©ã«ãããWeb ãµãŒãã¹ã«ããããŠãŒã¶ãŒèªèšŒæ©èœã¯ 1 åäœã£ããçµããã§ã¯ãªããææµã«å¿ããŠé©å®æ¹ä¿®ããå¿
èŠãåºãŠããããšãããããšæããŸãã ããããç¹ã«ãŠãŒã¶ãŒèªèšŒãã¡ã€ã³ã®ãµãŒãã¹ãšå¯çµåããŠããå Žåãªã©ã§ã¯ãèªèšŒã®ååŸãªã©èªèšŒåŠçãã®ãã®ã ãã§ãªããã®åšèŸºã®åŠçãžã®åœ±é¿ç¯å²ãç¡èŠã§ããªãå ŽåãããããŠãŒã¶ãŒèªèšŒã®æ¹ä¿®ã«å·¥æ°ãæã£ãããããã£ãŠããŸã£ããã察å¿ãæ»ã£ãŠããŸãããšããããããããŸããã ãããªãšããèªèšŒãµãŒãã¹ãã¡ã€ã³ã®ãµãŒãã¹ãšåãé¢ãããšã§ããæè»ãªãŠãŒã¶ãŒèªèšŒææ®µãæäŸã§ãããããOpenID Connect ã®å°å
¥ãæ€èšããŠã¿ãŠãè¯ããããããŸããã OpenID Connect ãšã¯ OpenID Connect(以éãOIDC)ã«ã€ããŠãæ¬å®¶ãµã€ãã§ã¯ä»¥äžã®ããã«èª¬æãããŠããŸãã OpenID Connect 1.0 ã¯, OAuth 2.0 ãããã³ã«ã®äžã«ã·ã³ãã«ãªã¢ã€ãã³ãã£ãã£ã¬ã€ã€ãŒãä»äžãããã®ã§ãã. ãã®ãããã³ã«ã¯ Client ã Authorization Server ã®èªèšŒçµæã«åºã¥ã㊠End-User ã®ã¢ã€ãã³ãã£ãã£ãæ€èšŒå¯èœã«ãã. ãŸãåæã« End-User ã®å¿
èŠæäœéã®ãããã£ãŒã«æ
å ±ã, çžäºéçšå¯èœã〠RESTful ãªåœ¢ã§ååŸããããšãå¯èœã«ãã. ãã®ä»æ§ã¯, OpenID Connect ã®äž»èŠãªæ©èœã§ãã OAuth 2.0 äžã§ End-User ã®æ
å ±äŒéã®ããã«ã¯ã¬ãŒã ãçšããèªèšŒæ©èœãå®çŸ©ãã. ãã®ä»æ§ã¯ãŸã, OpenID Connect ãå©çšããããã® Security, Privacy Considerations ã説æãã. ïŒ æ¥æ¬èª , è±èª ïŒ å人çã«ã¯ãã¡ã€ã³ã®ãµãŒãã¹ãšèªèšŒãµãŒãã¹ãåãé¢ããŠéçšããããšãæ³å®ããŠä»æ§ãèŠå®ãããŠããç¹ãéèŠãšèããŸãã OIDC ãå©çšããããšã§ããŠãŒã¶ãŒèªèšŒãããæè»ã«æ¹ä¿®ãããæ°ããèªèšŒæ¹æ³ã«å¯Ÿå¿ãããããããšããããããªãããšãæåŸ
ãããããã§ãã ãªããOIDC ã®ä»æ§ã«ã¯èªèšŒææ®µèªäœïŒãã¹ã¯ãŒãèªèšŒãå€èŠçŽ èªèšŒãªã©ïŒã«é¢ããŠã¯èŠå®ãããŠãããããããŸã§èªèšŒãµãŒãã¹ã«ããèªèšŒçµæã®ååŸæ¹æ³ãæ±ãæ¹ã«ã€ããŠãèŠå®ãããŠããŸãã ãŸããæ§ã
ãªãŠãŒã¹ã±ãŒã¹ã«å¯Ÿå¿ã§ããããããã€ãã®åŠçãããŒããªãã·ã§ãã«ãªèšå®ãæäŸãããŠããŸããããã®åé¢ã»ãã¥ãªãã£ã®ç¢ºä¿ã¯å®è£
è
ã«å§ããããŠããããŠãŒã¹ã±ãŒã¹ã«å¿ããŠé©åãªå®è£
ãè¡ãå¿
èŠããããŸãã åè¿°ãããŠãŒã¶ãŒèªèšŒãµãŒãã¹ã§ãã Amazon Cognito ã FirebaseAuthentication ãªã©ã¯ãèªèšŒææ®µãæšæºã§ããã€ãæäŸãããŠãããå ããŠããã¯ãšã³ããš SDK ã« OIDC åºæã®ã»ãã¥ã¢ãªå®è£
