{"id":59520,"date":"2023-04-14T12:00:41","date_gmt":"2023-04-14T03:00:41","guid":{"rendered":"https:\/\/www.creationline.com\/?p=59520"},"modified":"2023-04-18T14:24:42","modified_gmt":"2023-04-18T05:24:42","slug":"keycloak-21-0-2-%e3%81%a7-%e3%82%af%e3%83%a9%e3%82%a4%e3%82%a2%e3%83%b3%e3%83%88%e3%83%9d%e3%83%aa%e3%82%b7%e3%83%bc-fapi1-advanced-%e3%82%92%e8%a9%a6%e3%81%99-keycloak-ciba-oauth-oidc","status":"publish","type":"post","link":"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520","title":{"rendered":"Keycloak (21.0.2) \u3067 \u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc + FAPI1 advanced \u3092\u8a66\u3059 #keycloak #oauth #oidc"},"content":{"rendered":"<h2 id=\"1-%E7%9B%AE%E6%AC%A1\" class=\"code-line\" dir=\"auto\" data-line=\"2\">1. \u76ee\u6b21<a id=\"index1\"><\/a><\/h2>\n<ol class=\"code-line\" dir=\"auto\" data-line=\"3\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"3\"><a href=\"#index1\">\u76ee\u6b21<\/a><\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"4\"><a href=\"#index2\">\u6982\u8981<\/a><br \/>\n<a href=\"#index2.1\">2.1 \u672c\u8a18\u4e8b\u5185\u3067\u306e\u7565\u79f0\u306b\u3064\u3044\u3066<\/a><br \/>\n<a href=\"#index2.2\">2.2 \u4eca\u56de\u306e\u8a18\u4e8b\u3067\u8aac\u660e\u3059\u308b\u7b87\u6240<\/a><br \/>\n<a href=\"#index2.3\">2.3 \u4eca\u56de\u306e\u8a18\u4e8b\u3067\u8aac\u660e\u3057\u306a\u3044\u7b87\u6240<\/a><\/li>\n<\/ol>\n<ol class=\"code-line\" dir=\"auto\" start=\"3\" data-line=\"8\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"8\"><a href=\"#index3\">\u74b0\u5883\u306e\u8aac\u660e<\/a><br \/>\n<a href=\"#index3.1\">3.1 \u30ec\u30eb\u30e0\u306e\u8a2d\u5b9a<\/a><br \/>\n<a href=\"#index3.2\">3.2 \u30e6\u30fc\u30b6\u30fc\u306e\u8a2d\u5b9a<\/a><br \/>\n<a href=\"#index3.3\">3.3 \u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306e\u8a2d\u5b9a<\/a><br \/>\n<a href=\"#index3.4\">3.4 \u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc\u306e\u8a2d\u5b9a<\/a><\/li>\n<\/ol>\n<ol class=\"code-line\" dir=\"auto\" start=\"4\" data-line=\"13\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"13\">\n<div>\n<div><a href=\"#index4\">\u524d\u56de\u306e\u8a18\u4e8b\u306e\u632f\u308a\u8fd4\u308a<\/a><\/div>\n<\/div>\n<\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"14\"><a href=\"#index5\">mTLS\u5bfe\u5fdc<\/a><br \/>\n<a href=\"#index5.2\">5.1 OAuth2 \u306b\u95a2\u9023\u3059\u308bmTLS\u306e\u4ed5\u69d8<\/a><br \/>\n<a href=\"#index5.2\">5.2 docker-compose \u306e\u4fee\u6b63<\/a><br \/>\n<a href=\"#index5.3\">5.3 CA\u7528\u306e\u9375\u3068\u8a3c\u660e\u66f8\u306e\u4f5c\u6210<\/a><br \/>\n<a href=\"#index5.4\">5.4 \u30b5\u30fc\u30d0\u30fc\u3067\u7528\u3044\u308bHTTPS\u7528\u306e\u9375\u3084\u8a3c\u660e\u66f8\u306a\u3069\u306e\u4f5c\u6210<\/a><br \/>\n<a href=\"#index5.5\">5.5 \u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u7528\u306e\u9375\u3084\u8a3c\u660e\u66f8\u306a\u3069\u306e\u4f5c\u6210<\/a><br \/>\n<a href=\"#index5.6\">5.6 Keycloak\u5074\u3067\u306e\u8a2d\u5b9a<\/a><\/li>\n<\/ol>\n<ol class=\"code-line \" dir=\"auto\" start=\"6\" data-line=\"19\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"19\"><a href=\"#index6\">\u30ea\u30af\u30a8\u30b9\u30c8\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u5bfe\u5fdc<\/a><br \/>\n<a href=\"#index6.1\">6.1 JWS\u306b\u4f7f\u3046\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u306e\u691c\u8a0e<\/a><br \/>\n<a href=\"#index6.2\">6.2 JWS\u306b\u4f7f\u3046\u9375\u60c5\u5831\u3068JWKS\u306e\u4f5c\u6210<\/a><br \/>\n<a href=\"#index6.3\">6.3 Keycloak\u304b\u3089JWKS\u306e\u8a2d\u5b9a<\/a><br \/>\n<a href=\"#index6.4\">6.4 \u30ea\u30af\u30a8\u30b9\u30c8\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u4f5c\u6210<\/a><br \/>\n<a href=\"#index6.5\">6.5 JWS\u4ed8\u304d\u306e\u8a8d\u53ef\u30ea\u30af\u30a8\u30b9\u30c8\u306e\u4f5c\u6210\u30fb\u9001\u4fe1<\/a><br \/>\n<a href=\"#index6.6\">6.6 Detached Signature<\/a><br \/>\n<a href=\"#index6.7\">6.7 \u30c8\u30fc\u30af\u30f3\u30ea\u30af\u30a8\u30b9\u30c8<\/a><\/li>\n<\/ol>\n<ol class=\"code-line\" dir=\"auto\" start=\"7\" data-line=\"26\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"26\"><a href=\"#index7\">\u5f8c\u66f8\u304d<\/a><\/li>\n<\/ol>\n<h2 id=\"2-%E6%A6%82%E8%A6%81\" class=\"code-line\" dir=\"auto\" data-line=\"28\">2. \u6982\u8981<a id=\"index2\"><\/a><\/h2>\n<hr class=\"code-line\" dir=\"auto\" data-line=\"28\" \/>\n<p class=\"code-line\" dir=\"auto\" data-line=\"32\">shiba \u30c1\u30fc\u30e0\u306e\u4e2d\u6751\u3067\u3059\u3002<a href=\"\/lab\/46316\" data-href=\"\/lab\/46316\">\u524d\u56de\u306e\u8a18\u4e8b<\/a>\u3067\u306f Keycloak \u3067\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc\u3092\u8a2d\u5b9a\u3057\u305f\u5f8c\u3067\u00a0<a href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-1-1_0-final.html\" data-href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-1-1_0-final.html\">Financial-grade API Security Profile 1.0 - Part 1: Baseline<\/a>\u00a0\u306e\u52d5\u304d\u3092\u78ba\u8a8d\u3057\u3066\u3044\u304d\u307e\u3057\u305f\u3002\u3057\u304b\u3057\u3001<a href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html\" data-href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html\">Financial-grade API Security Profile 1.0 - Part 2: Advanced<\/a>\u00a0\u306b\u5bfe\u5fdc\u3059\u308b\u4e8b\u306f\u884c\u3063\u3066\u3044\u307e\u305b\u3093\u3067\u3057\u305f\u3002\u305d\u3053\u3067\u4eca\u56de\u306e\u8a18\u4e8b\u3067\u306f\u00a0<a href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html\" data-href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html\">Financial-grade API Security Profile 1.0 - Part 2: Advanced<\/a>\u00a0\u3078\u5bfe\u5fdc\u3057\u3066\u3044\u304d\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"36\">\u307e\u305f\u3001\u4eca\u56de\u3082\u4e00\u7dd2\u306b\u691c\u8a3c\u3057\u3066\u3044\u304f\u3088\u3046\u306b\u767a\u751f\u3057\u305d\u3046\u306a\u30a8\u30e9\u30fc\u3092\u8e0f\u307f\u6f70\u3057\u306a\u304c\u3089\u8a66\u3057\u3066\u3044\u304d\u307e\u3059\u306e\u3067\u3001 FAPI \u3084 Keycloak \u3092\u65e2\u306b\u304a\u8a73\u3057\u3044\u65b9\u3084\u3001\u7d50\u679c\u3060\u3051\u77e5\u308a\u305f\u3044\u65b9\u306f\u9069\u6642\u8aad\u307f\u98db\u3070\u3057\u306a\u304c\u3089\u3054\u78ba\u8a8d\u304f\u3060\u3055\u3044\u3002<\/p>\n<h3 id=\"21-%E6%9C%AC%E8%A8%98%E4%BA%8B%E5%86%85%E3%81%A7%E3%81%AE%E7%95%A5%E7%A7%B0%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6\" class=\"code-line\" dir=\"auto\" data-line=\"35\">2.1 \u672c\u8a18\u4e8b\u5185\u3067\u306e\u7565\u79f0\u306b\u3064\u3044\u3066<a id=\"index2.1\"><\/a><\/h3>\n<hr class=\"code-line\" dir=\"auto\" data-line=\"36\" \/>\n<p class=\"code-line\" dir=\"auto\" data-line=\"37\">\u672c\u8cc7\u6599\u3067\u306f\u4ee5\u964d\u306e\u8cc7\u6599\u306b\u304a\u3044\u3066\u3001\u4e0b\u8a18\u306e\u3088\u3046\u306b\u540d\u79f0\u3092\u7701\u7565\u3057\u3066\u8868\u8a18\u3057\u307e\u3059\u3002<\/p>\n<table class=\"code-line\" dir=\"auto\" data-line=\"39\">\n<thead class=\"code-line\" dir=\"auto\" data-line=\"39\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"39\">\n<th>\u540d\u79f0<\/th>\n<th>\u7565\u79f0<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"code-line\" dir=\"auto\" data-line=\"41\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"41\">\n<td>Financial-grade API<\/td>\n<td>FAPI<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"42\">\n<td>Financial-grade API Security Profile 1.0 - Part 1: Baseline<\/td>\n<td>FAPI1 Baseline<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"43\">\n<td>Financial-grade API Security Profile 1.0 - Part 2: Advanced<\/td>\n<td>FAPI1 Advanced<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3 id=\"22-%E5%BD%93%E8%A8%98%E4%BA%8B%E3%81%A7%E8%AA%AC%E6%98%8E%E3%81%99%E3%82%8B%E5%86%85%E5%AE%B9\" class=\"code-line\" dir=\"auto\" data-line=\"45\">2.2 \u5f53\u8a18\u4e8b\u3067\u8aac\u660e\u3059\u308b\u5185\u5bb9<a id=\"index2.2\"><\/a><\/h3>\n<hr class=\"code-line\" dir=\"auto\" data-line=\"46\" \/>\n<p class=\"code-line\" dir=\"auto\" data-line=\"47\">\u4eca\u56de\u306e\u8a18\u4e8b\u3067\u306f\u4e3b\u306b\u4e0b\u8a18\u306e\u90e8\u5206\u306b\u3064\u3044\u3066\u89e3\u8aac\u3057\u3066\u3044\u304d\u307e\u3059\u3002<\/p>\n<ul class=\"code-line\" dir=\"auto\" data-line=\"49\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"49\">Keycloak 21.0.2 \u3092\u7528\u3044\u3066\u306e\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc\u306e\u6319\u52d5<\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"50\">\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc\u3068\u3057\u3066 FAPI1 Advanced \u3092\u8a2d\u5b9a\u3057\u305f\u6642\u306e\u30ea\u30af\u30a8\u30b9\u30c8\u3068\u30ec\u30b9\u30dd\u30f3\u30b9\u306e\u4f8b<\/li>\n<\/ul>\n<h3 id=\"23-%E5%BD%93%E8%A8%98%E4%BA%8B%E3%81%A7%E8%AA%AC%E6%98%8E%E3%81%97%E3%81%AA%E3%81%84%E5%86%85%E5%AE%B9\" class=\"code-line\" dir=\"auto\" data-line=\"52\">2.3 \u5f53\u8a18\u4e8b\u3067\u8aac\u660e\u3057\u306a\u3044\u5185\u5bb9<a id=\"index2.3\"><\/a><\/h3>\n<hr class=\"code-line\" dir=\"auto\" data-line=\"53\" \/>\n<ul class=\"code-line\" dir=\"auto\" data-line=\"55\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"55\">FAPI \u306b\u95a2\u3059\u308b\u8a73\u7d30\u306a\u8aac\u660e<\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"56\">Keycloak \u306e\u8a73\u7d30\u306a\u8aac\u660e<\/li>\n<\/ul>\n<h2 id=\"3-%E7%92%B0%E5%A2%83%E3%81%AE%E8%AA%AC%E6%98%8E\" class=\"code-line\" dir=\"auto\" data-line=\"58\">3. \u74b0\u5883\u306e\u8aac\u660e<a id=\"index3\"><\/a><\/h2>\n<hr class=\"code-line\" dir=\"auto\" data-line=\"59\" \/>\n<p class=\"code-line\" dir=\"auto\" data-line=\"60\">\u524d\u56de\u306e\u74b0\u5883\u306f Keycloak \u306e 16.1.1 \u3092\u7528\u3044\u3066\u8a66\u3057\u3066\u3044\u307e\u3057\u305f\u304c\u3001\u4eca\u56de\u306f\u73fe\u6642\u70b9\u3067\u6700\u65b0\u306b\u8fd1\u3044Keycloak 21.0.1 \u7528\u3044\u3066\u691c\u8a3c\u3092\u9032\u3081\u3066\u3044\u304d\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"62\">\u307e\u305f\u3001Keycloak 17.0.0 \u304b\u3089 Quarkus \u30d9\u30fc\u30b9\u306e\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u304c\u4f7f\u7528\u3055\u308c\u306f\u3058\u3081\u307e\u3057\u305f\u304c\u3001Keycloak 20.0.0 \u304b\u3089 WildFly \u306e\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u304c\u524a\u9664\u3055\u308c\u307e\u3057\u305f\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"64\">\u305d\u308c\u306b\u5408\u308f\u305b\u3066\u672c\u8cc7\u6599\u3082 Quarkus \u30d9\u30fc\u30b9\u306eKeycloak\u3092\u524d\u63d0\u3068\u3059\u308b\u306b\u3042\u305f\u308a\u3001\u524d\u56de\u306e\u8cc7\u6599(WildFly\u30d9\u30fc\u30b9\u306eKeycloak)\u3068\u6bd4\u8f03\u3057\u3066\u4e3b\u306b\u4e0b\u8a18\u306e\u5909\u66f4\u70b9\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<ol class=\"code-line code-active-line\" dir=\"auto\" data-line=\"66\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"66\">Keycloak \u306e\u69cb\u6210\u304c\u5927\u5e45\u306b\u5909\u66f4<\/li>\n<li class=\"code-line \" dir=\"auto\" data-line=\"67\">\u30c7\u30d5\u30a9\u30eb\u30c8\u306e\u30b3\u30f3\u30c6\u30ad\u30b9\u30c8\u30d1\u30b9\u304b\u3089 \/auth \u304c\u524a\u9664<\/li>\n<\/ol>\n<p class=\"code-line \" dir=\"auto\" data-line=\"69\">\u305d\u306e\u4ed6\u306e\u5909\u66f4\u70b9\u306b\u3064\u3044\u3066\u306f<a href=\"https:\/\/www.keycloak.org\/migration\/migrating-to-quarkus\" data-href=\"https:\/\/www.keycloak.org\/migration\/migrating-to-quarkus\">\u3053\u3061\u3089<\/a>\u3092\u3054\u78ba\u8a8d\u304f\u3060\u3055\u3044\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"71\">\u307e\u305a1\u306b\u3064\u3044\u3066\u3067\u3059\u304c\u3001docker-compose.yml \u306f\u4e0b\u8a18\u306e\u3088\u3046\u306b\u5909\u66f4\u3055\u308c\u307e\u3059\u3002<\/p>\n<h4 id=\"%E5%89%8D%E5%9B%9E%E3%81%BE%E3%81%A7%E3%81%AE-docker-composeyml\" class=\"code-line\" dir=\"auto\" data-line=\"72\">\"\u524d\u56de\u307e\u3067\u306e\" docker-compose.yml<\/h4>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">version: '3.8'\r\nservices:\r\n  keycloak:\r\n    container_name: keycloak\r\n    image: jboss\/keycloak:16.1.1\r\n    command: -b 0.0.0.0\r\n    ports:\r\n      - \"8088:8080\"\r\n    environment:\r\n      KEYCLOAK_USER: admin\r\n      KEYCLOAK_PASSWORD: password<\/pre>\n<p>&nbsp;<\/p>\n<h4 class=\"code-line\" dir=\"auto\" data-line=\"72\">\"\u4eca\u56de\u306e\" docker-compose.yml<\/h4>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">services:\r\n  keycloak:\r\n    container_name: keycloak\r\n    image: quay.io\/keycloak\/keycloak:21.0.2\r\n    entrypoint: [\"\/opt\/keycloak\/bin\/kc.sh\",\"start-dev\"]\r\n    ports:\r\n      - \"8088:8080\"\r\n    environment:\r\n      KEYCLOAK_ADMIN: admin\r\n      KEYCLOAK_ADMIN_PASSWORD: password\r\n      KC_LOG_LEVEL: debug<\/pre>\n<p class=\"code-line\" dir=\"auto\" data-line=\"103\">\u203b \u691c\u8a3c\u306b\u306f\u5fc5\u9808\u3067\u306f\u3042\u308a\u307e\u305b\u3093\u304c\u3001\u4eca\u56de\u306fJWS\u306b\u7f72\u540d\u3057\u3066JWS\u3092\u4f5c\u6210\u3057\u3066\u30ea\u30af\u30a8\u30b9\u30c8\u306b\u4ed8\u4e0e\u3059\u308b\u30b1\u30fc\u30b9\u306a\u3069\u304c\u51fa\u3066\u304f\u308b\u306e\u3067\u3001 Keycloak \u5074\u306b\u6307\u5b9a\u3057\u305f\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u3068\u7f72\u540d\u306e\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u304c\u9055\u3046\u5834\u5408\u306a\u3069\u306e\u30a8\u30e9\u30fc\u306e\u8a73\u7d30\u306f\u30ed\u30b0\u3092\u78ba\u8a8d\u3059\u308b\u3057\u304b\u306a\u3044\u305f\u3081 KC_LOG_LEVEL \u3092 debug \u3068\u3057\u3066\u6307\u5b9a\u3057\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"105\">\u6b21\u306b2\u306b\u3064\u3044\u3066\u3067\u3059\u304c\u3001\u3056\u3063\u304f\u308a\u4f8b\u3092\u51fa\u3057\u3066\u8aac\u660e\u3059\u308b\u3068<a href=\"\/lab\/46316\" data-href=\"\/lab\/46316\">\u524d\u56de\u306e\u8a18\u4e8b<\/a>\u3068\u6bd4\u8f03\u3057\u3066\u672c\u8a18\u4e8b\u3067\u306f\u4e0b\u8a18\u306e\u3088\u3046\u306b\u5909\u66f4\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n<table class=\"code-line\" dir=\"auto\" data-line=\"107\">\n<thead class=\"code-line\" dir=\"auto\" data-line=\"107\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"107\">\n<th>\u5bfe\u8c61<\/th>\n<th>\u5909\u66f4\u524d<\/th>\n<th>\u5909\u66f4\u5f8c<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"code-line\" dir=\"auto\" data-line=\"109\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"109\">\n<td>\u7ba1\u7406\u30b3\u30f3\u30bd\u30fc\u30eb<\/td>\n<td><a href=\"http:\/\/localhost:8088\/auth\/admin\" data-href=\"http:\/\/localhost:8088\/auth\/admin\">http:\/\/localhost:8088\/auth\/admin<\/a><\/td>\n<td><a href=\"http:\/\/localhost:8088\/admin\" data-href=\"http:\/\/localhost:8088\/admin\">http:\/\/localhost:8088\/admin<\/a><\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"110\">\n<td>authorization_endpoint<\/td>\n<td><a href=\"http:\/\/localhost:8088\/auth\/realms\/sample-realm\/protocol\/openid-connect\/auth\" data-href=\"http:\/\/localhost:8088\/auth\/realms\/sample-realm\/protocol\/openid-connect\/auth\">http:\/\/localhost:8088\/auth\/realms\/sample-realm\/protocol\/openid-connect\/auth<\/a><\/td>\n<td><a href=\"http:\/\/localhost:8088\/realms\/sample-realm\/protocol\/openid-connect\/auth\" data-href=\"http:\/\/localhost:8088\/realms\/sample-realm\/protocol\/openid-connect\/auth\">http:\/\/localhost:8088\/realms\/sample-realm\/protocol\/openid-connect\/auth<\/a><\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"111\">\n<td>token_endpoint<\/td>\n<td><a href=\"http:\/\/localhost:8088\/auth\/realms\/sample-realm\/protocol\/openid-connect\/token\" data-href=\"http:\/\/localhost:8088\/auth\/realms\/sample-realm\/protocol\/openid-connect\/token\">http:\/\/localhost:8088\/auth\/realms\/sample-realm\/protocol\/openid-connect\/token<\/a><\/td>\n<td><a href=\"http:\/\/localhost:8088\/realms\/sample-realm\/protocol\/openid-connect\/token\" data-href=\"http:\/\/localhost:8088\/realms\/sample-realm\/protocol\/openid-connect\/token\">http:\/\/localhost:8088\/realms\/sample-realm\/protocol\/openid-connect\/token<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3 id=\"31-%E3%83%AC%E3%83%AB%E3%83%A0%E3%81%AE%E8%A8%AD%E5%AE%9A\" class=\"code-line\" dir=\"auto\" data-line=\"114\">3.1 \u30ec\u30eb\u30e0\u306e\u8a2d\u5b9a<a id=\"index3.1\"><\/a><\/h3>\n<p class=\"code-line\" dir=\"auto\" data-line=\"115\">\u307e\u305f\u3001\u30ec\u30eb\u30e0\u3001\u30e6\u30fc\u30b6\u30fc\u540d\u3001\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306f\u524d\u56de\u306e\u8a18\u4e8b\u3068\u5168\u304f\u540c\u3058\u30c7\u30fc\u30bf\u3092\u4f7f\u3063\u3066\u3044\u304d\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"117\">\u30ec\u30eb\u30e0\u306e\u4f5c\u308a\u65b9\u306b\u3064\u3044\u3066\u306f<a href=\"https:\/\/www.keycloak.org\/docs\/latest\/server_admin\/index.html#proc-creating-a-realm_server_administration_guide\" data-href=\"https:\/\/www.keycloak.org\/docs\/latest\/server_admin\/index.html#proc-creating-a-realm_server_administration_guide\">\u516c\u5f0f\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8<\/a>\u3092\u3054\u53c2\u7167\u304f\u3060\u3055\u3044\u3002<\/p>\n<table class=\"code-line\" dir=\"auto\" data-line=\"119\">\n<thead class=\"code-line\" dir=\"auto\" data-line=\"119\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"119\">\n<th>\u30d5\u30a3\u30fc\u30eb\u30c9<\/th>\n<th>\u5024<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"code-line\" dir=\"auto\" data-line=\"121\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"121\">\n<td>Realm name<\/td>\n<td>sample-realm<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3 id=\"32-%E3%83%A6%E3%83%BC%E3%82%B6%E3%83%BC%E3%81%AE%E8%A8%AD%E5%AE%9A\" class=\"code-line\" dir=\"auto\" data-line=\"123\">3.2 \u30e6\u30fc\u30b6\u30fc\u306e\u8a2d\u5b9a<a id=\"index3.2\"><\/a><\/h3>\n<p class=\"code-line\" dir=\"auto\" data-line=\"124\">\u30e6\u30fc\u30b6\u30fc\u306b\u3064\u3044\u3066\u306f\u524d\u56de\u306e\u8a18\u4e8b\u3068\u5909\u308f\u3089\u305a\u7ba1\u7406\u30b3\u30f3\u30bd\u30fc\u30eb\u3067\u3082\u5927\u304d\u306aUI\u306e\u5909\u66f4\u306f\u3055\u308c\u3066\u304a\u308a\u307e\u305b\u3093\u3002\u524d\u56de\u306e\u8a18\u4e8b\u3068\u540c\u69d8\u306b\u4e0b\u8a18\u306e\u30c7\u30fc\u30bf\u3067\u4f5c\u6210\u3057\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"126\">\u30e6\u30fc\u30b6\u30fc\u306e\u4f5c\u308a\u65b9\u306b\u3064\u3044\u3066\u306f<a href=\"https:\/\/www.keycloak.org\/docs\/latest\/server_admin\/index.html#proc-creating-user_server_administration_guide\" data-href=\"https:\/\/www.keycloak.org\/docs\/latest\/server_admin\/index.html#proc-creating-user_server_administration_guide\">\u516c\u5f0f\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8<\/a>\u3092\u3054\u53c2\u7167\u304f\u3060\u3055\u3044\u3002<\/p>\n<table class=\"code-line\" dir=\"auto\" data-line=\"128\">\n<thead class=\"code-line\" dir=\"auto\" data-line=\"128\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"128\">\n<th>\u30d5\u30a3\u30fc\u30eb\u30c9<\/th>\n<th>\u5024<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"code-line\" dir=\"auto\" data-line=\"130\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"130\">\n<td>Username<\/td>\n<td>cl-taro<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p class=\"code-line\" dir=\"auto\" data-line=\"132\">\u307e\u305f\u3001\u30e6\u30fc\u30b6\u30fc\u306e Credentials \u306b\u3064\u3044\u3066\u306f\u4eca\u56de\u3082\u4e0b\u8a18\u306e\u3088\u3046\u306b\u4f5c\u6210\u3057\u307e\u3059\u3002<\/p>\n<table class=\"code-line\" dir=\"auto\" data-line=\"134\">\n<thead class=\"code-line\" dir=\"auto\" data-line=\"134\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"134\">\n<th>\u30d5\u30a3\u30fc\u30eb\u30c9<\/th>\n<th>\u5024<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"code-line\" dir=\"auto\" data-line=\"136\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"136\">\n<td>Password<\/td>\n<td>password<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"137\">\n<td>Temporary<\/td>\n<td>Off<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3 id=\"33-%E3%82%AF%E3%83%A9%E3%82%A4%E3%82%A2%E3%83%B3%E3%83%88%E3%81%AE%E8%A8%AD%E5%AE%9A\" class=\"code-line\" dir=\"auto\" data-line=\"139\">3.3 \u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306e\u8a2d\u5b9a<a id=\"index3.3\"><\/a><\/h3>\n<p class=\"code-line\" dir=\"auto\" data-line=\"140\">Keycloak \u306e\u66f4\u65b0\u306b\u5408\u308f\u305b\u3066\u3001\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306b\u8a2d\u5b9a\u753b\u9762\u306a\u3069\u3082\u5c11\u3057\u5909\u308f\u3063\u3066\u3044\u307e\u3059\u304c\u4f5c\u6210\u3059\u308b\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306e\u5185\u5bb9\u306f\u524d\u56de\u306e\u8a18\u4e8b\u3068\u5909\u308f\u3089\u305a\u4e0b\u8a18\u306e\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"142\">\u4e3b\u306a\u5909\u66f4\u70b9\u3068\u3057\u3066\u306f\u3001Access Type \u3068\u3044\u3046\u8a2d\u5b9a\u9805\u76ee\u3067\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30bf\u30a4\u30d7\u306b\u3064\u3044\u3066\u3001 public \u304b confidential \u3092\u9078\u629e\u3057\u3066\u3044\u307e\u3057\u305f\u304c\u3001Client authentication \u3068\u3044\u3046\u540d\u524d\u306e\u8a2d\u5b9a\u9805\u76ee\u306b\u5909\u66f4\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"144\">\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306e\u4f5c\u308a\u65b9\u306b\u3064\u3044\u3066\u306f<a href=\"https:\/\/www.keycloak.org\/docs\/latest\/server_admin\/index.html#proc-creating-oidc-client_server_administration_guide\" data-href=\"https:\/\/www.keycloak.org\/docs\/latest\/server_admin\/index.html#proc-creating-oidc-client_server_administration_guide\">\u516c\u5f0f\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8<\/a>\u3092\u3054\u53c2\u7167\u304f\u3060\u3055\u3044\u3002<\/p>\n<table class=\"code-line\" dir=\"auto\" data-line=\"146\">\n<thead class=\"code-line\" dir=\"auto\" data-line=\"146\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"146\">\n<th>\u30d5\u30a3\u30fc\u30eb\u30c9<\/th>\n<th>\u5024<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"code-line\" dir=\"auto\" data-line=\"148\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"148\">\n<td>Client ID<\/td>\n<td>test-client<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"149\">\n<td>Client Type<\/td>\n<td>OpenID Connect (default\u306e\u5024)<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"150\">\n<td>Client