Safari (ITP) & Chrome (SameSite=Lax as default) が Federation に与える影響 - OpenID TechNight vol.17
•
1 j'aime•1,331 vues
OpenID TechNight vol.17 での発表スライドです。 https://openid.connpass.com/event/183577/ 録画はこちら。 https://www.youtube.com/watch?v=0856pHMoTDs
Signaler
Partager
Signaler
Partager
Télécharger pour lire hors ligne
Recommandé
#idcon vol.29 - #fidcon WebAuthn, Next Stage
Nov Matake gave a keynote presentation at FIDCon about the next stage of WebAuthn and Passkeys on Apple platforms. He demonstrated syncing Passkeys across devices and using them for autofill on websites. Some challenges remain around credential changes and re-authentication. Syncing Passkeys across different operating systems like Windows, Android, and ChromeOS will also need to be addressed to make the experience better for users.
FedCM - OpenID TechNight vol.19
The document discusses authentication for browser-based and native apps using app-specific, IDP, and third-party backend APIs. It asks questions about obtaining and storing tokens for each API and passing tokens. Answers recommend using OAuth 2.0 for tokens, storing them in keychain/backend server, and passing as bearer tokens. Best practices are proposed like using a mediator flow and letting IDPs handle user interactions.
Sign in with Apple
This document summarizes differences between Sign in with Apple (SIWA) and OpenID Connect (OIDC) and OAuth 2.0 standards. It notes several ways SIWA specifications and behaviors deviate from or violate OIDC standards, including not supporting standard authentication methods, response types, and claims. It also describes SIWA's characteristic identifier design which links multiple apps and services from the same developer together under a single user consent. Developer teams are limited to 10 linked apps/services and must create a new team for additional apps.
FIDO @ LINE - #idcon vol.24
This document discusses LINE Corporation's LINE FIDO authentication solution and compares FIDO U2F, FIDO2, and FIDO UAF standards. It outlines the key components of each standard including message formats, protocol specifications, assertion data, and how they ensure interoperability across authenticators. It also mentions potential applications of LINE FIDO in areas like finance and IoT, as well as features like enrollment to address device loss.
W3C Web Authentication - #idcon vol.24
The document discusses the W3C Web Authentication standard (also known as FIDO 2.0) for passwordless strong authentication on the web. It provides an overview of the key components and actors in the standard like FIDO authenticators, user agents, relying parties. It then summarizes the basic flows of registration and authentication in 2 phases. During registration, a key pair is generated on the authenticator and the public key is registered with the FIDO server. During authentication, the authenticator performs local authentication using the registered key and sends an assertion to the server for remote authentication.
NIST SP 800-63C - Federation and Assertions (FINAL)
OIDF-J・JIPDEC共催OpenID BizDay#11「NIST SP 800-63-3を読む」
https://www.jipdec.or.jp/topics/event/20171013.html
OPTiM StoreにおけるSCIM & OIDC活用事例 - ID&IT 2016
This document discusses the OPTiM Store, which uses SCIM and OpenID Connect (OIDC) for provisioning and federation between systems like Active Directory and SaaS applications. It outlines the processes for tenant contracting, client registration, and credential exchange to enable synchronization of user identities and attributes from a SaaS application to the OPTiM Store using SCIM, and authentication from the store to SaaS using OIDC single sign-on.
NIST SP 800-63C #idcon vol.22
The document discusses standards for identity federation and assertions. It defines four levels of federation assurance (FAL) based on the type of assertion used and how it is presented. FAL1 uses front-channel or back-channel bearer assertions signed by the identity provider. FAL2 adds encryption of assertions to the relying party. FAL3 encrypts assertions to the relying party for both front and back-channel. FAL4 uses holder-of-key assertions, where the assertion contains a public key and proof of possession, signed and encrypted to the relying party. The document provides definitions and discusses security considerations for federation and assertions.
Recommandé
#idcon vol.29 - #fidcon WebAuthn, Next Stage
Nov Matake gave a keynote presentation at FIDCon about the next stage of WebAuthn and Passkeys on Apple platforms. He demonstrated syncing Passkeys across devices and using them for autofill on websites. Some challenges remain around credential changes and re-authentication. Syncing Passkeys across different operating systems like Windows, Android, and ChromeOS will also need to be addressed to make the experience better for users.