ãæœãããŠãããããéçºè
ã¯æå°éã®èšå®ã ãã§ãŠãŒã¶ãŒèªèšŒæ©èœãå©çšã§ããããã«ãªããŸãã䟿å©ã§ããã åŠçãããŒã®è§£èª¬ ããŠãOIDC ã®å
·äœçãªåŠçã«ã€ããŠè§£èª¬ããŠããããšæããŸãã ãŸãç»å Žäººç©ã§ãã OpenID ProviderïŒOPïŒïŒèªèšŒèªå¯ãè¡ããµãŒãã¹ããŠãŒã¶ãŒèªèšŒæ
å ±ïŒèå¥åããã¹ã¯ãŒããªã©ïŒã管çããããèªèšŒã«é¢ãããŠãŒã¶ãŒå±æ§æ
å ±ïŒæ°åããŠãŒã¶ãŒåãªã©ïŒãä¿æããã RelyingPartyïŒRPïŒïŒ ã¢ã¯ã»ã¹å
ã®ãŠãŒã¶ãŒã®èªèšŒãšãŠãŒã¶ãŒå±æ§æ
å ±ãèŠæ±ãããµãŒãã¹ããŠãŒã¶ãŒããã®ãªã¯ãšã¹ãã«å¯Ÿã OP ã«ããèªèšŒçµæãä¿¡é ŒïŒrelyïŒããŠãªãœãŒã¹ãžã®ã¢ã¯ã»ã¹ãèš±å¯ããïŒäŸãã°ãã€ããŒãžã衚瀺ãããªã©ïŒã EndUserïŒãã°ã€ã³ãããŠãµãŒãã¹ãå©çšããããšããŠãããŠãŒã¶ãŒã åºæ¬çãªçšèªãå
ã«ç°¡åã«ç޹ä»ããŠãããŸãã ã¯ã©ã€ã¢ã³ã IDïŒOpenID Provider ã§ç®¡çãããRelyingParty ã®è奿
å ±ã ã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ããïŒOpenID Provider ã RelyingParty ããšã«çºè¡ããç§å¯éµã èªèšŒã³ãŒãïŒåŸè¿°ãã AuthorizationCodeFlow ã§ OpenID Provider ãçºè¡ããçåœã®ãã¹ã¯ãŒãã®ãããªãã®ã ID ããŒã¯ã³ïŒOpenID Provider ããçºè¡ãããããŠãŒã¶ãŒã«ããèªèšŒãè¡ã£ã蚌ææ
å ±ã JSON Web Token(JWT) ã§è¡šçŸãããæ€èšŒã«ããæ¹ããæ€ç¥ããããšãã§ãããèªèšŒã®å
容ïŒOpenID ProviderããŠãŒã¶ãŒèå¥åãRelyingParty ã®ã¯ã©ã€ã¢ã³ã IDãæå¹æéãªã©ïŒããŠãŒã¶ãŒå±æ§æ
å ±ãæ ŒçŽãããã ã¢ã¯ã»ã¹ããŒã¯ã³:OpenID Provider ãä¿æãããŠãŒã¶ãŒå±æ§æ
å ±ã«å¯Ÿãã¢ã¯ã»ã¹ããããã® OAuth2 ã®èªå¯ããŒã¯ã³ã OIDC ã®åŠçãããŒã¯å€§ããåã㊠3 çš®é¡ãèŠå®ãããŠããŸãã AuthorizationCodeFlowïŒèªèšŒæåæã« OpenID Provider ã RelyingParty ã«å¯ŸãèªèšŒã³ãŒããçºè¡ããRelyingParty ã¯ãããçšã㊠OpenID Provider ãã ID ããŒã¯ã³çãååŸãããRelyingParty ããµãŒããŒãµã€ãã¢ããªã±ãŒã·ã§ã³ã§ãOpenID Provider ããçºè¡ãããã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå®å