authentication<\/td>\n<td>Off (default\u306e\u5024)<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"151\">\n<td>Authorization<\/td>\n<td>Off (default\u306e\u5024)<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"152\">\n<td>Standard flow<\/td>\n<td>\u2713 (default\u306e\u5024)<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"153\">\n<td>Direct access grants<\/td>\n<td>\u2713 \u3092\u306f\u305a\u3059<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"154\">\n<td>Valid redirect URIs<\/td>\n<td><a href=\"https:\/\/client.example.com\/test\" data-href=\"https:\/\/client.example.com\/test\">https:\/\/client.example.com\/test<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p class=\"code-line\" dir=\"auto\" data-line=\"156\">\u307e\u305f\u3001PKCE \u306e\u9805\u76ee\u306a\u3069\u3092\u5909\u66f4\u3059\u308b Advanced \u3082\u30bf\u30d6\u5206\u3051\u3055\u308c\u3066\u3044\u307e\u3059\u306e\u3067\u3001\u4e0b\u8a18\u306e\u3088\u3046\u306b\u30bf\u30d6\u3092\u79fb\u52d5\u3057\u3066\u78ba\u8a8d\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-59488\" src=\"\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-setting-1-1024x653.png\" alt=\"\" width=\"1024\" height=\"653\" srcset=\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-setting-1-1024x653.png 1024w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-setting-1-360x230.png 360w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-setting-1-768x490.png 768w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-setting-1.png 1327w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"156\">Advanced \u30bf\u30d6\u306e Advanced Settings \u306e\u4e2d\u306b\u3042\u308b\u4e0b\u8a18\u306ePKCE\u306e\u30e1\u30bd\u30c3\u30c9\u3082\u5909\u66f4\u3057\u3066\u304a\u304d\u307e\u3059\u3002<\/p>\n<table class=\"code-line\" dir=\"auto\" data-line=\"162\">\n<thead class=\"code-line\" dir=\"auto\" data-line=\"162\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"162\">\n<th>\u30d5\u30a3\u30fc\u30eb\u30c9<\/th>\n<th>\u5024<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"code-line\" dir=\"auto\" data-line=\"164\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"164\">\n<td>Proof Key for Code Exchange Code Challenge Method<\/td>\n<td>S256<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<div class=\"code-line\" dir=\"auto\" data-line=\"166\"><\/div>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-59489\" src=\"\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-setting-2-1024x653.png\" alt=\"\" width=\"1024\" height=\"653\" srcset=\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-setting-2-1024x653.png 1024w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-setting-2-360x230.png 360w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-setting-2-768x490.png 768w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-setting-2.png 1323w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<h3 id=\"34-%E3%82%AF%E3%83%A9%E3%82%A4%E3%82%A2%E3%83%B3%E3%83%88%E3%83%9D%E3%83%AA%E3%82%B7%E3%83%BC%E3%81%AE%E8%A8%AD%E5%AE%9A\" class=\"code-line\" dir=\"auto\" data-line=\"168\">3.4 \u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc\u306e\u8a2d\u5b9a<a id=\"index3.4\"><\/a><\/h3>\n<p class=\"code-line\" dir=\"auto\" data-line=\"169\">\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc\u306e\u8a2d\u5b9a\u306b\u3064\u3044\u3066\u3082<a href=\"\/lab\/46316#section6.2\" data-href=\"\/lab\/46316#section6.2\">\u524d\u56de\u306e\u8a18\u4e8b<\/a>\u3068\u5909\u308f\u3089\u305a\u7ba1\u7406\u30b3\u30f3\u30bd\u30fc\u30eb\u3067\u3082\u5927\u304d\u306aUI\u306e\u5909\u66f4\u306f\u3055\u308c\u3066\u304a\u308a\u307e\u305b\u3093\u3002\u524d\u56de\u306e\u8a18\u4e8b\u3068\u540c\u69d8\u306b\u4e0b\u8a18\u306e\u30c7\u30fc\u30bf\u3067\u4f5c\u6210\u3057\u307e\u3059\u3002<\/p>\n<table class=\"code-line\" dir=\"auto\" data-line=\"171\">\n<thead class=\"code-line\" dir=\"auto\" data-line=\"171\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"171\">\n<th>\u30d5\u30a3\u30fc\u30eb\u30c9<\/th>\n<th>\u5024<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"code-line\" dir=\"auto\" data-line=\"173\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"173\">\n<td>Name<\/td>\n<td>test-policy<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"174\">\n<td>Conditions<\/td>\n<td>any-client<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"175\">\n<td>Client Profiles<\/td>\n<td>fapi1-advanced<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p class=\"code-line\" dir=\"auto\" data-line=\"177\">Configure\u306e\u4f4d\u7f6e\u304c\u4e0b\u8a18\u306e\u3088\u3046\u306b\u5909\u66f4\u3055\u308c\u3066\u3044\u308b\u306e\u3067\u3001Realm Setting \u306e\u4f4d\u7f6e\u3082\u5408\u308f\u305b\u3066\u305a\u308c\u3066\u3044\u307e\u3059\u304c\u3001\u8a72\u5f53\u30bf\u30d6\u5185\u3067\u306e\u5909\u66f4\u65b9\u6cd5\u306a\u3069\u306f\u3055\u307b\u3069\u5927\u304d\u304f\u306f\u5909\u308f\u3063\u3066\u304a\u308a\u307e\u305b\u3093\u3002\u8a2d\u5b9a\u306e\u30a4\u30e1\u30fc\u30b8\u306b\u3064\u3044\u3066\u306f\u3001<a href=\"\/lab\/46316#section6.2\" data-href=\"\/lab\/46316#section6.2\">\u524d\u56de\u306e\u8a18\u4e8b<\/a>\u3092\u3054\u78ba\u8a8d\u304f\u3060\u3055\u3044\u3002<\/p>\n<h2 id=\"4-%E5%89%8D%E5%9B%9E%E3%81%AE%E8%A8%98%E4%BA%8B%E3%81%AE%E6%8C%AF%E3%82%8A%E8%BF%94%E3%82%8A\" class=\"code-line code-active-line\" dir=\"auto\" data-line=\"179\">4. \u524d\u56de\u306e\u8a18\u4e8b\u306e\u632f\u308a\u8fd4\u308a<a id=\"index4\"><\/a><\/h2>\n<p class=\"code-line\" dir=\"auto\" data-line=\"181\">\u524d\u56de\u306e\u691c\u8a3c\u3067\u306f\u4f5c\u6210\u3057\u305f\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306b\u3064\u3044\u3066\u632f\u308a\u8fd4\u3063\u3066\u307f\u3066\u307f\u308b\u3068\u3001\u4e0b\u8a18\u306e\u6761\u4ef6\u3067\u3057\u305f\u3002<\/p>\n<table class=\"code-line\" dir=\"auto\" data-line=\"183\">\n<thead class=\"code-line\" dir=\"auto\" data-line=\"183\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"183\">\n<th>\u30d5\u30a3\u30fc\u30eb\u30c9<\/th>\n<th>\u5024<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"code-line\" dir=\"auto\" data-line=\"185\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"185\">\n<td>\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30bf\u30a4\u30d7<\/td>\n<td>\u30d1\u30d6\u30ea\u30c3\u30af (public)<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"186\">\n<td>\u8a8d\u53ef\u30b0\u30e9\u30f3\u30c8<\/td>\n<td>\u8a8d\u53ef\u30b3\u30fc\u30c9<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p class=\"code-line\" dir=\"auto\" data-line=\"188\">\u3068\u3044\u3046\u72b6\u6cc1\u3067\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc\u306e 'fapi-1-advanced' \u3092\u9069\u7528\u3057\u3066PKCE\u3092\u8a66\u3057\u3066\u3044\u307e\u3057\u305f\u3002\u7c21\u6613\u306e\u30a4\u30e1\u30fc\u30b8\u56f3\u3092\u51fa\u3059\u3068\u4e0b\u8a18\u306e\u3088\u3046\u306a\u30a4\u30e1\u30fc\u30b8\u3067\u3059\u3002<\/p>\n<p dir=\"auto\" data-line=\"188\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-59900\" src=\"\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/pkce-image.png\" alt=\"\" width=\"745\" height=\"309\" srcset=\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/pkce-image.png 745w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/pkce-image-360x149.png 360w\" sizes=\"auto, (max-width: 745px) 100vw, 745px\" \/><\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"190\">\u3067\u306f\u518d\u5ea6\u30ea\u30af\u30a8\u30b9\u30c8\u3068\u30ec\u30b9\u30dd\u30f3\u30b9\u3092\u9001\u3063\u3066\u307f\u307e\u3057\u3087\u3046\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"192\">\u524d\u56de\u306e\u8a18\u4e8b\u3068\u6bd4\u8f03\u3057\u3066Keycloak\u306e\u66f4\u65b0\u306b\u5408\u308f\u305b\u3066\u3001authorization_endpoint \u306e\u30d1\u30b9\u304b\u3089 \/auth \u304c\u7121\u304f\u306a\u3063\u3066\u3044\u308b\u3053\u3068\u306b\u6ce8\u610f\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"194\"><a href=\"http:\/\/localhost:8088\/realms\/sample-realm\/protocol\/openid-connect\/auth?response_type=code&amp;scope=openid%20email&amp;client_id=test-client&amp;nonce=abcdefghijk&amp;state=abcdefghijk&amp;redirect_uri=https%3A%2F%2Fclient.example.com%2Ftest&amp;code_challenge=x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE&amp;code_challenge_method=S256\" data-href=\"http:\/\/localhost:8088\/realms\/sample-realm\/protocol\/openid-connect\/auth?response_type=code&amp;scope=openid%20email&amp;client_id=test-client&amp;nonce=abcdefghijk&amp;state=abcdefghijk&amp;redirect_uri=https%3A%2F%2Fclient.example.com%2Ftest&amp;code_challenge=x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE&amp;code_challenge_method=S256\">\u8a8d\u53ef\u30ea\u30af\u30a8\u30b9\u30c8<\/a>\u3092\u518d\u5ea6\u9001\u3063\u3066\u307f\u307e\u3057\u3087\u3046\u3002<\/p>\n<ul class=\"code-line\" dir=\"auto\" data-line=\"195\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"195\"><a href=\"http:\/\/localhost:8088\/realms\/sample-realm\/protocol\/openid-connect\/auth?response_type=code&amp;scope=openid%20email&amp;client_id=test-client&amp;nonce=abcdefghijk&amp;state=abcdefghijk&amp;redirect_uri=https%3A%2F%2Fclient.example.com%2Ftest&amp;code_challenge=x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE&amp;code_challenge_method=S256\" data-href=\"http:\/\/localhost:8088\/realms\/sample-realm\/protocol\/openid-connect\/auth?response_type=code&amp;scope=openid%20email&amp;client_id=test-client&amp;nonce=abcdefghijk&amp;state=abcdefghijk&amp;redirect_uri=https%3A%2F%2Fclient.example.com%2Ftest&amp;code_challenge=x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE&amp;code_challenge_method=S256\">http:\/\/localhost:8088\/realms\/sample-realm\/protocol\/openid-connect\/auth?response_type=code&amp;scope=openid email&amp;client_id=test-client&amp;nonce=abcdefghijk&amp;state=abcdefghijk&amp;redirect_uri=https%3A%2F%2Fclient.example.com%2Ftest&amp;code_challenge=x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE&amp;code_challenge_method=S256<\/a><\/li>\n<\/ul>\n<p class=\"code-line\" dir=\"auto\" data-line=\"197\">URL\u6b04\u304b\u3089\u30ec\u30b9\u30dd\u30f3\u30b9\u3092\u78ba\u8a8d\u3059\u308b\u3068\u4e0b\u8a18\u306e\u3088\u3046\u306a\u5024\u304c\u78ba\u8a8d\u3067\u304d\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">https:\/\/client.example.com\/test?error=invalid_client&amp;error_description=invalid+client+access+type&amp;state=abcdefghijk\r\n<\/pre>\n<p class=\"code-line\" dir=\"auto\" data-line=\"203\">URL \u306e\u30af\u30a8\u30ea\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u3092\u30c7\u30b3\u30fc\u30c9\u3057\u3066\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u898b\u3066\u307f\u308b\u3068\u3001\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u304c\u7121\u52b9\u3067\u3042\u3063\u305f\u3053\u3068\u3068\u3001\u30a8\u30e9\u30fc\u306e\u8aac\u660e\u3068\u3057\u3066\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306e\u30a2\u30af\u30bb\u30b9\u30bf\u30a4\u30d7\u304c\u7121\u52b9\u3068\u3044\u3046\u60c5\u5831\u304c\u308f\u304b\u308a\u307e\u3059\u3002<\/p>\n<table class=\"code-line\" dir=\"auto\" data-line=\"205\">\n<thead