FedCM - OpenID TechNight vol.19
The document discusses authentication for browser-based and native apps using app-specific, IDP, and third-party backend APIs. It asks questions about obtaining and storing tokens for each API and passing tokens. Answers recommend using OAuth 2.0 for tokens, storing them in keychain/backend server, and passing as bearer tokens. Best practices are proposed like using a mediator flow and letting IDPs handle user interactions.
Sign in with Apple
This document summarizes differences between Sign in with Apple (SIWA) and OpenID Connect (OIDC) and OAuth 2.0 standards. It notes several ways SIWA specifications and behaviors deviate from or violate OIDC standards, including not supporting standard authentication methods, response types, and claims. It also describes SIWA's characteristic identifier design which links multiple apps and services from the same developer together under a single user consent. Developer teams are limited to 10 linked apps/services and must create a new team for additional apps.
FIDO @ LINE - #idcon vol.24
This document discusses LINE Corporation's LINE FIDO authentication solution and compares FIDO U2F, FIDO2, and FIDO UAF standards. It outlines the key components of each standard including message formats, protocol specifications, assertion data, and how they ensure interoperability across authenticators. It also mentions potential applications of LINE FIDO in areas like finance and IoT, as well as features like enrollment to address device loss.
W3C Web Authentication - #idcon vol.24
The document discusses the W3C Web Authentication standard (also known as FIDO 2.0) for passwordless strong authentication on the web. It provides an overview of the key components and actors in the standard like FIDO authenticators, user agents, relying parties. It then summarizes the basic flows of registration and authentication in 2 phases. During registration, a key pair is generated on the authenticator and the public key is registered with the FIDO server. During authentication, the authenticator performs local authentication using the registered key and sends an assertion to the server for remote authentication.
NIST SP 800-63C - Federation and Assertions (FINAL)
OIDF-J・JIPDEC共催OpenID BizDay#11「NIST SP 800-63-3を読む」
https://www.jipdec.or.jp/topics/event/20171013.html
OPTiM StoreにおけるSCIM & OIDC活用事例 - ID&IT 2016
This document discusses the OPTiM Store, which uses SCIM and OpenID Connect (OIDC) for provisioning and federation between systems like Active Directory and SaaS applications. It outlines the processes for tenant contracting, client registration, and credential exchange to enable synchronization of user identities and attributes from a SaaS application to the OPTiM Store using SCIM, and authentication from the store to SaaS using OIDC single sign-on.
NIST SP 800-63C #idcon vol.22
The document discusses standards for identity federation and assertions. It defines four levels of federation assurance (FAL) based on the type of assertion used and how it is presented. FAL1 uses front-channel or back-channel bearer assertions signed by the identity provider. FAL2 adds encryption of assertions to the relying party. FAL3 encrypts assertions to the relying party for both front and back-channel. FAL4 uses holder-of-key assertions, where the assertion contains a public key and proof of possession, signed and encrypted to the relying party. The document provides definitions and discusses security considerations for federation and assertions.
NIST SP 800-63-3 #idcon vol.22
SP 800-63-3 is an update to NIST's digital identity guidelines. It introduces a new framework that separates assurance levels into three components: Identity Assurance Level (IAL), Authenticator Assurance Level (AAL), and Federation Assurance Level (FAL). This provides more flexibility and granularity over the previous version's single Level of Assurance (LOA). The document outlines the recommended requirements and mappings between the new IAL, AAL, FAL framework and the legacy LOA model from SP 800-63-2.
ID連携入門 (実習編) - Security Camp 2016
The document discusses OAuth and OpenID Connect protocols. It provides diagrams illustrating the flows of OAuth authorization code grant, implicit grant and hybrid grant flows. It also compares OAuth and OpenID Connect, noting that OpenID Connect builds upon OAuth by adding an identity layer. Key aspects of OpenID Connect like ID tokens and their claims are outlined. Examples of OAuth and OpenID Connect implementations are provided at the end.
ID連携概要 - OpenID TechNight vol.13
This document contains information about Nov Matake, including that he is a security engineer at GREE Inc. and evangelist for the OpenID Foundation. It discusses concepts related to digital identity including entity, identity, authentication, authorization, access control, and identity proofing. It also compares identity providers and relying parties in the context of single sign-on using services like Facebook and Disqus.
FIDO alliance #idcon vol.18
The document discusses the FIDO Alliance and its specifications for passwordless and two-factor authentication. It describes the FIDO Alliance's role in defining specifications, issuing vendor codes, and operating a certification program called FIDO Ready. The specifications cover areas like registration, authentication, and key generation in interactions between users' devices, authenticators, clients, and relying parties.