šã«ç®¡çããããšãã§ããå Žåãªã©ã«çšããããã ImplicitFlowïŒèªèšŒã³ãŒãã䜿ããèªèšŒçµæã®ã¬ã¹ãã³ã¹ã§ ID ããŒã¯ã³çãååŸãããRelyingParty ãã¯ã©ã€ã¢ã³ãã¢ããªã±ãŒã·ã§ã³ã®å Žåãªã©ãã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå®å
šã«ç®¡çã§ããªãå Žåãªã©ã«çšããããã HybridFlowïŒAuthorizationCodeFlow ãš ImplicitFlow ã®çµã¿åããã ãããã®ãããŒã®éãã¯ä»¥äžã®è¡šã®ãšããã§ãã ïŒ å
¬åŒããåŒçš ïŒ ä»åã¯ã å
¬åŒ ã ãã¡ãã®è§£èª¬èšäº ãªã©ãåç
§ããªãããåºæ¬ã®åŠçãããŒã§ãã AuthorizationCodeFlow ã«ã€ããŠè§£èª¬ããŸãã ç°¡ç¥åã®ãããã€ã¡ãŒãžéèŠã§ç»å Žäººç©ã¯ã ãŠãŒã¶ãŒ ããïŒãŠãŒã¶ãŒã«ãµãŒãã¹ãæäŸããïŒ Web ãµãŒãã¹ ãã èªèšŒãµãŒãã¹ ããšè¡šçŸããããšã«ããŸãã 倧ãŸãã«ã¯ä»¥äžã®ã¹ãããã§åŠçãè¡ãããŸãã ãŠãŒã¶ãŒ ããã®ã¢ã¯ã»ã¹ã«å¯Ÿãã Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ã«ãŠãŒã¶ãŒèªèšŒãèŠæ±ãã èªèšŒãµãŒãã¹ ã¯ãŠãŒã¶ãŒèªèšŒãè¡ããèªèšŒã³ãŒããçºè¡ããŠã ãŠãŒã¶ãŒ ã Web ãµãŒãã¹ ã«ãªãã€ã¬ã¯ãããã Web ãµãŒã㹠㯠2 ã§ååŸããèªèšŒã³ãŒããçšã㊠èªèšŒãµãŒãã¹ ã« ID ããŒã¯ã³çããªã¯ãšã¹ããã Web ãµãŒã㹠㯠3 ã§ååŸãã ID ããŒã¯ã³ãæ€èšŒãã ãŠãŒã¶ãŒ ã®èå¥åãååŸãã Step.0 : äºåæºå ããããã Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ããã¯ã©ã€ã¢ã³ã ID ãšã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããååŸãä¿æããŠãããŸãã Step.1: ãŠãŒã¶ãŒèªèšŒã®èŠæ± ãŠãŒã¶ãŒ ã Web ãµãŒãã¹ ã«å¯Ÿãäžè¬çãªãã°ã€ã³ã®æµãã§ãã°ã€ã³ãèŠæ±ãããšã Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ã«ãªã¯ãšã¹ãããªãã€ã¬ã¯ãããŸãã Web ãµãŒãã¹ ãã èªèšŒãµãŒãã¹ ãžã®ãªãã€ã¬ã¯ãã® URL ã¯ä»¥äžã®ãããªæãã§ãã HTTP / 1.1 302 Found Location: https://server.example.com/authorize? response_type=code & client_id = s6BhdRkqt3 & redirect_uri = https%3A%2F%2Fclient.example.org%2Fcb & scope = openid%20profile & state = af0ifjsldkj response_type ã§ OIDC ã®ã©ã®èªèšŒãããŒã䜿ãããæå®ããŸãã redirect_uri ã¯ã èªèšŒãµãŒãã¹ ã§ã®èªèšŒãæåãããšãã® Web ãµãŒãã¹ ã«ã³ãŒã«ããã¯ãã URL ã§ããããã¯äºåã«èªèšŒãµãŒãã¹ã«ç»é²ããŠããå¿