class=\"code-line\" dir=\"auto\" data-line=\"205\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"205\">\n<th>\u30d1\u30e9\u30e1\u30fc\u30bf\u540d<\/th>\n<th>\u5024<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"code-line\" dir=\"auto\" data-line=\"207\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"207\">\n<td>error<\/td>\n<td>invalid_client<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"208\">\n<td>error_description<\/td>\n<td>invalid client access type<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p class=\"code-line\" dir=\"auto\" data-line=\"210\">\u3053\u3053\u3067\u8a00\u3046\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30a2\u30af\u30bb\u30b9\u30bf\u30a4\u30d7\u306f OAuth2 \u3067\u8a00\u3046\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30bf\u30a4\u30d7\u3092\u6307\u3057\u3066\u3044\u308b\u306e\u3067\u3001public \u306a\u3068\u3053\u308d\u3092 confidential \u306b\u5909\u66f4\u3057\u3066\u307f\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"212\">\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30bf\u30a4\u30d7\u3092\u5909\u66f4\u3059\u308b\u305f\u3081\u306b\u3001\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306e\u8a2d\u5b9a\u753b\u9762\u304b\u3089\u3001 Client authenticatio \u306e\u5024\u3092 On \u306b\u5909\u66f4\u3057\u3066 Save \u3092\u62bc\u3057\u3066\u307f\u307e\u3057\u3087\u3046\u3002\u3067\u3059\u304c\u73fe\u5728\u306f\u5909\u66f4\u3057\u3088\u3046\u3068\u3059\u308b\u3068\u3001\u4e0b\u8a18\u306e\u30a8\u30e9\u30fc\u304c\u30dd\u30c3\u30d7\u30a2\u30c3\u30d7\u3067\u8868\u793a\u3055\u308c\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">Client could not be updated: Invalid client metadata: token_endpoint_auth_method<\/pre>\n<p class=\"code-line\" dir=\"auto\" data-line=\"218\">\u73fe\u5728\u306f\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc\u3067\u5236\u9650\u3055\u308c\u3066\u304a\u308a\u3001\u6761\u4ef6\u3092\u6e80\u305f\u3055\u306a\u3044\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306f\u4f5c\u6210\u3057\u3065\u3089\u3044\u306e\u3067\u4e00\u65e6\u4f5c\u6210\u6e08\u307f\u306e\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc\u3067\u3042\u308b test-policy \u306e\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30d7\u30ed\u30d5\u30a1\u30a4\u30eb\u3067\u3042\u308b fapi1-advanced \u306b\u3064\u3044\u3066 Status \u306e\u6b04\u306e\u30c8\u30b0\u30eb\u30b9\u30a4\u30c3\u30c1\u3092\u62bc\u3057\u3066\u30dd\u30ea\u30b7\u30fc\u3092\u4e00\u5ea6\u7121\u52b9\u5316\u3057\u307e\u3059\u3002<\/p>\n<p dir=\"auto\" data-line=\"218\">\u5909\u66f4\u524d\u306e\u30a4\u30e1\u30fc\u30b8:<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-59510\" src=\"\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/test-policy-on-1024x569.png\" alt=\"\" width=\"1024\" height=\"569\" srcset=\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/test-policy-on-1024x569.png 1024w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/test-policy-on-360x200.png 360w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/test-policy-on-768x427.png 768w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/test-policy-on.png 1289w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/>\u5909\u66f4\u5f8c\u306e\u30a4\u30e1\u30fc\u30b8:<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-59511\" src=\"\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/test-policy-disable-1024x576.png\" alt=\"\" width=\"1024\" height=\"576\" srcset=\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/test-policy-disable-1024x576.png 1024w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/test-policy-disable-360x202.png 360w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/test-policy-disable-768x432.png 768w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/test-policy-disable.png 1293w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/>\u307e\u305f\u3001\u5909\u66f4\u4e2d\u306b\u4e0b\u8a18\u306e\u3088\u3046\u306a\u30dd\u30c3\u30d7\u30a2\u30c3\u30d7\u304c\u51fa\u305f\u5834\u5408\u306f Disable \u3092\u9078\u3093\u3067\u304f\u3060\u3055\u3044\u3002<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-59512\" src=\"\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/test-policy-disable-check-1024x570.png\" alt=\"\" width=\"1024\" height=\"570\" srcset=\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/test-policy-disable-check-1024x570.png 1024w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/test-policy-disable-check-360x200.png 360w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/test-policy-disable-check-768x428.png 768w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/test-policy-disable-check.png 1295w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"229\">\u3053\u306e\u30d7\u30ed\u30d5\u30a1\u30a4\u30eb\u3092\u7121\u52b9\u5316\u3057\u305f\u72b6\u614b\u3067\u3001\u5148\u7a0b\u3068\u540c\u3058\u3088\u3046\u306b\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306e\u8a2d\u5b9a\u753b\u9762\u304b\u3089\u3001 Client authentication \u306e\u5024\u3092 On \u306b\u5909\u66f4\u3057\u3066\u3001Save \u3092\u62bc\u3057\u3066\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306e\u60c5\u5831\u3092\u4fdd\u5b58\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u305d\u3057\u3066\u5148\u7a0b\u7121\u52b9\u5316\u3057\u305f fapi1-advanced \u306e test-policy \u3092\u518d\u5ea6\u6709\u52b9\u306b\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"235\">\u307e\u305f\u3001\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306e Client authentication \u306e\u5024\u3092 On \u306b\u5909\u66f4\u3059\u308b\u3053\u3068\u3067\u3001Credentials \u306e\u30bf\u30d6\u304c\u65b0\u3057\u304f\u8868\u793a\u3055\u308c\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"237\">\u3067\u306f\u00a0<a href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html\" data-href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html\">FAPI1 Advanced<\/a>\u00a0\u306b\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u8a8d\u8a3c\u306b\u95a2\u3059\u308b\u8a18\u8ff0\u304c\u306a\u3044\u304b\u3092\u78ba\u8a8d\u3057\u3066\u307f\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"239\"><a href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0-final.html#authorization-server\" data-href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0-final.html#authorization-server\">\u8a8d\u53ef\u30b5\u30fc\u30d0\u30fc\u306b\u95a2\u3059\u308b\u8a18\u8ff0<\/a>\u306b\u4e0b\u8a18\u306e\u3088\u3046\u306a\u8a18\u8ff0\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">14. shall authenticate the confidential client using one of the following methods (this overrides FAPI Security Profile 1.0 - Part 1: Baseline clause 5.2.2-4):  \r\n    1. tls_client_auth or self_signed_tls_client_auth as specified in section 2 of MTLS, or  \r\n    2. private_key_jwt as specified in section 9 of OIDC;<\/pre>\n<p class=\"code-line\" dir=\"auto\" data-line=\"247\">\u4e0a\u8a18\u306e\u3088\u3046\u306b\u3001 OAuth2 \u306b\u95a2\u9023\u3059\u308bMTLS \u306e\u4ed5\u69d8\u306e\u30bb\u30af\u30b7\u30e7\u30f32\u306b\u3067\u3066\u304f\u308b tls_client_auth \u307e\u305f\u306f\u3001self_signed_tls_client_auth \u306a\u3044\u3057\u306f\u3001OIDC Core \u306e\u30bb\u30af\u30b7\u30e7\u30f3\uff19\u306b\u3067\u3066\u304f\u308b private_key_jwt \u3092\u7528\u3044\u3066\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u3092\u8a8d\u8a3c\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"253\">\u4eca\u56de\u306f tls_client_auth \u306e\u5f62\u3067 Client \u8a8d\u8a3c\u3092\u3057\u3066\u3044\u304f\u3053\u3068\u306b\u3057\u307e\u3057\u3087\u3046\u3002<\/p>\n<h2 id=\"5-mtls%E3%81%AE%E5%B0%8E%E5%85%A5\" class=\"code-line\" dir=\"auto\" data-line=\"255\">5. mTLS\u5bfe\u5fdc<a id=\"index5\"><\/a><\/h2>\n<p class=\"code-line\" dir=\"auto\" data-line=\"255\">OAuth2 \u306b\u95a2\u9023\u3059\u308bMTLS\u306e\u524d\u306b\u3001mTLS\u306b\u3064\u3044\u3066\u7c21\u5358\u306b\u78ba\u8a8d\u3057\u307e\u3059\u3002\u00a0<a href=\"https:\/\/cloud.google.com\/beyondcorp-enterprise\/docs\/understand-mtls?hl=ja#:~:text=%E7%9B%B8%E4%BA%92%20TLS%EF%BC%88mTLS%EF%BC%89%E3%81%AF%E3%80%81,%E3%81%93%E3%81%A8%E3%82%92%E4%BF%9D%E8%A8%BC%E3%81%97%E3%81%BE%E3%81%99%E3%80%82\" data-href=\"https:\/\/cloud.google.com\/beyondcorp-enterprise\/docs\/understand-mtls?hl=ja#:~:text=%E7%9B%B8%E4%BA%92%20TLS%EF%BC%88mTLS%EF%BC%89%E3%81%AF%E3%80%81,%E3%81%93%E3%81%A8%E3%82%92%E4%BF%9D%E8%A8%BC%E3%81%97%E3%81%BE%E3%81%99%E3%80%82\">Google Cloud\u3055\u3093\u306e\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8<\/a>\u306e\u8868\u73fe\u3092\u501f\u308a\u308b\u3068\u3001\u4e0b\u8a18\u3067\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">\u76f8\u4e92 TLS\uff08mTLS\uff09\u306f\u3001\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u3068\u30b5\u30fc\u30d0\u30fc\u9593\u306e\u76f8\u4e92\u8a8d\u8a3c\u306e\u305f\u3081\u306e\u696d\u754c\u6a19\u6e96\u30d7\u30ed\u30c8\u30b3\u30eb\u3067\u3059\u3002mTLS \u30d7\u30ed\u30c8\u30b3\u30eb\u306f\u3001\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u63a5\u7d9a\u306e\u4e21\u7aef\u3067\u3001\u53cc\u65b9\u304c\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u8a3c\u660e\u66f8\u306b\u95a2\u9023\u4ed8\u3051\u3089\u308c\u305f\u79d8\u5bc6\u9375\u3092\u4fdd\u6301\u3057\u3066\u3044\u308b\u3053\u3068\u3092\u78ba\u8a8d\u3059\u308b\u3053\u3068\u3067\u3001\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u3068\u30b5\u30fc\u30d0\u30fc\u306e\u4e21\u65b9\u304c\u81ea\u8eab\u3067\u3042\u308b\u3068\u4e3b\u5f35\u3059\u308b\u3053\u3068\u3092\u4fdd\u8a3c\u3057\u307e\u3059\u3002<\/pre>\n<p class=\"code-line code-active-line\" dir=\"auto\" data-line=\"261\">\u4e0a\u8a18\u5f15\u7528\u90e8\u306b\u3064\u3044\u3066\u306f\u3001\u76f8\u4e92\u3067\u81ea\u8eab\u3092\u8a3c\u660e\u66f8\u3067\u4fdd\u8a3c\u3059\u308b\u30a4\u30e1\u30fc\u30b8\u3055\u3048\u3067\u304d\u308c\u3070\u4eca\u306f\u554f\u984c\u3042\u308a\u307e\u305b\u3093\u3002<\/p>\n<h3 id=\"51-oauth-20-mutual-tls-client-authentication-and-certificate-bound-access-tokens\" class=\"code-line\" dir=\"auto\" data-line=\"261\">5.1 OAuth2 \u306b\u95a2\u9023\u3059\u308bmTLS\u306e\u4ed5\u69d8<a id=\"index5.1\"><\/a><\/h3>\n<p class=\"code-line\" dir=\"auto\" data-line=\"269\">\u3053\u306e\u3088\u3046\u306amTLS\u306e\u632f\u308b\u821e\u3044\u3068\u30a2\u30af\u30bb\u30b9\u30c8\u30fc\u30af\u30f3\u3092\u7d10\u4ed8\u3051\u308b\u3053\u3068\u3067\u3001\u30a2\u30af\u30bb\u30b9\u30c8\u30fc\u30af\u30f3\u304c\u6a2a\u53d6\u308a\u3055\u308c\u3066\u3057\u307e\u3063\u305f\u969b\u306b\u3001\u60aa\u7528\u3055\u308c\u308b\u3053\u3068\u3092\u8efd\u6e1b\u3067\u304d\u308b\u3068\u3044\u3046\u306e\u304c\u00a0<a href=\"https:\/\/www.rfc-editor.org\/rfc\/rfc8705\" data-href=\"https:\/\/www.rfc-editor.org\/rfc\/rfc8705\">OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens<\/a>\u00a0\u3068\u3044\u3046\u4ed5\u69d8\u3067\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"271\">\u3053\u306e\u4ed5\u69d8\u306f\u4e3b\u306b\u4e0b\u8a18\uff12\u70b9\u306e\u65b9\u6cd5\u3092\u63d0\u4f9b\u3059\u308b\u4ed5\u69d8\u3060\u3068\u30a4\u30e1\u30fc\u30b8\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<ol