OpenID Connect 101 @ OpenID TechNight vol.11
The document is a presentation on OpenID Connect 101 by Nov Matake of OpenID Foundation Japan. It provides an overview of OpenID Connect, including how it uses OAuth 2.0 with an added identity layer, the code flow process, ID tokens and their contents, scopes, discovery, and dynamic client registration. It also discusses password leaks, two-factor authentication, and security best practices.
MIT-KIT Intro at #idcon sattelite
The document provides an overview of the MIT Kerberos & Internet Trust Consortium (MIT-KIT). It discusses the history and success of Kerberos authentication. The mission of MIT-KIT has expanded to address broader issues in identity, authorization, and privacy on the internet. It envisions an emerging personal data ecosystem where individuals control their own data. MIT-KIT is working on various open source components and standards to help realize this vision, including projects around OpenPDS and implementing the NSTIC Identity Ecosystem Steering Group framework.
Self isssued-idp
This document discusses a self-issued open ID provider that allows identity in devices without central identity provider servers. It generates ID tokens on the device using a self-signed key pair stored securely on the device. The subject ("sub") claim in the ID token is calculated from the public key. This allows each device to have a unique ID token tied to the key pair, with no need for client registration or API access tokens.
IIW 16th Report at #idcon
The document summarizes several talks from the IIW #16 conference on identity topics. One talk discussed enabling single sign-on across mobile apps by storing an ID token in a shared keychain. Another discussed passing an ID token from a native mobile app to a browser to skip separate login. A third talked presented Google's vision for authentication over the next 5 years, focusing on setup instead of separate sign-ins, reducing bearer tokens, incorporating smarter hardware, and advanced combination authentication techniques. The last summary discussed using OAuth 2.0 and JSON Web Encryption standards for accessing patient health records through a Blue Button API.
OAuth 2.0 #idit2012
The document discusses OAuth 2.0 and OpenID Connect. It provides an overview of OAuth 2.0's authorization code and implicit grant flows for obtaining an access token to access a secured resource. It also mentions OAuth 2.0 is used for access control in APIs and enterprises. Additionally, it states OpenID Connect is based on and extends OAuth 2.0 to provide identity features. Finally, it suggests these protocols are important for applications, access control, identity, social media, clouds, and the growing API economy.
Account Chooser #idit2012
This document discusses the Account Chooser Working Group, an OpenID Foundation initiative to create a standard user interface and user experience for logging into websites and applications. The group aims to develop a central account chooser that allows users to select an identity provider from their browser using local storage. This would provide a better login experience than existing "username/password" or social login options. The document promotes the benefits of implementing the account chooser standard and provides links to related projects and resources.
OpenID Connect via WebIntents
This document discusses using WebIntents to enable OpenID Connect discovery. WebIntents allows for inter-app communication and discovery on smartphones. The document proposes standardizing intent action values and response formats to enable OpenID Connect providers to be discovered and registration/authorization flows delegated using WebIntents. This avoids the need for direct communication between relying parties and authorization servers.
OAuth 2.0 & OpenID Connect @ OpenSource Conference 2011 Tokyo #osc11tk
1. The document discusses OAuth 2.0 and OpenID Connect for API access control and authorization. It provides a brief history of OAuth and describes the core specification and response types.
2. The core specification defines two response types - code and token. The code response type uses authorization codes to obtain access tokens in a two-step process, while the token response type returns access tokens directly.
3. The document also covers token types, notably the bearer token which transmits no signature or secret and is commonly used for API access. It notes that some providers may not follow the latest OAuth draft specifications strictly.
論文紹介：Deep Learning-Based Human Pose Estimation: A Survey
Ce Zheng, Wenhan Wu, Chen Chen, Taojiannan Yang, Sijie Zhu, Ju Shen, Nasser Kehtarnavaz, Mubarak Shah, "Deep Learning-Based Human Pose Estimation: A Survey" arXiv2020
https://arxiv.org/abs/2012.13392
Contenu connexe
Plus de Nov Matake
NIST SP 800-63-3 #idcon vol.22
SP 800-63-3 is an update to NIST's digital identity guidelines. It introduces a new framework that separates assurance levels into three components: Identity Assurance Level (IAL), Authenticator Assurance Level (AAL), and Federation Assurance Level (FAL). This provides more flexibility and granularity over the previous version's single Level of Assurance (LOA). The document outlines the recommended requirements and mappings between the new IAL, AAL, FAL framework and the legacy LOA model from SP 800-63-2.
