Ad（microsoftの方）のOpenId Connect対応

Deprecated: The each() function is deprecated. This message will be suppressed on further calls in /home/zhenxiangba/zhenxiangba.com/public_html/phproxy-improved-master/index.php on line 456
Ad（microsoftの方）のOpenId Connect対応

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

AD（Microsoftの方）の
OpenID Connect対応
2014/04/25 #idcon vol.18
Naohiro Fujie
@phr_eidentity
http://idmlab.eidentity.jp

AD?
Advertising Active Directory
越後屋のチラシ
出典：wikipedia

Active Directory
•Windows Server Active Directory
•Microsoft Azure Active Directory

Overview

Azure AD for Developers
• Identity Provider
• ディレクトリサービスとして : Users/Groups (sync with WSAD)
• プロトコル・サポート : SAML, ws-federa...

Identity Provider
Application
SAML-SP
Application
ws-fed RP
Application
OpenID
Connect RP
Microsoft
Account
Azure AD
Accou...

Identity Provider
Application
SAML-SP
Application
ws-fed RP
Application
OpenID
Connect RP
Microsoft
Account
Azure AD
Accou...

OpenID Connect Support
https://login.windows.net/nfujie2.onmicrosoft.com/.well-known/openid-configuration
{
"issuer":"http...

Sequence(ASP.NET MVC5 App)

Authorization Server
OAuth2.0
AuthZ/Token
EndPoint
OAuth2.0
Client
WebAPI
Registry
Register as a protected resource
(use m...

$WebAPIの登録とパーミッションの登録 "appPermissions": [ { "claimValue": "user_impersonation", "description": "Allow the application full ...$

クライアント・ライブラリ
• OWIN : Open Web Interface for .NET(http://owin.org)
• サーバを抽象化したインターフェースを提供
• IIS/ASP.NETだけでなくセルフホスト（ネイティブアプ...

$OWIN OpenIdConnect Middleware app.UseOpenIdConnectAuthentication( new OpenIdConnectAuthenticationOptions { Client_Id = "be...$

OpenIdConnectAuthenticationNotifications
以下のイベントに応じて処理を記述
※今のところPOSTにしか反応しない。response_mode=form_postがデフォルトの理由？
• AccessCod...

AccessCodeRecieved:code->token
Notifications = new OpenIdConnectAuthenticationNotifications()
{
AccessCodeReceived = (cont...

DEMO
ASP.NET MVC
Sign in : id_token
Graph API access : code->access token

まとめ
• Active Directoryにも2つあります
• Windows Server Active Directory
• Microsoft Azure Active Directory
• Microsoft Azure Acti...