èŠããããŸãã scope ã«ã¯èªèšŒã®å
容ãèšå®ããŸããopenid ã¯å¿
é ã§ãä»ã«ã¯ OAuth2 ã®ã¢ã¯ã»ã¹ããŒã¯ã³ã䜿ã£ãŠååŸã§ãããŠãŒã¶ãŒå±æ§æ
å ±ãæå®ããŸãã scope ã§æå®ã§ãããŠãŒã¶ãŒå±æ§æ
å ±ã¯ä»¥äžã®ãšããã§ãã ïŒ å
¬åŒããåŒçš ïŒ ãŠãŒã¶ãŒã®èªèšŒã§ãã䜿ãããããªãæ°åãããã¡ãŒã«ã¢ãã¬ã¹ããªã©åºæ¬çãªå±æ§æ
å ±ãå®çŸ©ãããŠããŸãã state 㯠CSRF 察çãªã©ã®ããã®ã©ã³ãã å€ã§ããèªèšŒãããŒãéå§ãããã³ã« Web ãµãŒãã¹ ãçºè¡ãããªã¯ãšã¹ããšã³ãŒã«ããã¯ã®éã§å€ãç¶æãããŸãã ä»ã«ãããã€ãã®ãã©ã¡ãŒã¿ïŒnonce ãªã©ïŒãå®çŸ©ãããŠãããå¿
èŠã«å¿ããŠå©çšããŸãã Step.2: ãŠãŒã¶ãŒèªèšŒãšèªèšŒã³ãŒãã®çºè¡ èªèšŒãµãŒãã¹ ã§ã¯èªèšŒææ®µã«å¿ããŠãã°ã€ã³ ID ã»ãã¹ã¯ãŒãã®å
¥åãã©ãŒã ãªã©ã衚瀺ãã ãŠãŒã¶ãŒ ããèªèšŒæ
å ±ãååŸããŠèªèšŒåŠçãè¡ããŸãã èªèšŒãµãŒãã¹ ã¯ãŠãŒã¶ãŒã®èªèšŒã«æåãããšãèªèšŒã³ãŒããçºè¡ãã ãŠãŒã¶ãŒ ã Web ãµãŒãã¹ ã«ãªãã€ã¬ã¯ããããŸãã HTTP / 1.1 302 Found Location: https://client.example.org/cb? code=SplxlOBeZQQYbYS6WxSbIA & state = af0ifjsldkj ãªãã€ã¬ã¯ãå
ã«ã€ããŠã èªèšŒãµãŒã㹠㯠Step.1 ã§åãåã£ã redirect url ã èªèšŒãµãŒãã¹ ã«äºãç»é²ãããŠãã URL ãšåèŽããããšãæ€èšŒããå¿
èŠããããŸãã_Web ãµãŒãã¹ ã®ãªãããŸããé²ãããã§ãã ãŸã Web ãµãŒãã¹ åŽã§ èªèšŒãµãŒãã¹ ããã®ã¬ã¹ãã³ã¹ã§ããããšã確èªã§ãããããstate ããã©ã¡ãŒã¿ã«å«ããŸãã ãªããèªèšŒã«å€±æããå Žåã¯äžèšã®ããã«èªèšŒãšã©ãŒããå
容ããã©ã¡ãŒã¿ãŒã«å ã㊠Web ãµãŒãã¹ã«ãªãã€ã¬ã¯ããããŸãã HTTP / 1.1 302 Found Location: https://client.example.org/cb? error=invalid_request & error_description = Unsupported%20response_type%20value & state = af0ifjsldkj Step.3: èªèšŒçµæã®ååŸ Step.2 ã§ Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹ ããã®ãªãã€ã¬ã¯ããåããèªèšŒã³ãŒããååŸãããšããã®èªèšŒã³ãŒããå©çšã㊠èªèšŒãµãŒãã¹ ã«å¯ŸããŠèªèšŒçµææ