class=\"code-line\" dir=\"auto\" data-line=\"267\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"267\">\u8a8d\u53ef\u30b5\u30fc\u30d0\u30fc\u304c\u30a2\u30af\u30bb\u30b9\u30c8\u30fc\u30af\u30f3\u306b\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306emTLS\u306e\u8a3c\u660e\u66f8\u3092\u7d10\u4ed8\u3051\u308b\u65b9\u6cd5<\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"268\">\u30ea\u30bd\u30fc\u30b9\u30b5\u30fc\u30d0\u30fc\u304c\u30c8\u30fc\u30af\u30f3\u30ea\u30af\u30a8\u30b9\u30c8\u6642\u306b\u9001\u4fe1\u3055\u308c\u305f\u30a2\u30af\u30bb\u30b9\u30c8\u30fc\u30af\u30f3\u306b\u3064\u3044\u3066\u3001\u30c8\u30fc\u30af\u30f3\u3092\u9001\u4fe1\u3057\u305f\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306b\u5bfe\u3057\u3066\u767a\u884c\u3055\u308c\u305f\u304b\u3082\u306e\u304b\u3092\u78ba\u8a8d\u3059\u308b\u65b9\u6cd5<\/li>\n<\/ol>\n<p class=\"code-line\" dir=\"auto\" data-line=\"270\">Keycloak \u3067\u8a66\u3059\u5834\u5408\u306f\u4e0b\u8a18\u306e3\u3064\u306e\u6d41\u308c\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"272\">\u2460 \u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306f\u30c8\u30fc\u30af\u30f3\u30ea\u30af\u30a8\u30b9\u30c8\u6642\u306bKeycloak\u3068mTLS\u901a\u4fe1\u3057\u3001\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306e\u8a3c\u660e\u66f8\u3092Keycloak\u306b\u308f\u305f\u3059(\u8a3c\u660e\u66f8\u306e\u60c5\u5831\u306fKeycloak\u5074\u3067\u78ba\u8a8d)<\/p>\n<p class=\"code-line \" dir=\"auto\" data-line=\"274\">\u2461 Keycloak\u306f\u30a2\u30af\u30bb\u30b9\u30c8\u30fc\u30af\u30f3\u306eJWT\u306e\u4e2d\u306e cnf \u306e\u4e2d\u306b\u3042\u308b x5t#S256 \u3068\u3044\u3046\u5024\u306b\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306e\u8a3c\u660e\u66f8\u306e\u30cf\u30c3\u30b7\u30e5\u60c5\u5831\u3092\u683c\u7d0d\u3057\u3066\u30a2\u30af\u30bb\u30b9\u30c8\u30fc\u30af\u30f3\u306a\u3069\u3092\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306b\u8fd4\u5374\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">{\r\n  \"exp\": 1677754428,\r\n  \"iat\": 1677754128,\r\n  \"auth_time\": 1677754095,\r\n  \"jti\": \"e36385c1-97b2-4723-8f8a-2e2d5784d489\",\r\n  \"iss\": \"https:\/\/localhost:8443\/realms\/sample-realm\",\r\n  \"sub\": \"ab767b12-e843-4a19-8e78-099f795ce8aa\",\r\n  \"typ\": \"Bearer\",\r\n  \"azp\": \"test-client\",\r\n  \"nonce\": \"abcdefghijk\",\r\n  \"session_state\": \"b5187cfc-08ee-46d6-8f6b-ad354016cfd6\",\r\n  \"acr\": \"1\",\r\n  \"allowed-origins\": [\r\n    \"https:\/\/client.example.com\"\r\n  ],\r\n  \"cnf\": {\r\n    \"x5t#S256\": \"AW3AakVy486N8hMv_ERHTTCPDYC6Zvw-RcKzUkdAijQ\"\r\n  },\r\n  \"scope\": \"openid email profile\",\r\n  \"sid\": \"b5187cfc-08ee-46d6-8f6b-ad354016cfd6\",\r\n  \"email_verified\": false,\r\n  \"preferred_username\": \"cl-taro\",\r\n  \"given_name\": \"\",\r\n  \"family_name\": \"\"\r\n}<\/pre>\n<p class=\"code-line\" dir=\"auto\" data-line=\"304\">\u2462 \u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306f\u30ea\u30bd\u30fc\u30b9\u30b5\u30fc\u30d0\u30fc\u3078\u306e\u30a2\u30af\u30bb\u30b9\u6642\u306bmTLS\u901a\u4fe1\u3057\u3001\u30ea\u30bd\u30fc\u30b9\u30b5\u30fc\u30d0\u30fc\u306f\u30a2\u30af\u30bb\u30b9\u30c8\u30fc\u30af\u30f3\u306e\u4e2d\u306e cnf \u306e\u4e2d\u306b\u3042\u308b x5t#S256 \u306e\u60c5\u5831\u3068\u3001mTLS\u3067\u6e21\u3059\u8a3c\u660e\u66f8\u306e\u60c5\u5831\u304c\u4e00\u81f4\u3059\u308b\u304b\u3092\u78ba\u8a8d\u3059\u308b\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"306\">\u30a4\u30e1\u30fc\u30b8\u3068\u3057\u3066\u306f\u4e0b\u8a18\u306e\u69d8\u306a\u6d41\u308c\u3067\u3001\u2460\u3067\u6e21\u3059\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u8a3c\u660e\u66f8\u306f\u30c8\u30fc\u30af\u30f3\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u884c\u3063\u305f\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u3057\u304b\u6240\u6301\u3057\u3066\u3044\u306a\u3044\u306f\u305a\u306a\u306e\u3067\u3001\u2462\u306e\u30ea\u30af\u30a8\u30b9\u30c8\u306f\u3001\u30c8\u30fc\u30af\u30f3\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u884c\u3063\u305f\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u3060\u3068\u5224\u65ad\u3067\u304d\u307e\u3059\u3002<\/p>\n<p dir=\"auto\" data-line=\"277\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-59722\" src=\"\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/mtls.png\" alt=\"\" width=\"970\" height=\"425\" srcset=\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/mtls.png 970w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/mtls-360x158.png 360w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/mtls-768x336.png 768w\" sizes=\"auto, (max-width: 970px) 100vw, 970px\" \/><\/p>\n<h3 id=\"52-docker-compose-%E3%81%AE%E4%BF%AE%E6%AD%A3\" class=\"code-line code-active-line\" dir=\"auto\" data-line=\"281\">5.2 docker-compose \u306e\u4fee\u6b63<a id=\"index5.2\"><\/a><\/h3>\n<p class=\"code-line\" dir=\"auto\" data-line=\"256\">tls_client_auth \u306e\u305f\u3081\u306bMTLS\u3092\u884c\u3044\u305f\u3044\u306e\u3067\u3001\u307e\u305a\u306fdocker-compose.yml\u3092\u3092\u4e0b\u8a18\u306e\u3088\u3046\u306b\u4fee\u6b63\u3057\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">services:\r\n  keycloak:\r\n    container_name: keycloak\r\n    image: quay.io\/keycloak\/keycloak:21.0.2\r\n    entrypoint: [\"\/opt\/keycloak\/bin\/kc.sh\",\"start-dev\"]\r\n    ports:\r\n      - \"8088:8080\"\r\n      - \"8443:8443\"\r\n    volumes:\r\n      - .\/certs\/keycloak-server.crt:\/opt\/keycloak\/conf\/tls.crt\r\n      - .\/certs\/keycloak-server.key:\/opt\/keycloak\/conf\/tls.key\r\n      - .\/certs\/client.jks:\/opt\/keycloak\/conf\/client.jks\r\n    environment:\r\n      KEYCLOAK_ADMIN: admin\r\n      KEYCLOAK_ADMIN_PASSWORD: password\r\n      KC_LOG_LEVEL: debug\r\n      KC_HTTPS_CERTIFICATE_FILE: \/opt\/keycloak\/conf\/tls.crt\r\n      KC_HTTPS_CERTIFICATE_KEY_FILE: \/opt\/keycloak\/conf\/tls.key\r\n      KC_HTTPS_TRUST_STORE_FILE: \/opt\/keycloak\/conf\/client.jks\r\n      KC_HTTPS_TRUST_STORE_PASSWORD: changeit\r\n      KC_HTTPS_CLIENT_AUTH: request<\/pre>\n<p class=\"code-line\" dir=\"auto\" data-line=\"282\">\u4eca\u56de\u306e\u4fee\u6b63\u3067\u306fHTTPS\u306b\u5bfe\u5fdc\u3059\u308b\u305f\u3081\u3001tls.crt, tls.key \u306e\u8a2d\u5b9a\u3092\u3001 \u307e\u305fmTLS\u306b\u5bfe\u5fdc\u3059\u308b\u305f\u3081\u3001client.jks \u306e\u8a2d\u5b9a\u3092\u8ffd\u52a0\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<table class=\"code-line\" dir=\"auto\" data-line=\"285\">\n<thead class=\"code-line\" dir=\"auto\" data-line=\"285\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"285\">\n<th>\u7528\u9014<\/th>\n<th>environment<\/th>\n<th>value<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"code-line\" dir=\"auto\" data-line=\"287\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"287\">\n<td>HTTPS<\/td>\n<td>KC_HTTPS_CERTIFICATE_FILE<\/td>\n<td>\/opt\/keycloak\/conf\/tls.crt<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"288\">\n<td>HTTPS<\/td>\n<td>KC_HTTPS_CERTIFICATE_KEY_FILE<\/td>\n<td>\/opt\/keycloak\/conf\/tls.key<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"289\">\n<td>mTLS<\/td>\n<td>KC_HTTPS_TRUST_STORE_FILE<\/td>\n<td>\/opt\/keycloak\/conf\/client.jks<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"290\">\n<td>mTLS<\/td>\n<td>KC_HTTPS_TRUST_STORE_PASSWORD<\/td>\n<td>changeit<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"291\">\n<td>mTLS<\/td>\n<td>KC_HTTPS_CLIENT_AUTH<\/td>\n<td>request<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p class=\"code-line\" dir=\"auto\" data-line=\"293\">\u3067\u306f\u305d\u308c\u305e\u308c\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u4f5c\u6210\u3057\u3066\u3044\u304d\u307e\u3059\u3002 \u30b3\u30f3\u30bd\u30fc\u30eb\u3092\u958b\u3044\u3066\u3001\u4eca\u56de\u306e docker-compose.yml \u3092\u4f5c\u6210\u3057\u305f\u30ea\u30dd\u30b8\u30c8\u30ea\u307e\u3067\u79fb\u52d5\u3057\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"296\">\u307e\u305a\u306f\u73fe\u5728\u306e\u4f4d\u7f6e\u3092\u5909\u6570\u306b\u683c\u7d0d\u3057\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">$ BASE=`pwd`<\/pre>\n<p>&nbsp;<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"320\">\u6b21\u306b\u8a3c\u660e\u66f8\u3092\u4fdd\u5b58\u3059\u308b\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u306e\u4f5c\u6210\u3057\u3066\u304a\u304d\u307e\u3057\u3087\u3046\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">$ mkdir -p $BASE\/certs<\/pre>\n<p>&nbsp;<\/p>\n<h3 id=\"51-ca%E7%94%A8%E3%81%AE%E9%8D%B5%E3%81%A8%E8%A8%BC%E6%98%8E%E6%9B%B8%E3%81%AE%E4%BD%9C%E6%88%90\" class=\"code-line\" dir=\"auto\" data-line=\"303\">5.3 CA\u7528\u306e\u9375\u3068\u8a3c\u660e\u66f8\u306e\u4f5c\u6210<a id=\"index5.3\"><\/a><\/h3>\n<p class=\"code-line\" dir=\"auto\" data-line=\"304\">\u4eca\u56de\u4f7f\u3046CA\u7528\u306e\u9375\u3068\u8a3c\u660e\u66f8\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">$ openssl req -new -x509 -nodes -sha256 -days 365 -subj \"\/CN=test-ca\" -keyout $BASE\/certs\/ca.key -out $BASE\/certs\/ca.crt<\/pre>\n<p>&nbsp;<\/p>\n<div class=\"code-line\" dir=\"auto\" data-line=\"307\"><\/div>\n<h3 id=\"52-%E3%82%B5%E3%83%BC%E3%83%90%E3%83%BC%E3%81%A7%E7%94%A8%E3%81%84%E3%82%8Bhttps%E7%94%A8%E3%81%AE%E9%8D%B5%E3%82%84%E8%A8%BC%E6%98%8E%E6%9B%B8%E3%81%AA%E3%81%A9%E3%81%AE%E4%BD%9C%E6%88%90\" class=\"code-line code-active-line\" dir=\"auto\" data-line=\"311\">5.4 \u30b5\u30fc\u30d0\u30fc\u3067\u7528\u3044\u308bHTTPS\u7528\u306e\u9375\u3084\u8a3c\u660e\u66f8\u306a\u3069\u306e\u4f5c\u6210<a id=\"index5.4\"><\/a><\/h3>\n<p class=\"code-line\" dir=\"auto\" data-line=\"313\">HTTPS\u306b\u4f7f\u3046\u79d8\u5bc6\u9375\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">$ openssl genrsa -out $BASE\/certs\/keycloak-server.key<\/pre>\n<p>&nbsp;<\/p>\n<div class=\"code-line\" dir=\"auto\" data-line=\"316\"><\/div>\n<p class=\"code-line\" dir=\"auto\" data-line=\"320\">\u6b21\u306b\u4e0a\u8a18\u306e\u79d8\u5bc6\u9375\u3092\u7528\u3044\u3066\u7f72\u540d\u30ea\u30af\u30a8\u30b9\u30c8(CSR)\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">$ openssl req -new -key $BASE\/certs\/keycloak-server.key -sha256 -out $BASE\/certs\/keycloak-server.csr -subj \"\/CN=localhost\"<\/pre>\n<p>&nbsp;<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"323\">\u6700\u5f8c\u306b\u4f5c\u6210\u3057\u305fCSR\u30d5\u30a1\u30a4\u30eb\u3068\u3001CA\u7528\u306e\u8a3c\u660e\u66f8\u3068\u9375\u3092\u7528\u3044\u3066\u3001\u8a3c\u660e\u66f8\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">$ openssl x509 -req -days 365 -sha256 -in $BASE\/certs\/keycloak-s erver.csr -CA $BASE\/certs\/ca.crt -CAkey $BASE\/certs\/ca.key -set_serial 1 -out $BASE\/certs\/keycloak-server.crt<\/pre>\n<div class=\"code-line\" dir=\"auto\" data-line=\"326\"><\/div>\n<h3 id=\"53-%E3%82%AF%E3%83%A9%E3%82%A4%E3%82%A2%E3%83%B3%E3%83%88%E7%94%A8%E3%81%AE%E9%8D%B5%E3%82%84%E8%A8%BC%E6%98%8E%E6%9B%B8%E3%81%AA%E3%81%A9%E3%81%AE%E4%BD%9C%E6%88%90\" class=\"code-line\" dir=\"auto\" data-line=\"330\">5.5 \u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u7528\u306e\u9375\u3084\u8a3c\u660e\u66f8\u306a\u3069\u306e\u4f5c\u6210<a id=\"index5.5\"><\/a><\/h3>\n<p