ID連携入門 (実習編) - Security Camp 2016
The document discusses OAuth and OpenID Connect protocols. It provides diagrams illustrating the flows of OAuth authorization code grant, implicit grant and hybrid grant flows. It also compares OAuth and OpenID Connect, noting that OpenID Connect builds upon OAuth by adding an identity layer. Key aspects of OpenID Connect like ID tokens and their claims are outlined. Examples of OAuth and OpenID Connect implementations are provided at the end.
ID連携概要 - OpenID TechNight vol.13
This document contains information about Nov Matake, including that he is a security engineer at GREE Inc. and evangelist for the OpenID Foundation. It discusses concepts related to digital identity including entity, identity, authentication, authorization, access control, and identity proofing. It also compares identity providers and relying parties in the context of single sign-on using services like Facebook and Disqus.
FIDO alliance #idcon vol.18
The document discusses the FIDO Alliance and its specifications for passwordless and two-factor authentication. It describes the FIDO Alliance's role in defining specifications, issuing vendor codes, and operating a certification program called FIDO Ready. The specifications cover areas like registration, authentication, and key generation in interactions between users' devices, authenticators, clients, and relying parties.
OpenID Connect 101 @ OpenID TechNight vol.11
The document is a presentation on OpenID Connect 101 by Nov Matake of OpenID Foundation Japan. It provides an overview of OpenID Connect, including how it uses OAuth 2.0 with an added identity layer, the code flow process, ID tokens and their contents, scopes, discovery, and dynamic client registration. It also discusses password leaks, two-factor authentication, and security best practices.
MIT-KIT Intro at #idcon sattelite
The document provides an overview of the MIT Kerberos & Internet Trust Consortium (MIT-KIT). It discusses the history and success of Kerberos authentication. The mission of MIT-KIT has expanded to address broader issues in identity, authorization, and privacy on the internet. It envisions an emerging personal data ecosystem where individuals control their own data. MIT-KIT is working on various open source components and standards to help realize this vision, including projects around OpenPDS and implementing the NSTIC Identity Ecosystem Steering Group framework.
Self isssued-idp
This document discusses a self-issued open ID provider that allows identity in devices without central identity provider servers. It generates ID tokens on the device using a self-signed key pair stored securely on the device. The subject ("sub") claim in the ID token is calculated from the public key. This allows each device to have a unique ID token tied to the key pair, with no need for client registration or API access tokens.
IIW 16th Report at #idcon
The document summarizes several talks from the IIW #16 conference on identity topics. One talk discussed enabling single sign-on across mobile apps by storing an ID token in a shared keychain. Another discussed passing an ID token from a native mobile app to a browser to skip separate login. A third talked presented Google's vision for authentication over the next 5 years, focusing on setup instead of separate sign-ins, reducing bearer tokens, incorporating smarter hardware, and advanced combination authentication techniques. The last summary discussed using OAuth 2.0 and JSON Web Encryption standards for accessing patient health records through a Blue Button API.
OAuth 2.0 #idit2012
The document discusses OAuth 2.0 and OpenID Connect. It provides an overview of OAuth 2.0's authorization code and implicit grant flows for obtaining an access token to access a secured resource. It also mentions OAuth 2.0 is used for access control in APIs and enterprises. Additionally, it states OpenID Connect is based on and extends OAuth 2.0 to provide identity features. Finally, it suggests these protocols are important for applications, access control, identity, social media, clouds, and the growing API economy.
Account Chooser #idit2012
This document discusses the Account Chooser Working Group, an OpenID Foundation initiative to create a standard user interface and user experience for logging into websites and applications. The group aims to develop a central account chooser that allows users to select an identity provider from their browser using local storage. This would provide a better login experience than existing "username/password" or social login options. The document promotes the benefits of implementing the account chooser standard and provides links to related projects and resources.
OpenID Connect via WebIntents
This document discusses using WebIntents to enable OpenID Connect discovery. WebIntents allows for inter-app communication and discovery on smartphones. The document proposes standardizing intent action values and response formats to enable OpenID Connect providers to be discovered and registration/authorization flows delegated using WebIntents. This avoids the need for direct communication between relying parties and authorization servers.
OAuth 2.0 & OpenID Connect @ OpenSource Conference 2011 Tokyo #osc11tk
1. The document discusses OAuth 2.0 and OpenID Connect for API access control and authorization. It provides a brief history of OAuth and describes the core specification and response types.
