「認証は OIDC 等のデファクトに乗っておけ」
というのはわかりました。ではその次。認証した後です。
残念ながらアクセス制御の枠組みにはデファクトがありません。
自分で設計するしかないのです。 しかし、我々は漠然と車輪の再発明を続ければいいのでしょうか。アクセス制御にスタンダードが無いなら無いなりに、
どのようにアクセス制御機構を整備すればいいのか？その考え方を整理していきましょう。

2. URL
Attention
https://bit.ly/devio2019-authz

3. #cmdevio #cmdevio2
✦
✦
✦
✦
✦
✦
✦
✦
✦
Twitter @daisuke_m

4. #cmdevio #cmdevio2

5. #cmdevio #cmdevio2

6. #cmdevio #cmdevio2
API
UI

7. #cmdevio #cmdevio2
✦
✦
✦
✦
✦
✦
✦
total
45 min

8. #cmdevio #cmdevio2
4
ADI, ADF

9. #cmdevio #cmdevio2

10. #cmdevio #cmdevio2

11. #cmdevio #cmdevio2
✦
✦
✦

12. #cmdevio #cmdevio2
4
ADI, ADF

13. #cmdevio #cmdevio2
※
( )

14. #cmdevio #cmdevio2
@PreAuthorize @PostAuthorize
@PreFilter @PostFilter
※
Java Spring Security

15. #cmdevio #cmdevio2
4
ADI, ADF

16. #cmdevio #cmdevio2
¥20,856

17. #cmdevio #cmdevio2
✦
adf: (adi) ↦ allow/deny (boolean)
✦
✦
✦

18. #cmdevio #cmdevio2
✦
✦
✦
✦
✦
✦

19. #cmdevio #cmdevio2
✦ Referer
✦
✦
✦
✦
✦

20. #cmdevio #cmdevio2

21. #cmdevio #cmdevio2
✦
✦
✦
✦
✦
✦

22. #cmdevio #cmdevio2
4
ADI, ADF

23. #cmdevio #cmdevio2
✦
✦
✦
✦
✦
✦

24. #cmdevio #cmdevio2
emps.create({
"id": "ezaki"
});
POST /emps
{
"id": "ezaki"
}

25. #cmdevio #cmdevio2
✦

26. #cmdevio #cmdevio2
✦
✦ CreateEmp ListEmp GetEmp
UpdateEmp DeleteEmp
✦
✦
✦
✦
AWS

27. #cmdevio #cmdevio2
✦
adf: (adi) ↦ allow/deny (boolean)
@RequestMapping
fun getEmp(param: Any, adi: AccessDicisionInfo) {
if (adf(adi) == false) {
throw AccessDeniedException()
}
val resource = service.getEmp(param)
return Response.ok(resource)
}

28. #cmdevio #cmdevio2
ADI
adf

29. #cmdevio #cmdevio2
✦
✦
✦ adi.action

30. #cmdevio #cmdevio2
adi.sub.authorities
✦
{
"name": "ezaki",
"authorities": [
"ListEmp",
"GetEmp",
"UpdateEmp",
"UpdateEmpByAdmin"
]
}
{
"name": "takada",
"authorities": [
"ListEmp",
"UpdateEmp"
]
}
fun adf(adi: AccessDecisionInfo) {
return adi.sub.authorities.contains(adi.action)
}

31. #cmdevio #cmdevio2
✦
✦ UpdateEmp
UpdateEmp("kaga", {
"name": " "
})
UpdateEmp("kaga", {
"salary": 888888
})
by kaga by kaga
200 OK 403 Forbidden

32. #cmdevio #cmdevio2
✦
✦ UpdateEmp
✦ UpdateEmpByAdmin
✦

33. #cmdevio #cmdevio2
✦
✦
UpdateEmpByAdmin("kaga", {
"salary": 888888
})
UpdateEmp("kaga", {
"name": " "
})
UpdateEmpByAdmin UpdateEmp
200 OK (by ezaki) 200 OK (by kaga)
( API )403 Forbidden (by takada)

34. #cmdevio #cmdevio2
✦
✦ adi.action
✦ adi.sub.authorities
✦ adf
✦ adi.action adi.sub.authorities
✦ contains

35. #cmdevio #cmdevio2

36. #cmdevio #cmdevio2

37. #cmdevio #cmdevio2
postFilter
✦
✦ GetEmp
{
"id": "kaga",
"address": "...",
"name": "Kaga Masaru",
"tel": "090-0000-0006",
"salary": 999999,
"dept": 2
}
{
"id": "kaga",
"name": "Kaga Masaru",
"tel": "090-0000-0006",
"dept": 2
}
by ezaki by takada

38. #cmdevio #cmdevio2
✦
✦
✦
GetEmpByAdmin GetEmp
{
"id": "kaga",
"address": "...",
"name": "Kaga Masaru",
"tel": "090-0000-0006",
"salary": 999999,
"dept": 2
}
{
"id": "kaga",
"name": "Kaga Masaru",
"tel": "090-0000-0006",
"dept": 2
}

39. #cmdevio #cmdevio2
✦
✦
✦ ListEmp
✦
✦ ListEmp ListEmpForPartner
✦ ListEmp ListEmpForPartner

40. #cmdevio #cmdevio2
✦
✦
✦
✦
✦
✦
✦
✦

41. #cmdevio #cmdevio2

42. #cmdevio #cmdevio2
✦
✦ ezaki UpdateEmp("ezaki", p) name
✦ ezaki UpdateEmp("kanou", p) name
✦
✦
UpdateEmp

43. #cmdevio #cmdevio2
✦
/emps/ezaki
✦
✦ adi.obj.owner
✦ adi.sub.name adi.obj.owner
✦ adi.obj.owner

44. #cmdevio #cmdevio2
✦
{
"id": "ezaki",
"owner": "ezaki",
// ...
}
{
"id": "kanou",
"owner": "kanou",
// ...
}
fun adf(adi: AccessDecisionInfo) {
return adi.sub.name == adi.obj.owner
}

45. #cmdevio #cmdevio2
✦
✦ ezaki UpdateEmp("kaga", p) name
✦ ezaki UpdateEmp("ushijima", p) name
✦
✦

46. #cmdevio #cmdevio2
✦
✦ authorities
✦
✦

47. #cmdevio #cmdevio2
✦
{
"id": "kaga",
"acl": [
{ ezaki
UpdateEmp }
],
// ...
}
{
"id": "ushijima",
"acl": [],
// ...
}
fun adf(adi: AccessDecisionInfo) {
return adi.obj.acl.allow(adi.sub, adi.action)
}

48. #cmdevio #cmdevio2
✦ { ezaki UpdateEmp }
✦
{
"effect": "allow",
"action": "UpdateEmp",
"authority": "Leader"
}
{
"name": "ezaki",
"authorities": [
"Leader",
// ...
]
}
obj ADI ( ) sub ADI

49. #cmdevio #cmdevio2
✦
✦
✦ adf
✦
✦ adi.action
✦ adi.sub.name
✦ adi.sub.authorities
✦ adi.obj.owner
✦ adi.obj.acl
✦

50. #cmdevio #cmdevio2
https://classmethod.jp/recruit/
https://prismatix.jp/recruit/