class=\"code-line\" dir=\"auto\" data-line=\"331\">\u5148\u7a0b\u306e\u30b5\u30fc\u30d0\u30fc\u7528\u306e\u8a3c\u660e\u66f8\u3068\u540c\u3058\u3088\u3046\u306b\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u7528\u306e\u9375\u3001\u7f72\u540d\u30ea\u30af\u30a8\u30b9\u30c8\u3001\u8a3c\u660e\u66f8\u3092\u4f5c\u6210\u3057\u3066\u3044\u304d\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">$ openssl genrsa -out $BASE\/certs\/client.key<\/pre>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">$ openssl req -new -key $BASE\/certs\/client.key -out $BASE\/certs\/client.csr -subj \"\/CN=client.example.com\"<\/pre>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">$ openssl x509 -req -days 365 -sha256 -in $BASE\/certs\/client.csr -CA $BASE\/certs\/ca.crt -CAkey $BASE\/certs\/ca.key -set_serial 2 -out $BASE\/certs\/client.crt<\/pre>\n<p>&nbsp;<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"338\">\u524d\u56de\u306e\u8a18\u4e8b\u307e\u3067\u4f7f\u3063\u3066\u3044\u305f\u3001Wildfly \u30d9\u30fc\u30b9\u306eKeycloak\u306e\u30b3\u30f3\u30c6\u30ca\u3067\u306f mTLS \u306b\u5bfe\u5fdc\u3059\u308b\u305f\u3081\u306e\u3001X509_CA_BUNDLE \u3068\u3044\u3046\u74b0\u5883\u5909\u6570\u306b\u306f \u8a3c\u660e\u66f8\u30d5\u30a1\u30a4\u30eb\u3092\u6307\u5b9a\u3059\u308b\u3068\u3088\u3057\u306a\u306b\u3084\u3063\u3066\u304f\u308c\u308b\u3068\u3044\u3046<a href=\"https:\/\/github.com\/keycloak\/keycloak-containers\/blob\/main\/server\/tools\/x509.sh\" data-href=\"https:\/\/github.com\/keycloak\/keycloak-containers\/blob\/main\/server\/tools\/x509.sh\">\u9ed2\u9b54\u8853\u306e\u3088\u3046\u306a\u30b9\u30af\u30ea\u30d7\u30c8<\/a>\u304c\u3042\u308a\u307e\u3057\u305f\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"340\">\u305d\u308c\u3089\u304c\u6709\u52b9\u306a\u5834\u5408\u306f\u4e0b\u8a18\u306e\u3088\u3046\u306a\u6307\u5b9a\u3067\u3057\u305f\u3002<\/p>\n<ul class=\"code-line\" dir=\"auto\" data-line=\"341\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"341\"><code>X509_CA_BUNDLE: \/etc\/x509\/https\/client.crt<\/code><\/li>\n<\/ul>\n<p class=\"code-line\" dir=\"auto\" data-line=\"344\">\u3067\u3059\u304c\u3001 Quarkus \u30d9\u30fc\u30b9\u306eKeycloak\u3067\u306f KC_HTTPS_TRUST_STORE_FILE \u306e\u74b0\u5883\u5909\u6570\u306b\u306f\u30c8\u30e9\u30b9\u30c8\u30b9\u30c8\u30a2\u30d5\u30a1\u30a4\u30eb\u3092\u6307\u5b9a\u3059\u308b\u5fc5\u8981\u304c\u3042\u308b\u306e\u3067\u3001\".jks\u5f62\u5f0f\" \u306e\u30d5\u30a1\u30a4\u30eb\u3092\u4f5c\u6210\u3057\u3066\u3044\u304d\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"346\">\u4e0b\u8a18\u306e\u30b3\u30de\u30f3\u30c9\u3067PKCS12\u5f62\u5f0f\u306b\u4e00\u5ea6\u5909\u63db\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u307e\u305f\u3001\u51e6\u7406\u4e2d\u306e Export Password \u306f changeit \u3067\u884c\u3063\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">$ openssl pkcs12 -export -out $BASE\/certs\/client.p12 -name \"certificate\" -inkey $BASE\/certs\/client.key -in $BASE\/certs\/client.crt<\/pre>\n<p class=\"code-line\" dir=\"auto\" data-line=\"349\">\u6b21\u306bkeytool\u3092\u4f7f\u7528\u3057\u3066 jks\u5f62\u5f0f \u306b\u5909\u63db\u3057\u307e\u3059\u3002\u3067\u3059\u304c keytool \u3092\u52d5\u304b\u3059\u305f\u3081\u306b\u306fJDK\u3092\u5165\u308c\u308b\u305f\u3081\u3001\u307e\u305a\u306fdocker\u3067\u9069\u5f53\u306a ubuntu \u306e\u30b3\u30f3\u30c6\u30ca\u3092\u7acb\u3061\u4e0a\u3052\u307e\u3057\u3087\u3046\u3002 \u30b3\u30f3\u30c6\u30ca\u3092\u52d5\u304b\u3059\u969b\u306b\u306f\u3001\/certs \u3092\u30de\u30a6\u30f3\u30c8\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">$ docker run -it --rm -v $BASE\/certs:\/tmp\/crt ubuntu:23.04<\/pre>\n<p class=\"code-line\" dir=\"auto\" data-line=\"353\">\u307e\u305a\u306f\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u30ea\u30b9\u30c8\u3092\u66f4\u65b0\u3057\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">$ apt -y update<\/pre>\n<p>&nbsp;<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"356\">\u305d\u306e\u5f8c\u30d1\u30c3\u30b1\u30fc\u30b8\u3092\u66f4\u65b0\u3057\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">$ apt upgrade<\/pre>\n<p>&nbsp;<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"359\">\u3067\u306f\u6e96\u5099\u304c\u6574\u3063\u305f\u306e\u3067OpenJDK\u3092\u5165\u308c\u307e\u3057\u3087\u3046\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">$ apt -y install openjdk-19-jdk<\/pre>\n<p>&nbsp;<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"362\">\u6b21\u306bkeytool\u3092\u4f7f\u7528\u3057\u3066 jks\u5f62\u5f0f \u306b\u5909\u63db\u3057\u307e\u3059\u3002\u51e6\u7406\u4e2d\u306e\u51fa\u529b\u5148\u30ad\u30fc\u30b9\u30c8\u30a2\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u3084\u30bd\u30fc\u30b9\u30fb\u30ad\u30fc\u30b9\u30c8\u30a2\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u306f\u5171\u306b changeit \u3067\u884c\u3063\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">$ keytool -importkeystore -srckeystore \/tmp\/crt\/client.p12 -srcstoretype PKCS12 -destkeystore \/tmp\/crt\/client.jks -deststoretype JKS<\/pre>\n<p>&nbsp;<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"365\">\u3067\u306f\u5148\u7a0b\u306edocker-compose.yml\u3092\u307f\u3066\u3001 \u30de\u30a6\u30f3\u30c8\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u3092\u5168\u3066\u6301\u3063\u3066\u3044\u308b\u304b\u3092\u78ba\u8a8d\u3057\u3066\u307f\u307e\u3057\u3087\u3046\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">services:\r\n  keycloak:\r\n    container_name: keycloak\r\n    image: quay.io\/keycloak\/keycloak:21.0.2\r\n    entrypoint: [\"\/opt\/keycloak\/bin\/kc.sh\",\"start-dev\"]\r\n    ports:\r\n      - \"8088:8080\"\r\n      - \"8443:8443\"\r\n    volumes:\r\n      - .\/certs\/keycloak-server.crt:\/opt\/keycloak\/conf\/tls.crt\r\n      - .\/certs\/keycloak-server.key:\/opt\/keycloak\/conf\/tls.key\r\n      - .\/certs\/client.jks:\/opt\/keycloak\/conf\/client.jks\r\n    environment:\r\n      KEYCLOAK_ADMIN: admin\r\n      KEYCLOAK_ADMIN_PASSWORD: password\r\n      KC_LOG_LEVEL: debug\r\n      KC_HTTPS_CERTIFICATE_FILE: \/opt\/keycloak\/conf\/tls.crt\r\n      KC_HTTPS_CERTIFICATE_KEY_FILE: \/opt\/keycloak\/conf\/tls.key\r\n      KC_HTTPS_TRUST_STORE_FILE: \/opt\/keycloak\/conf\/client.jks\r\n      KC_HTTPS_TRUST_STORE_PASSWORD: changeit\r\n      KC_HTTPS_CLIENT_AUTH: request<\/pre>\n<p>&nbsp;<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"392\">\u78ba\u8a8d\u3092\u7d42\u3048\u305f\u3089\u3001\u4e00\u5ea6docker\u74b0\u5883\u3092\u4f5c\u308a\u76f4\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">$ docker-compose down\r\n$ docker-compose up<\/pre>\n<p>&nbsp;<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"396\">docker\u306e\u8d77\u52d5\u3092\u78ba\u8a8d\u3057\u305f\u3089\u3001\u4e0b\u8a18\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3057\u3066MTLS\u304c\u6210\u529f\u3057\u3066\u3044\u308b\u304b\u3092\u78ba\u8a8d\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">$ curl -v https:\/\/localhost:8443 --cacert $BASE\/certs\/ca.crt --key $BASE\/certs\/client.key --cert .\/certs\/client.crt<\/pre>\n<p>&nbsp;<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"400\">\u6b63\u3057\u304f\u8a2d\u5b9a\u3067\u304d\u3066\u3044\u308c\u3070\u3001\u4e0b\u8a18\u306e\u3088\u3046\u306a\u30ec\u30b9\u30dd\u30f3\u30b9\u304c\u8fd4\u308a\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">*   Trying ::1...\r\n* TCP_NODELAY set\r\n* Connected to localhost (::1) port 8443 (#0)\r\n* ALPN, offering h2\r\n* ALPN, offering http\/1.1\r\n* successfully set certificate verify locations:\r\n*   CAfile: \/Users\/k-nakamura\/Desktop\/test\/certs\/ca.crt\r\n  CApath: none\r\n* TLSv1.2 (OUT), TLS handshake, Client hello (1):\r\n* TLSv1.2 (IN), TLS handshake, Server hello (2):\r\n* TLSv1.2 (IN), TLS handshake, Certificate (11):\r\n* TLSv1.2 (IN), TLS handshake, Server key exchange (12):\r\n* TLSv1.2 (IN), TLS handshake, Request CERT (13):\r\n* TLSv1.2 (IN), TLS handshake, Server finished (14):\r\n* TLSv1.2 (OUT), TLS handshake, Certificate (11):\r\n* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):\r\n* TLSv1.2 (OUT), TLS handshake, CERT verify (15):\r\n* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):\r\n* TLSv1.2 (OUT), TLS handshake, Finished (20):\r\n* TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):\r\n* TLSv1.2 (IN), TLS handshake, Finished (20):\r\n* SSL connection using TLSv1.2 \/ ECDHE-RSA-AES256-GCM-SHA384\r\n* ALPN, server accepted to use h2\r\n* Server certificate:\r\n*  subject: CN=localhost\r\n*  start date: Mar 2 10:07:58 2023 GMT\r\n*  expire date: Mar 1 10:07:58 2024 GMT\r\n*  common name: localhost (matched)\r\n*  issuer: CN=test-ca\r\n*  SSL certificate verify ok.\r\n* Using HTTP2, server supports multi-use\r\n* Connection state changed (HTTP\/2 confirmed)\r\n* Copying HTTP\/2 data in stream buffer to connection buffer after upgrade: len=0\r\n* Using Stream ID: 1 (easy handle 0x7fd512011c00)\r\n&gt; GET \/ HTTP\/2\r\n&gt; Host: localhost:8443\r\n&gt; User-Agent: curl\/7.64.1\r\n&gt; Accept: *\/*\r\n&gt;\r\n* Connection state changed (MAX_CONCURRENT_STREAMS == 100)!\r\n&lt; HTTP\/2 200\r\n--- \u4ee5\u4e0b\u7565 ---<\/pre>\n<p class=\"code-line\" dir=\"auto\" data-line=\"546\">\u307e\u305f\u3001docker-compse\u306e\u74b0\u5883\u3092\u4f5c\u308a\u76f4\u3057\u305f\u306e\u3067\u3001HTTPS\u3067<a href=\"https:\/\/localhost:8443\/admin\" data-href=\"https:\/\/localhost:8443\/admin\">\u7ba1\u7406\u753b\u9762<\/a>\u3092\u958b\u304d\u3001\u4e0b\u8a18\u306e\u60c5\u5831\u3092\u518d\u5ea6\u8a2d\u5b9a\u3057\u3066\u304a\u3044\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<ul class=\"code-line\" dir=\"auto\" data-line=\"548\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"548\">\u30ec\u30eb\u30e0<\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"549\">\u30e6\u30fc\u30b6\u30fc<\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"550\">\u30af\u30e9\u30a4\u30a2\u30f3\u30c8<\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"551\">\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc<\/li>\n<\/ul>\n<h3 id=\"54-keycloak%E5%81%B4%E3%81%A7%E3%81%AE%E8%A8%AD%E5%AE%9A\" class=\"code-line code-active-line\" dir=\"auto\" data-line=\"552\">5.6 Keycloak\u5074\u3067\u306e\u8a2d\u5b9a<a id=\"index5.4\"><\/a><\/h3>\n<p class=\"code-line\" dir=\"auto\" data-line=\"554\">\u3067\u306fMTLS\u3067\u306e\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u8a8d\u8a3c\u306b\u5fc5\u8981\u306a\u6b8b\u308a\u306e\u4f5c\u696d\u3068\u3057\u3066\u3001Keycloak\u5074\u306e\u8a2d\u5b9a\u3057\u3066\u3044\u304d\u307e\u3059\u3002\u4f5c\u696d\u524d\u306b\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc\u306e test-policy \u3092\u7121\u52b9\u5316\u3057\u3066\u304a\u304d\u307e\u3057\u3087\u3046\u3002\u7121\u52b9\u5316\u5f8c\u306b clients \u30bf\u30d6\u304b\u3089 test-client \u306e\u8a2d\u5b9a\u306b\u79fb\u52d5\u3057\u3066\u3001 Credentials \u306e\u30bf\u30d6\u306b\u79fb\u52d5\u3057\u307e\u3059\u3002<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-59513\" src=\"\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/test-client-credentials-tab-1024x572.png\" alt=\"\" width=\"1024\" height=\"572\" srcset=\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/test-client-credentials-tab-1024x572.png 