2. The core specification defines two response types - code and token. The code response type uses authorization codes to obtain access tokens in a two-step process, while the token response type returns access tokens directly.
3. The document also covers token types, notably the bearer token which transmits no signature or secret and is commonly used for API access. It notes that some providers may not follow the latest OAuth draft specifications strictly.
Plus de Nov Matake (20)
SAML / OpenID Connect / OAuth / SCIM 技術解説 - ID&IT 2014 #idit2014
SAML / OpenID Connect / OAuth / SCIM 技術解説 - ID&IT 2014 #idit2014
OAuth 2.0 & OpenID Connect @ OpenSource Conference 2011 Tokyo #osc11tk
OAuth 2.0 & OpenID Connect @ OpenSource Conference 2011 Tokyo #osc11tk
Dernier
論文紹介：Deep Learning-Based Human Pose Estimation: A Survey
Ce Zheng, Wenhan Wu, Chen Chen, Taojiannan Yang, Sijie Zhu, Ju Shen, Nasser Kehtarnavaz, Mubarak Shah, "Deep Learning-Based Human Pose Estimation: A Survey" arXiv2020
https://arxiv.org/abs/2012.13392
「進化するアプリ イマ×ミライ ～生成AIアプリへ続く道と新時代のアプリとは～」Interop24Tokyo APPS JAPAN B1-01講演
進化するアプリ イマ×ミライ
～生成AIアプリへ続く道と新時代のアプリとは～
2024/6/12～14まで幕張メッセで開催されました、インターロップ併設アプリジャパンの展示会場内ROOM Bで、10:30～11:10の枠で登壇させてもらいましたセッション資料を公開します。
生成AIがもたらすコンテンツ経済圏の新時代 The New Era of Content Economy Brought by Generative AI
、コンテンツ制作の主体をプロのクリエーターからユーザーへと移行させている現状をご存じの方も多いでしょう。現在、画像コンテンツ制作現場では生成AIがクリエーターを支援するツールとして利用されています。セミナーでは、画像生成における自動化の境界についての議論が予定されています。
AIの利用には著作権や倫理的な問題も伴いますが、クリエーターとAIが共存し、センシング技術と統合することで新しい形のコンテンツが生み出されることが期待されています。
無形価値を守り育てる社会における「デー タ」の責務について - Atlas, Inc.
AI/IT系の会社だと「データ」は商売道具の一つかと思いますが、その「データ」って今の社会で一体どんな価値を持っていて、今後どのような責務を担わせるのが健全なのだろうか？という思考の発散をしてみました。
※喋りメインだったのでスライドだけだと内容薄いと思います, 気になった方はhttps://x.com/wox_aiまで。
Generating Automatic Feedback on UI Mockups with Large Language Models
Generating Automatic Feedback on UI Mockups with Large Language Modelsを和訳紹介したものです
Dernier (9)
論文紹介：Deep Learning-Based Human Pose Estimation: A Survey
論文紹介：Deep Learning-Based Human Pose Estimation: A Survey
「進化するアプリ イマ×ミライ ～生成AIアプリへ続く道と新時代のアプリとは～」Interop24Tokyo APPS JAPAN B1-01講演
「進化するアプリ イマ×ミライ ～生成AIアプリへ続く道と新時代のアプリとは～」Interop24Tokyo APPS JAPAN B1-01講演
生成AIがもたらすコンテンツ経済圏の新時代 The New Era of Content Economy Brought by Generative AI
生成AIがもたらすコンテンツ経済圏の新時代 The New Era of Content Economy Brought by Generative AI
Generating Automatic Feedback on UI Mockups with Large Language Models
Generating Automatic Feedback on UI Mockups with Large Language Models
ハイブリッドクラウド研究会_Hyper-VとSystem Center Virtual Machine Manager セッションMM
ハイブリッドクラウド研究会_Hyper-VとSystem Center Virtual Machine Manager セッションMM
ヒアラブルへの入力を想定したユーザ定義型ジェスチャ調査と IMUセンサによる耳タッチジェスチャの認識
ヒアラブルへの入力を想定したユーザ定義型ジェスチャ調査と IMUセンサによる耳タッチジェスチャの認識
Humanoid Virtual Athletics Challenge2024 技術講習会 スライド
Humanoid Virtual Athletics Challenge2024 技術講習会 スライド