å ±ïŒID ããŒã¯ã³ãªã©ïŒãååŸããŸãã Web ãµãŒãã¹ ãã èªèšŒãµãŒãã¹ ãžã®èªèšŒçµæååŸãªã¯ãšã¹ãã¯ä»¥äžã®ãããªåœ¢åŒã«ãªããŸãã POST /token HTTP / 1.1 Host: server.example.com Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW Content-Type: application/x-www-form-urlencoded grant_type=authorization_code&code=SplxlOBeZQQYbYS6WxSbIA & redirect_uri = https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb èªèšŒã³ãŒããéä¿¡ããå¿
èŠããããããPOST ã¡ãœããã§ãªã¯ãšã¹ãããŸãããŸãã¯ã©ã€ã¢ã³ã ID ãšã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ããã«ãã BASIC èªèšŒãè¡ããŸãã ãã®ãªã¯ãšã¹ãã§ã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå¿
èŠã«ãªãã®ã§ããããã㯠èªèšŒãµãŒãã¹ ã«ãšã£ãŠ Web ãµãŒãã¹ ã®æ£åœæ§ãæ€èšŒããããã®éèŠãªãã©ã¡ãŒã¿ã§ãããå®å
šã«ç®¡çãããå¿
èŠããããŸãã SinglePageApplication ã®ããã«ãŠãŒã¶ãŒåŽã«ããã¢ããªã±ãŒã·ã§ã³ã§ OIDC ãåŠçããå Žåã«ã¯ããã®ã¯ã©ã€ã¢ã³ãã·ãŒã¯ã¬ãããå®å
šã«ç®¡çãããä¿èšŒããªããããAuthenticationCodeFlow ã§ã¯ãªã ImplicitFlow ãªã©ãå©çšããå¿
èŠããããŸãã Web ãµãŒãã¹ ããã®ãªã¯ãšã¹ããåãåã£ã èªèšŒãµãŒã㹠㯠grant_type ã« Step.1 ã§æå®ããåŠçãããŒã«è©²åœããæ
å ±ãæž¡ããèªèšŒã³ãŒãïŒ code ïŒãšåãã㊠èªèšŒãµãŒãã¹ ã«ãªã¯ãšã¹ãã®æ€èšŒããããŸãã èªèšŒãµãŒãã¹ ã¯ãªã¯ãšã¹ãã®æ€èšŒã«æåãããšã Web ãµãŒãã¹ ã«å¯ŸãèªèšŒçµæãšã㊠ID ããŒã¯ã³çãè¿åŽããŸãã HTTP / 1.1 200 OK Content-Type: application/json Cache-Control: no-cache, no-store Pragma: no-cache { "access_token" : "SlAV32hkKG" , "token_type" : "Bearer" , "expires_in" : 3600 , "refresh_token" : "tGzv3JOkF0XG5Qx2TlKWIA" , "id_token" : "eyJ0 ... NiJ9.eyJ1c ... I6IjIifX0.DeWt4Qu ... ZXso" } access_token 㯠èªèšŒãµãŒãã¹ ã§ç®¡çããŠãããŠãŒã¶ãŒå±æ§æ
å ±ãååŸããããã® OAuth2 ããŒã¯ã³ã§ãã refresh_token 㯠èªèšŒãµãŒãã¹ ãã access_token ãåçºè¡ããéã«å©çšããŸãã Step.4: èªèšŒçµæã®æ€èšŒ Web ãµãŒã㹠㯠èªèšŒãµãŒãã¹*ããååŸãã ID ããŒã¯ã³ãæ€èšŒããŸããID ããŒã¯ã³ã¯åè¿°ã®éã JWT ã§è¡šçŸãããŠããã*èªèšŒãµãŒãã¹_ã®å