1024w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/test-client-credentials-tab-360x201.png 360w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/test-client-credentials-tab-768x429.png 768w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/test-client-credentials-tab.png 1286w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"538\">\u305d\u3057\u3066 Client Authenticator \u306e\u30d5\u30a3\u30fc\u30eb\u30c9\u304b\u3089 X509 Certificate \u3092\u9078\u629e\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u6b21\u306b\u3001Subject DN \u306e\u30d5\u30a3\u30fc\u30eb\u30c9\u3092 CN=client.example.com \u306b\u5909\u66f4\u3057\u3066\u3001Save \u3092\u62bc\u3057\u3066\u304f\u3060\u3055\u3044\u3002<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-59514\" src=\"\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-x509-setting-1024x567.png\" alt=\"\" width=\"1024\" height=\"567\" srcset=\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-x509-setting-1024x567.png 1024w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-x509-setting-360x199.png 360w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-x509-setting-768x426.png 768w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-x509-setting.png 1294w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"540\">\u4e0b\u8a18\u306e\u3088\u3046\u306a\u78ba\u8a8d\u306e\u30dd\u30c3\u30d7\u30a2\u30c3\u30d7\u304c\u51fa\u305f\u3089\u3001Yes \u3092\u9078\u629e\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<p dir=\"auto\" data-line=\"540\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-59515\" src=\"\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-x509-setting-check-1024x572.png\" alt=\"\" width=\"1024\" height=\"572\" srcset=\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-x509-setting-check-1024x572.png 1024w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-x509-setting-check-360x201.png 360w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-x509-setting-check-768x429.png 768w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-x509-setting-check.png 1292w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"566\">\u5909\u66f4\u5f8c\u306b \u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc\u306e test-policy \u3092\u518d\u5ea6\u6709\u52b9\u306b\u5909\u66f4\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"568\">\u3067\u306f\u518d\u5ea6<a href=\"https:\/\/localhost:8443\/realms\/sample-realm\/protocol\/openid-connect\/auth?response_type=code&amp;scope=openid%20email&amp;client_id=test-client&amp;nonce=abcdefghijk&amp;state=abcdefghijk&amp;redirect_uri=https%3A%2F%2Fclient.example.com%2Ftest&amp;code_challenge=x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE&amp;code_challenge_method=S256\" data-href=\"https:\/\/localhost:8443\/realms\/sample-realm\/protocol\/openid-connect\/auth?response_type=code&amp;scope=openid%20email&amp;client_id=test-client&amp;nonce=abcdefghijk&amp;state=abcdefghijk&amp;redirect_uri=https%3A%2F%2Fclient.example.com%2Ftest&amp;code_challenge=x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE&amp;code_challenge_method=S256\">\u8a8d\u53ef\u30ea\u30af\u30a8\u30b9\u30c8<\/a>\u3092\u9001\u3063\u3066\u307f\u307e\u3057\u3087\u3046\u3002\u307e\u305f\u3001\u3053\u306e\u969b\u306bHTTP\u304b\u3089HTTPS\u306b\u3001\u307e\u305fdocker-compose\u306b\u8a18\u8f09\u3057\u305fport\u3068\u5408\u308f\u305b\u3066\u30018088\u304b\u30898443\u306b\u5909\u66f4\u3057\u3066\u9001\u4fe1\u3057\u3066\u307f\u307e\u3057\u3087\u3046\u3002<\/p>\n<ul class=\"code-line\" dir=\"auto\" data-line=\"570\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"570\"><a href=\"https:\/\/localhost:8443\/realms\/sample-realm\/protocol\/openid-connect\/auth?response_type=code&amp;scope=openid%20email&amp;client_id=test-client&amp;nonce=abcdefghijk&amp;state=abcdefghijk&amp;redirect_uri=https%3A%2F%2Fclient.example.com%2Ftest&amp;code_challenge=x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE&amp;code_challenge_method=S256\" data-href=\"https:\/\/localhost:8443\/realms\/sample-realm\/protocol\/openid-connect\/auth?response_type=code&amp;scope=openid%20email&amp;client_id=test-client&amp;nonce=abcdefghijk&amp;state=abcdefghijk&amp;redirect_uri=https%3A%2F%2Fclient.example.com%2Ftest&amp;code_challenge=x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE&amp;code_challenge_method=S256\">https:\/\/localhost:8443\/realms\/sample-realm\/protocol\/openid-connect\/auth?response_type=code&amp;scope=openid email&amp;client_id=test-client&amp;nonce=abcdefghijk&amp;state=abcdefghijk&amp;redirect_uri=https%3A%2F%2Fclient.example.com%2Ftest&amp;code_challenge=x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE&amp;code_challenge_method=S256<\/a><\/li>\n<\/ul>\n<p class=\"code-line\" dir=\"auto\" data-line=\"572\">URL\u6b04\u304b\u3089\u30ec\u30b9\u30dd\u30f3\u30b9\u3092\u78ba\u8a8d\u3059\u308b\u3068\u4e0b\u8a18\u306e\u3088\u3046\u306a\u5024\u304c\u78ba\u8a8d\u3067\u304d\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">https:\/\/client.example.com\/test?error=invalid_request&amp;error_description=Missing+parameter%3A+%27request%27+or+%27request_uri%27&amp;state=abcdefghijk<\/pre>\n<p class=\"code-line\" dir=\"auto\" data-line=\"574\">URL \u306e\u30af\u30a8\u30ea\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u3092\u30c7\u30b3\u30fc\u30c9\u3057\u3066\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u898b\u3066\u307f\u308b\u3068\u3001 \u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u306e request \u306a\u3044\u3057\u306f request_uri \u306e\u3069\u3061\u3089\u304b\u304c\u4e0d\u8db3\u3057\u3066\u3044\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002<\/p>\n<table class=\"code-line\" dir=\"auto\" data-line=\"577\">\n<thead class=\"code-line\" dir=\"auto\" data-line=\"577\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"577\">\n<th>\u30d1\u30e9\u30e1\u30fc\u30bf\u540d<\/th>\n<th>\u5024<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"code-line\" dir=\"auto\" data-line=\"579\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"579\">\n<td>error<\/td>\n<td>invalid_client<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"580\">\n<td>error_description<\/td>\n<td>Missing parameter: 'request' or 'request_uri'<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p class=\"code-line\" dir=\"auto\" data-line=\"582\">\u3067\u306f\u00a0<a title=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html\" href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html\" data-href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html\">FAPI1 Advanced<\/a>\u00a0\u306b\u95a2\u9023\u3059\u308b\u8a18\u8ff0\u304c\u306a\u3044\u304b\u3092\u78ba\u8a8d\u3057\u3066\u307f\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"584\"><a title=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html#authorization-server\" href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html#authorization-server\" data-href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html#authorization-server\">\u8a8d\u53ef\u30b5\u30fc\u30d0\u30fc\u306b\u95a2\u3059\u308b\u8a18\u8ff0<\/a>\u306b\u4e0b\u8a18\u306e\u3088\u3046\u306a\u8a18\u8ff0\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">1. shall require a JWS signed JWT request object passed by value with the request parameter or by reference with the request_uri parameter;\r\n<\/pre>\n<p class=\"code-line\" dir=\"auto\" data-line=\"564\">\u3064\u307e\u308a\u8a8d\u53ef\u30ea\u30af\u30a8\u30b9\u30c8\u306b\u306f request \u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u306a\u3044\u3057\u306f\u3000request_uri \u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u3092\u7528\u3044\u3066\u3001JWS (\u7f72\u540d\u4ed8\u304d JWT )\u3092\u6e21\u3059\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<h2 id=\"6-%E3%83%AA%E3%82%AF%E3%82%A8%E3%82%B9%E3%83%88%E3%82%AA%E3%83%96%E3%82%B8%E3%82%A7%E3%82%AF%E3%83%88%E3%81%B8%E3%81%AE%E5%AF%BE%E5%BF%9C\" class=\"code-line\" dir=\"auto\" data-line=\"592\">6. \u30ea\u30af\u30a8\u30b9\u30c8\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u5bfe\u5fdc<a id=\"index6\"><\/a><\/h2>\n<p class=\"code-line\" dir=\"auto\" data-line=\"651\">\u30ea\u30af\u30a8\u30b9\u30c8\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306f\u3001\u8a8d\u53ef\u30ea\u30af\u30a8\u30b9\u30c8\u306e Claim \u304c\u30ea\u30af\u30a8\u30b9\u30c8\u30d1\u30e9\u30e1\u30fc\u30bf\u3068\u306a\u308b JWT \u3067\u3059\u3002request \u30d1\u30e9\u30e1\u30fc\u30bf\u306a\u3044\u3057\u306f request_uri \u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u4f7f\u3046\u3053\u3068\u3067\u8a8d\u53ef\u30ea\u30af\u30a8\u30b9\u30c8\u306b\u306e\u305b\u308b\u3053\u3068\u304c\u3067\u304d\u3001JWT\u306b\u7f72\u540d\u30fb\u6697\u53f7\u5316\u3059\u308b\u3053\u3068\u304c\u53ef\u80fd\u3067\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"655\">\u305d\u308c\u305e\u308c\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u306f\u30aa\u30d7\u30b7\u30e7\u30ca\u30eb\u3067\u3042\u308a\u3001request \u306e\u5834\u5408\u306fJWT\u306e\u5024\u3092\u793a\u3057\u307e\u3059\u3002\u4f8b\u793a\u3059\u308b\u3068\u3001\u7f72\u540d\u3059\u308b\u524d\u306eJWT\u3067\u306f\u4e0b\u8a18\u306e\u3088\u3046\u306a\u5024\u3067\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">{\r\n  \"iss\": \"test-client\",\r\n  \"aud\": \"https:\/\/localhost:8443\/realms\/sample-realm\",\r\n  \"response_type\": \"code\",\r\n  \"scope\": \"openid email\",\r\n  \"client_id\": \"test-client\",\r\n  \"nonce\": \"abcdefghijk\",\r\n  \"state\": \"abcdefghijk\",\r\n  \"redirect_uri\": \"https:\/\/client.example.com\/test\",\r\n  \"code_challenge\": \"x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE\",\r\n  \"code_challenge_method\": \"S256\"\r\n}\r\n```<\/pre>\n<p>request_uri \u306e\u5834\u5408\u306fJWT\u306e\u53c2\u7167\u5148\u3092\u793a\u3057\u307e\u3059\u3002\u4f8b\u793a\u3059\u308b\u3068\u4e0b\u8a18\u306e\u3088\u3046\u306a\u5024\u3067\u3059<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">https%3A%2F%2Fclient.example.com%2Frequest.jwt%23GkurKxf5T0Y-mnPFCHqWOMiZi4VS138cQO_V7PZHAdM<\/pre>\n<div>\n<p class=\"code-line code-active-line\" dir=\"auto\" data-line=\"679\">\u4eca\u56de\u306e\u691c\u8a3c\u3067\u306f\u8a8d\u53ef\u30ea\u30af\u30a8\u30b9\u30c8\u306e request \u30d1\u30e9\u30e1\u30fc\u30bf\u306b\u3001JWT\u306b\u7f72\u540d\u3057\u305fJWS\u3092\u7528\u3044\u9032\u3081\u307e\u3059\u3002\u7c21\u6613\u306e\u30a4\u30e1\u30fc\u30b8\u56f3\u3092\u51fa\u3059\u3068\u4e0b\u8a18\u306e\u3088\u3046\u306a\u30a4\u30e1\u30fc\u30b8\u3067\u3059\u3002<\/p>\n<div class=\"code-line\" dir=\"auto\" data-line=\"681\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-59901\" src=\"\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/request-object.png\" alt=\"\" width=\"812\" height=\"281\" srcset=\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/request-object.png 812w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/request-object-360x125.png 360w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/request-object-768x266.png 768w\" sizes=\"auto, (max-width: 812px) 100vw, 812px\" \/><\/div>\n<\/div>\n<h3 id=\"61-jws%E3%81%AB%E4%BD%BF%E3%81%86%E3%82%A2%E3%83%AB%E3%82%B4%E3%83%AA%E3%82%BA%E3%83%A0%E3%81%AE%E6%A4%9C%E8%A8%8E\" class=\"code-line\" dir=\"auto\" data-line=\"594\">6.1 