高度な OAuth フロー — CIBA、Device Flow、DPoP が必要になる瞬間

+----------+                         +---------------+
|  TV/CLI  |                         |  認可サーバー  |
| (デバイス)|                         |               |
+----+-----+                         +-------+-------+
     |  (1) POST /device_authorization      |
     | ------------------------------------>|
     |  (2) device_code + user_code +       |
     |      verification_uri                |
     | <------------------------------------|
     |                                      |
     |  (3) 画面に表示:                      |
     |  「example.com/device で              |
     |   コード WDJB-MJHT を入力」            |
     |                                      |
     |        +----------+ (4) スマホの      |
     |        | ユーザーの| ブラウザで        |
     |        | スマホ    | ---------------->|
     |        +----------+ コード入力+ログイン+同意
     |                                      |
     |  (5) その間デバイスはポーリング         |
     |  POST /token (device_code)           |
     | ------------------------------------>|
     |  authorization_pending ...           |
     | <------------------------------------|
     |  (6) ユーザー承認完了後                |
     |  access_token を発行                 |
     | <------------------------------------|
     v                                      v

POST /realms/prod/protocol/openid-connect/auth/device HTTP/1.1
Host: idp.example.com
Content-Type: application/x-www-form-urlencoded

client_id=smart-tv-app&scope=openid%20profile

{
  "device_code": "GmRhmhcxhwAzkoEqiMEg_DnyEysNkuNhszIySk9eS",
  "user_code": "WDJB-MJHT",
  "verification_uri": "https://idp.example.com/realms/prod/device",
  "verification_uri_complete": "https://idp.example.com/realms/prod/device?user_code=WDJB-MJHT",
  "expires_in": 600,
  "interval": 5
}

POST /realms/prod/protocol/openid-connect/token HTTP/1.1
Host: idp.example.com
Content-Type: application/x-www-form-urlencoded

grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code
&device_code=GmRhmhcxhwAzkoEqiMEg_DnyEysNkuNhszIySk9eS
&client_id=smart-tv-app

{
  "error": "authorization_pending",
  "error_description": "The authorization request is still pending"
}

# クライアントに device authorization grant を有効化
kcadm.sh update clients/CLIENT-UUID -r prod \
  -s 'attributes."oauth2.device.authorization.grant.enabled"="true"'

# realm レベルでコード寿命/ポーリング間隔を調整
kcadm.sh update realms/prod \
  -s 'attributes."oauth2DeviceCodeLifespan"="600"' \
  -s 'attributes."oauth2DevicePollingInterval"="5"'

+------------+                      +-----------+                +----------+
| オペレーター|                      | 認可サーバー|                | 顧客の    |
| システム(CC)|                      |           |                | スマホ    |
+-----+------+                      +-----+-----+                +----+-----+
      | (1) POST /ext/ciba/auth          |                            |
      |  login_hint=顧客識別子            |                            |
      | --------------------------------->|                           |
      | (2) auth_req_id を返却            |                           |
      | <---------------------------------|                           |
      |                                   | (3) 認証デバイスへプッシュ  |
      |                                   | ------------------------->|
      |                                   | (4) 顧客が生体認証で承認    |
      |                                   | <-------------------------|
      | (5) poll: POST /token             |                           |
      |  grant_type=ciba, auth_req_id     |                           |
      | --------------------------------->|                           |
      | (6) access_token                  |                           |
      | <---------------------------------|                           |
      v                                   v                           v

POST /realms/prod/protocol/openid-connect/ext/ciba/auth HTTP/1.1
Host: idp.example.com
Authorization: Basic Y2FsbC1jZW50ZXI6czNjcjN0
Content-Type: application/x-www-form-urlencoded

login_hint=customer-01087654321
&scope=openid%20account%3Aread
&binding_message=CS-4711
&requested_expiry=120

{
  "auth_req_id": "1c266114-a1be-4252-8ad1-04986c5b9ac1",
  "expires_in": 120,
  "interval": 5
}

POST /realms/prod/protocol/openid-connect/token HTTP/1.1
Host: idp.example.com
Authorization: Basic Y2FsbC1jZW50ZXI6czNjcjN0
Content-Type: application/x-www-form-urlencoded

grant_type=urn%3Aopenid%3Aparams%3Agrant-type%3Aciba
&auth_req_id=1c266114-a1be-4252-8ad1-04986c5b9ac1

# realm CIBA ポリシー設定例
kcadm.sh update realms/prod \
  -s 'attributes."cibaBackchannelTokenDeliveryMode"="poll"' \
  -s 'attributes."cibaExpiresIn"="120"' \
  -s 'attributes."cibaInterval"="5"'

# クライアントに CIBA grant を有効化
kcadm.sh update clients/CLIENT-UUID -r prod \
  -s 'attributes."oidc.ciba.grant.enabled"="true"'

{
  "typ": "dpop+jwt",
  "alg": "ES256",
  "jwk": {
    "kty": "EC",
    "crv": "P-256",
    "x": "l8tFrhx-34tV3hRICRDY9zCkDlpBhF42UQUfWVAWBFs",
    "y": "9VE4jf_Ok_o64zbTTlcuNJajHmt6v9TDVrU0CdvGRDA"
  }
}

{
  "jti": "-BwC3ESc6acc2lTc",
  "htm": "POST",
  "htu": "https://idp.example.com/realms/prod/protocol/openid-connect/token",
  "iat": 1781234567
}

GET /api/accounts HTTP/1.1
Host: api.example.com
Authorization: DPoP eyJhbGciOiJFUzI1NiIs...
DPoP: eyJ0eXAiOiJkcG9wK2p3dCIs...

# クライアントに DPoP バインディングを強制
kcadm.sh update clients/CLIENT-UUID -r prod \
  -s 'attributes."dpop.bound.access.tokens"="true"'

#!/usr/bin/env bash
set -euo pipefail

IDP="https://idp.example.com/realms/prod/protocol/openid-connect"
CLIENT_ID="internal-cli"

# 1. device authorization リクエスト
resp=$(curl -s -X POST "$IDP/auth/device" \
  -d "client_id=$CLIENT_ID" -d "scope=openid profile")

device_code=$(echo "$resp" | jq -r .device_code)
user_code=$(echo "$resp" | jq -r .user_code)
verification_uri=$(echo "$resp" | jq -r .verification_uri)
interval=$(echo "$resp" | jq -r .interval)

echo "ブラウザで $verification_uri を開き、"
echo "コード [$user_code] を入力してください。"

# 2. 承認されるまでポーリング
while true; do
  sleep "$interval"
  token_resp=$(curl -s -X POST "$IDP/token" \
    -d "grant_type=urn:ietf:params:oauth:grant-type:device_code" \
    -d "device_code=$device_code" \
    -d "client_id=$CLIENT_ID")

  error=$(echo "$token_resp" | jq -r '.error // empty')
  case "$error" in
    "") break ;;                                # 成功
    authorization_pending) continue ;;          # 待機中
    slow_down) interval=$((interval + 5)) ;;    # 間隔を拡大
    expired_token)
      echo "コードの有効期限が切れました。再試行してください。" >&2; exit 1 ;;
    *) echo "エラー: $error" >&2; exit 1 ;;
  esac
done

access_token=$(echo "$token_resp" | jq -r .access_token)
echo "トークン発行完了（先頭 20 文字）: $(echo "$access_token" | cut -c1-20)..."