ritou

すきっちゅーの！
ぱすきーっちゅーの！
好きになっちゃダメっつーの？
すきっちゅーの！
ぱすきっちゅーの！
パスワードとかいらんちゅーのchu!

顔だ！指紋だ！という貴方
面と向かってそれ言えます？

ritou

1. HTTP Client module

  defmodule Your.HttpClient do
    @behaviour Scratcher.HttpClient
    def request(method, url, body, headers, http_opts) do

      # use hackney, httpoison, httpotion...

 {:ok, %{status_code: 200, body: "..."}}

ritou

iex(1)> Application.ensure_all_started(:hackney)
{:ok,
 [:unicode_util_compat, :idna, :mimerl, :certifi, :syntax_tools, :parse_trans,
  :ssl_verify_fun, :metrics, :hackney]}
  
iex(2)> :hackney.request(:get, "https://example.com", [], "", [:with_body])
{:ok, 200,
 [
   {"Accept-Ranges", "bytes"},

ritou

iex(1)> JOSE.crypto_fallback(true)
:ok
iex(2)> JOSE.JWK.generate_key({:okp, :Ed25519})
%JOSE.JWK{
  fields: %{},
  keys: :undefined,
  kty: {:jose_jwk_kty_okp_ed25519,
   <<162, 30, 40, 233, 122, 159, 105, 49, 218, 101, 29, 205, 178, 236, 20, 132,
     14, 29, 119, 147, 44, 162, 49, 141, 96, 128, 117, 109, 21, 56, 64, 160, 4,

ritou

$ curl -i "https://same-site-cookie-tester.gigalixirapp.com/set_cookie"
HTTP/2 302 
server: nginx/1.17.7
date: Mon, 24 Aug 2020 01:36:18 GMT
content-type: text/html; charset=utf-8
content-length: 67
cache-control: max-age=0, private, must-revalidate
cross-origin-window-policy: deny
location: /

ritou

Application State

{
  "next_url":"/account/settings",
  ...
  "foo":"bar"
}

ritou

OIDCIBADEMO 使い方

関連仕様

• OpenID Connect Client Initiated Backchannel Authentication Flow - Core 1.0 draft-02
• OpenID Connect Discovery 1.0 incorporating errata set 1
• OpenID Connect Dynamic Client Registration 1.0 incorporating errata set 1
• OpenID Connect Extended Authentication Profile (EAP) ACR Values 1.0 - draft 00

Authentication Device の準備

ritou

ChromeのFIDO CTAP2 PIN support動作確認メモ

Chrome 75 Beta: low latency canvas contexts, sharing files, and numeric separators

Web Authentication API: FIDO CTAP2 PIN support
This feature extends Chrome's implementation of the Web Authentication API to support local user authorization of security key operations via a user-defined PIN for keys that implement the FIDO CTAP2 protocol. Web sites using web authentication can request or require such authorization via the API's user verification mechanisms.

Registration

ritou

Interop result with WebAuthnKit and WebAuthnLite. parameters is from https://github.com/lyokato/WebAuthnKit/blob/develop/utils/interop/go_koesie10_webauthn/main.go

iex(1)> origin = "https://example.org"
"https://example.org"
iex(2)> challenge = "rtnHiVQ7"
"rtnHiVQ7"
iex(3)> encoded_registration_client_data_json = "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoicnRuSGlWUTciLCJvcmlnaW4iOiJodHRwczpcL1wvZXhhbXBsZS5vcmcifQ"
"eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoicnRuSGlWUTciLCJvcmlnaW4iOiJodHRwczpcL1wvZXhhbXBsZS5vcmcifQ"

ritou

＃ JOSE.JWK を用いて鍵を作成
iex(1)> jwk = JOSE.JWK.generate_key(:secp256r1)
%JOSE.JWK{
  fields: %{},
  keys: :undefined,
  kty: {:jose_jwk_kty_ec,
   {:ECPrivateKey, 1,
    <<37, 161, 110, 23, 211, 111, 64, 142, 98, 207, 153, 90, 139, 91, 212, 33,