¬ééµãçšããŠæ€èšŒããããšãã§ããŸãã æé 㯠ãã¡ã ãã確èªãã ãããä»ã«ãåèãªã³ã¯ã玹ä»ããŠãããŸãã https://qiita.com/bobunderson/items/d48f89e2b3e6ad9f9c4c https://qiita.com/TakahikoKawasaki/items/8f0e422c7edd2d220e06 äžèšã¯ ID ããŒã¯ã³ã«å«ãŸããèªèšŒæ
å ±ã®äŸã§ãã { "iss" : "https://server.example.com" , "sub" : "24400320" , "aud" : "s6BhdRkqt3" , "exp" : 1311281970 , "iat" : 1311280970 } ãã®ãã¡ sub ã èªèšŒãµãŒãã¹ ã§ç®¡çãããŠãã ãŠãŒã¶ãŒ ã®èå¥åã§ãã iss 㯠èªèšŒãµãŒãã¹ ãaud 㯠Web ãµãŒãã¹ ã®ã¯ã©ã€ã¢ã³ã ID ã«ãªããŸãã expãiat ã¯ããããèªèšŒã®æå¹æéãšèªèšŒããã¿ã€ã ã¹ã¿ã³ãã§ãã Web ãµãŒã㹠㯠ID ããŒã¯ã³ãæ£ããå
容ã§ããããšã確èªã§ããã°ãããããã°ã€ã³ã»ãã·ã§ã³ãšçŽã¥ããŠä¿ç®¡ããŸãã 以äžã§èªèšŒåŠçã¯å®äºã§ãã ãŠãŒã¶ãŒå±æ§æ
å ±ã®ååŸ ãŠãŒã¶ãŒèªèšŒåŸã Web ãµãŒãã¹ ããŠãŒã¶ãŒåãªã©ã®ãŠãŒã¶ãŒå±æ§æ
å ±ãå¿
èŠã«ãªã£ãå ŽåãStep.3 ã§ååŸãã access_token ãå©çšã èªèšŒãµãŒãã¹ ã«å¯ŸããŠãŠãŒã¶ãŒå±æ§æ
å ±ããªã¯ãšã¹ãããŸãã GET /userinfo HTTP / 1.1 Host: server.example.com Authorization: Bearer SlAV32hkKG ãã®ãªã¯ãšã¹ãã«ãããStep.1 ã® scope ã§æå®ãããŠãŒã¶ãŒå±æ§æ
å ±ãååŸã§ããŸãã ãŸãšã 以äžå°ãé·ããªããŸãããããŠãŒã¶ãŒèªèšŒãš OpenID Connectãç¹ã«åºæ¬ã® AuthenticationCodeFlow ã«ã€ããŠè§£èª¬ããŸãããéãããçºè¡šæéã®äžã§ã®è§£èª¬ã®ããå³å¯ãããé°å²æ°ãéèŠããå
容ãšãªããŸãããããæ°ã¥ãã®ç¹ãªã©ããã°ãç¥ããããã ããã°ãšæããŸãã ãµãŒãã¹ã®èŠä»¶ããã§ãŒãºã«ãã£ãŠ OIDC ãåãå
¥ãããã©ããã¯æ§ã
ã§ããããŠãŒã¶ãŒèªèšŒã®å®è£
ãèªåã§å®è£
ãã¡ã³ããã³ã¹ããŠããã ãã§ãªããAmazon Cognito ãªã©ã®äŸ¿å©ãªèªèšŒãµãŒãã¹ãå©çšããŠããããšãéžæè¢ã®äžã€ãšããŠæ€èšããŠã¿ãŠãè¯ããããããŸããã ãããŠããã䟿å©ãªèªèšŒãµãŒãã¹ãããŸã䜿ãããªãããã«ãããã®èæ¯ã«ãã OIDC ã®ä»æ§ãææ³ãããããèªèšŒã®ä»çµã¿ã«ã€ããŠç«ã¡è¿ã£ãŠã¿ããšãçè§£ãäžæ®µãšæ·±ãŸãããšããããŸãã www.medley.jp www.medley.jp