認証と認可

Welcome to this lesson on Authentication & Authorization! These two concepts are fundamental pillars for securing any SaaS application.

Without them, anyone could access sensitive data or perform critical actions, leading to massive security breaches and a complete loss of user trust.

Authentication is the process of verifying a user's or system's identity. It's about answering the question: "Are you who you say you are?"

• Common methods: Username/password, multi-factor authentication (MFA), biometric scans, or digital certificates.
• Think of it as showing your ID to enter a building.

Successful authentication confirms identity; failure denies access.

Once a user is authenticated, Authorization determines what actions they are permitted to perform and what resources they can access. It answers: "What are you allowed to do here?"

• Examples: A standard user can view their own data, an admin can manage all users, a billing manager can only access financial reports.
• This is like the access card you use *inside* the building, granting entry to specific floors or rooms.

Authorization is crucial for fine-grained control and data segmentation in multi-tenant SaaS.

In traditional web applications, session-based authentication is common. After successful login, the server creates a 'session' and sends a unique session ID (often in a cookie) to the client.

• The server stores session data (user info, permissions).
• The client sends the session ID with each request.
• This approach is 'stateful' as the server must remember each user's session.

While simple, managing stateful sessions can be challenging for highly scalable, distributed SaaS architectures.

OAuth 2.0 is an authorization framework that enables third-party applications to obtain limited access to an HTTP service, on behalf of a resource owner (user).

• It's not an authentication protocol itself, but often used with OpenID Connect for authentication.
• Think of 'Login with Google' or 'Connect with Facebook' buttons.
• Users grant permission to an app without sharing their actual credentials.

OAuth is vital for integrating your SaaS with other services securely.

Understanding OAuth 2.0 involves a few key roles:

• Resource Owner: The user who owns the data (e.g., you).
• Client: The application requesting access to the user's data (e.g., your SaaS app).
• Authorization Server: The server that authenticates the resource owner and issues access tokens (e.g., Google's identity server).
• Resource Server: The server hosting the protected resources (e.g., Google Drive API).

The client uses an access token from the Authorization Server to access resources on the Resource Server.

JSON Web Tokens (JWTs) are a compact, URL-safe means of representing claims to be transferred between two parties. They are often used for stateless authentication in modern APIs.

• After login, a server issues a JWT to the client.
• The client stores this token (e.g., in local storage) and sends it with every API request.
• The server verifies the token without needing to store session data.

This 'stateless' nature makes JWTs excellent for scaling microservices and APIs.

A JWT consists of three parts, separated by dots (.):

• Header: Contains metadata like the token type (JWT) and the signing algorithm (e.g., HS256).
• Payload: Contains 'claims' – statements about an entity (the user) and additional data (e.g., user ID, roles, expiration time). This part is encoded, not encrypted, so don't put sensitive data here!
• Signature: Used to verify that the sender of the JWT is who it says it is and to ensure the message hasn't been tampered with. It's created using the header, payload, and a secret key.

When a client has a JWT, it typically sends it in the Authorization header of HTTP requests, usually prefixed with Bearer:

Authorization: Bearer <your_jwt_token>

The API gateway or microservice receiving the request can then:

• Verify the JWT's signature using the secret key.
• Decode the payload to extract user claims (e.g., user ID, roles).
• Use these claims to perform authorization checks.

This process is fast and efficient, as no database lookup is needed for token verification.

Test your understanding of authentication, authorization, OAuth 2.0, and JWTs.

In this lesson, we explored the critical concepts of Authentication (who you are) and Authorization (what you can do).

We learned how session-based authentication works and its limitations for scalable SaaS. We then delved into modern approaches like OAuth 2.0 for delegated authorization and JSON Web Tokens (JWTs) for efficient, stateless API security.

Mastering these concepts is essential for building secure, scalable, and trustworthy SaaS applications.