JWS\u306b\u4f7f\u3046\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u306e\u691c\u8a0e<a id=\"index6.1\"><\/a><\/h3>\n<p class=\"code-line\" dir=\"auto\" data-line=\"595\">\u3053\u3053\u304b\u3089 JWS \u306e\u7f72\u540d\u306e\u305f\u3081\u306e\u9375\u60c5\u5831\u306a\u3069\u3092\u4f5c\u6210\u3057\u3066\u3044\u304d\u307e\u3057\u3087\u3046\u3002\u307e\u305a\u306f\u7f72\u540d\u306e\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u3092\u6307\u5b9a\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"597\">\u3067\u306f\u3001\u30ea\u30af\u30a8\u30b9\u30c8\u30aa\u30d6\u30b8\u30a7\u30af\u30c8( JWS )\u306e\u7f72\u540d\u306b\u4f7f\u3046\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u306b\u3064\u3044\u3066\u3001<a title=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html\" href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html\" data-href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html\">FAPI1 Advanced<\/a>\u00a0\u306e\u4e2d\u3067 JWS \u306e\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u306b\u95a2\u9023\u3059\u308b\u8a18\u8ff0\u304c\u306a\u3044\u304b\u3092\u78ba\u8a8d\u3057\u3066\u307f\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"599\">\u3059\u308b\u3068\u00a0<a title=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html#security-considerations\" href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html#security-considerations\" data-href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html#security-considerations\">8. Security considerations<\/a>\u00a0\u306e\u4e2d\u306e\u3001<a title=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html#algorithm-considerations\" href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html#algorithm-considerations\" data-href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html#algorithm-considerations\">8.6. Algorithm considerations<\/a>\u306b\u4e0b\u8a18\u306e\u8a18\u8ff0\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">8.6.  Algorithm considerations\r\n    For JWS, both clients and authorization servers\r\n        1. shall use PS256 or ES256 algorithms;\r\n        2. should not use algorithms that use RSASSA-PKCS1-v1_5 (e.g. RS256); and\r\n        3. shall not use none.<\/pre>\n<p class=\"code-line code-active-line\" dir=\"auto\" data-line=\"609\">\u3064\u307e\u308a RS256 \u3068 none \u306f\u4f7f\u3046\u3079\u304d\u3067\u306a\u304f\u3001PS256 \u53c8\u306f ES256 \u3092\u4f7f\u3046\u3079\u304d\u3060\u3068\u3044\u3046\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u306e\u3067\u3001\u4eca\u56de\u306fPS256\u3092\u9078\u629e\u3057\u3066\u307f\u307e\u3059\u3002<\/p>\n<h3 id=\"62-jws%E3%81%AB%E4%BD%BF%E3%81%86%E9%8D%B5%E6%83%85%E5%A0%B1%E3%81%A8jwks%E3%81%AE%E4%BD%9C%E6%88%90\" class=\"code-line\" dir=\"auto\" data-line=\"611\">6.2 JWS\u306b\u4f7f\u3046\u9375\u60c5\u5831\u3068JWKS\u306e\u4f5c\u6210<a id=\"index6.2\"><\/a><\/h3>\n<p class=\"code-line\" dir=\"auto\" data-line=\"612\">\u6b21\u306b\u3001\u9375\u60c5\u5831\u3068 JWKS \u3092\u4f5c\u6210\u3059\u308b\u5fc5\u8981\u304c\u3042\u308b\u306e\u3067\u3059\u304c\u3001\u4eca\u56de\u306f<a title=\"https:\/\/mkjwk.org\/\" href=\"https:\/\/mkjwk.org\/\" data-href=\"https:\/\/mkjwk.org\/\">mkjwk.org<\/a>\u00a0\u3068\u3044\u3046\u30b5\u30fc\u30d3\u30b9\u3092\u4f7f\u3063\u3066\u307f\u307e\u3057\u3087\u3046\u3002\u307e\u305a\u306f\u753b\u9762\u53f3\u4e0a\u304b\u3089\u65e5\u672c\u8a9e\u306b\u8a00\u8a9e\u3092\u5909\u66f4\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"614\">\u6b21\u306b\u30bf\u30d6\u304b\u3089 \"RSA\" \u3092\u9078\u629e\u3057\u3066\u3001\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u306f\u4e0b\u8a18\u3092\u6307\u5b9a\u3057\u305f\u5f8c\u306b\u3001\"\u751f\u6210\u3059\u308b\" \u3092\u62bc\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<table class=\"code-line\" dir=\"auto\" data-line=\"616\">\n<thead class=\"code-line\" dir=\"auto\" data-line=\"616\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"616\">\n<th>\u30d5\u30a3\u30fc\u30eb\u30c9\u540d<\/th>\n<th>\u5024<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"code-line\" dir=\"auto\" data-line=\"618\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"618\">\n<td>\u9375\u306e\u30b5\u30a4\u30ba<\/td>\n<td>2048<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"619\">\n<td>\u9375\u306e\u7528\u9014<\/td>\n<td>\u7f72\u540d<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"620\">\n<td>\u9375\u306e\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0<\/td>\n<td>PS256: RSASSA-PSS using SHA-256 and MGF1 with SHA-256<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"621\">\n<td>\u9375\u306eID<\/td>\n<td>test \u203b\u30c7\u30d5\u30a9\u30eb\u30c8\u306eSpecify\u306e\u72b6\u614b\u306e\u307e\u307e test \u3092\u6307\u5b9a\u3057\u3066\u304f\u3060\u3055\u3044<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"622\">\n<td>Show X.509<\/td>\n<td>Yes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p class=\"code-line\" dir=\"auto\" data-line=\"624\">\u4e0b\u8a18\u306e\u3088\u3046\u306b \u516c\u958b\u9375\u30fb\u79d8\u5bc6\u9375\u30fb JWKS \u304c\u751f\u6210\u3055\u308c\u307e\u3059\u3002<\/p>\n<p dir=\"auto\" data-line=\"599\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-59491\" src=\"\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/mkjwk-rsa.png\" alt=\"\" width=\"743\" height=\"942\" srcset=\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/mkjwk-rsa.png 743w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/mkjwk-rsa-284x360.png 284w\" sizes=\"auto, (max-width: 743px) 100vw, 743px\" \/><\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"602\">\u4eca\u56de\u306e\u691c\u8a3c\u3067\u306e\u516c\u958b\u9375\u306f\u3001\u4e00\u4f8b\u3068\u3057\u3066\u4e0b\u8a18\u306e\u3082\u306e\u3092\u4f7f\u3044\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">-----BEGIN PUBLIC KEY-----\r\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAgoDU7p\/7uzESHYCDGN1E\r\nDCszYShRL8woEb6HKaGjUJDsBwD79IvedvzPbdy\/is5AIWPWfdyEaNmNixodEUQm\r\nXhvPabn7AFnrwXluGTraABTDimuSZWgLq0pkVXDiNA7ki3IYw\/dHqu3\/YkesjkOS\r\n5svSHVA5C\/yqegnkv2H9Ij8ETIyno9vzr4HKjpqVRI1CmuBRd1fgg8D2ju0pX5cc\r\nc6o9AoOgpDaoEThcYpcodgGrxZhmRJZazvoXkizMGAXZ64Zry4RJoUjwJVTVdTjx\r\njIw9KeI2S8\/uoxC74iUDOiBmi2SHokX8nCTDTLsCIMoCzZM9BR1cwDLvFfg4by0n\r\nkQIDAQAB\r\n-----END PUBLIC KEY-----<\/pre>\n<p>&nbsp;<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"602\">\u4eca\u56de\u306e\u691c\u8a3c\u3067\u306e\u79d8\u5bc6\u9375\u306f\u3001\u4e00\u4f8b\u3068\u3057\u3066\u4e0b\u8a18\u306e\u3082\u306e\u3092\u4f7f\u3044\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">-----BEGIN PRIVATE KEY-----\r\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCCgNTun\/u7MRId\r\ngIMY3UQMKzNhKFEvzCgRvocpoaNQkOwHAPv0i952\/M9t3L+KzkAhY9Z93IRo2Y2L\r\nGh0RRCZeG89pufsAWevBeW4ZOtoAFMOKa5JlaAurSmRVcOI0DuSLchjD90eq7f9i\r\nR6yOQ5Lmy9IdUDkL\/Kp6CeS\/Yf0iPwRMjKej2\/OvgcqOmpVEjUKa4FF3V+CDwPaO\r\n7Slflxxzqj0Cg6CkNqgROFxilyh2AavFmGZEllrO+heSLMwYBdnrhmvLhEmhSPAl\r\nVNV1OPGMjD0p4jZLz+6jELviJQM6IGaLZIeiRfycJMNMuwIgygLNkz0FHVzAMu8V\r\n+DhvLSeRAgMBAAECggEAe3lXffsCWwc\/o4gvAXyAYJ8TOs7Bmd6o3rkM+1fCxHyJ\r\nxMqqmKMpthzWSZT96V\/hj3X9wBG\/edC0ujLX47k+L\/ZSFS9xC9EIXYL9p4NmNYNv\r\ny2yiE64QtF1rdueaLjUVCdbHFcrGFTSfWCaGXggTWqjnwPJhNzU1OshXlLgqn5Xx\r\nTm4Go1Pr4LqjyaMzh5wPNnTP4ElNSwCBTI35b8BDwCqSNiooWrR2VmDo0IsXLCSh\r\nX9l22kbcBMcjqhWRn3E6GP7knYprEffpEBMW+XVlog73zAAha7WC6LZd9Xpv4djN\r\ngTMzepPeo9kd3oPakHfoZMnUkOVzbjy1JtDR2UfSLQKBgQDPuUkjeznpdxELJymQ\r\n1muXDqtLeiXBA3r+MgQhL8y2W8BBaLrePd3zcFpwkVZw5MVdVM3xX9tJPmbdsG5B\r\ntCTvGGrjzZll6hPQq296EDdSbGca\/pfibfdvVJgJT5PrFlLc\/FGqq6Zj3QlUsXIe\r\nBp5r\/SEcbKOGQIKIEUqqJuc9EwKBgQCg1T2wyG5SDgm0bNEhL7rdi+89sgSbewwh\r\nwGY7FKWDGmK7ymrNrwjokg6DeniB7qH\/xd1f+72MdQdWCJjm0xcjv5Z07bEvp6fA\r\noXN6g2+79BYuLvC3IFDeAbQqsZypOpgHmII4W70jyQ\/oASRIXxL3iAJaatSXNpm6\r\nCqTTRCARSwKBgF2MuZakKXmuaNuYAI09M+ks7xIn6ZbahWqzhc6YY16BRb1veDEc\r\ntbesEt79ZWukbApTZghdvjlnRBZ1HcKzaarQWVtMvdf7Kn9gpezYHsIdFfY\/UJHm\r\nKnhWJb6Tuy81t43UiMcPVPlGk6wz2gwRuQkzT9UoTCDrLp4vA2xL5vpHAoGAY46c\r\neWoYoEKAT2dsrRZWnf2ZQp+Hqpcok1v97GSDb\/xNUeGi61+GLDD9OvX80rFdJm7c\r\n8iVq2B85Q1BfFcNld4OJJyhbnhwyA1Ptn9DswXP+puf3qeQfKs3zMNpxF3Bl243U\r\nTf67vgMgDYVnaEUyAHf4vO+UWWY7Eqa0EPMCxrECgYEAq0DCJvjKeBUZ1XODvQ1n\r\n7W2ZNjmVRztJZwvfssWWOX2I3e8X9krYTRin\/EnRJhtQsF8LNq17H01izW8hZ0uX\r\nET3KUr5F91bVP2Jxis2QHWt9l586cDmd9X1XeXWCQv1+vNI+9v0ULQ4sNxsN6u2q\r\nsiZWb2FpceQgn0qPRFuegaY=\r\n-----END PRIVATE KEY-----<\/pre>\n<p>&nbsp;<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"602\">\u305d\u3057\u3066 JWKS \u306f\u3001\u4e00\u4f8b\u3068\u3057\u3066\u4e0b\u8a18\u306e\u3082\u306e\u3092\u4f7f\u3044\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"602\">JWKS\u306f\u4efb\u610f\u306e\u30c6\u30ad\u30b9\u30c8\u30d5\u30a1\u30a4\u30eb(\u4f8b: jwks.txt)\u306b\u4fdd\u5b58\u3057\u3066\u304a\u3044\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">{\r\n    \"keys\": [\r\n        {\r\n            \"p\": \"z7lJI3s56XcRCycpkNZrlw6rS3olwQN6_jIEIS_MtlvAQWi63j3d83BacJFWcOTFXVTN8V_bST5m3bBuQbQk7xhq482ZZeoT0KtvehA3UmxnGv6X4m33b1SYCU-T6xZS3PxRqqumY90JVLFyHgaea_0hHGyjhkCCiBFKqibnPRM\",\r\n            \"kty\": \"RSA\",\r\n            \"q\": \"oNU9sMhuUg4JtGzRIS-63YvvPbIEm3sMIcBmOxSlgxpiu8pqza8I6JIOg3p4ge6h_8XdX_u9jHUHVgiY5tMXI7-WdO2xL6enwKFzeoNvu_QWLi7wtyBQ3gG0KrGcqTqYB5iCOFu9I8kP6AEkSF8S94gCWmrUlzaZugqk00QgEUs\",\r\n            \"d\": \"e3lXffsCWwc_o4gvAXyAYJ8TOs7Bmd6o3rkM-1fCxHyJxMqqmKMpthzWSZT96V_hj3X9wBG_edC0ujLX47k-L_ZSFS9xC9EIXYL9p4NmNYNvy2yiE64QtF1rdueaLjUVCdbHFcrGFTSfWCaGXggTWqjnwPJhNzU1OshXlLgqn5XxTm4Go1Pr4LqjyaMzh5wPNnTP4ElNSwCBTI35b8BDwCqSNiooWrR2VmDo0IsXLCShX9l22kbcBMcjqhWRn3E6GP7knYprEffpEBMW-XVlog73zAAha7WC6LZd9Xpv4djNgTMzepPeo9kd3oPakHfoZMnUkOVzbjy1JtDR2UfSLQ\",\r\n            \"e\": \"AQAB\",\r\n            \"use\": \"sig\",\r\n            \"kid\": \"test\",\r\n            \"qi\": \"q0DCJvjKeBUZ1XODvQ1n7W2ZNjmVRztJZwvfssWWOX2I3e8X9krYTRin_EnRJhtQsF8LNq17H01izW8hZ0uXET3KUr5F91bVP2Jxis2QHWt9l586cDmd9X1XeXWCQv1-vNI-9v0ULQ4sNxsN6u2qsiZWb2FpceQgn0qPRFuegaY\",\r\n            \"dp\": \"XYy5lqQpea5o25gAjT0z6SzvEifpltqFarOFzphjXoFFvW94MRy1t6wS3v1la6RsClNmCF2-OWdEFnUdwrNpqtBZW0y91_sqf2Cl7Ngewh0V9j9QkeYqeFYlvpO7LzW3jdSIxw9U-UaTrDPaDBG5CTNP1ShMIOsuni8DbEvm-kc\",\r\n            \"alg\": \"PS256\",\r\n            \"dq\": \"Y46ceWoYoEKAT2dsrRZWnf2ZQp-Hqpcok1v97GSDb_xNUeGi61-GLDD9OvX80rFdJm7c8iVq2B85Q1BfFcNld4OJJyhbnhwyA1Ptn9DswXP-puf3qeQfKs3zMNpxF3Bl243UTf67vgMgDYVnaEUyAHf4vO-UWWY7Eqa0EPMCxrE\",\r\n            \"n\": \"goDU7p_7uzESHYCDGN1EDCszYShRL8woEb6HKaGjUJDsBwD79IvedvzPbdy_is5AIWPWfdyEaNmNixodEUQmXhvPabn7AFnrwXluGTraABTDimuSZWgLq0pkVXDiNA7ki3IYw_dHqu3_YkesjkOS5svSHVA5C_yqegnkv2H9Ij8ETIyno9vzr4HKjpqVRI1CmuBRd1fgg8D2ju0pX5ccc6o9AoOgpDaoEThcYpcodgGrxZhmRJZazvoXkizMGAXZ64Zry4RJoUjwJVTVdTjxjIw9KeI2S8_uoxC74iUDOiBmi2SHokX8nCTDTLsCIMoCzZM9BR1cwDLvFfg4by0nkQ\"\r\n        }\r\n    ]\r\n}<\/pre>\n<p class=\"code-line\" dir=\"auto\" data-line=\"680\">JWKS \u306f\u4efb\u610f\u306e\u30c6\u30ad\u30b9\u30c8\u30d5\u30a1\u30a4\u30eb(\u4f8b: jwks.txt)\u306b\u4fdd\u5b58\u3057\u3066\u304a\u3044\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<h3 id=\"63-keycloak%E3%81%8B%E3%82%89jwks%E3%81%AE%E8%A8%AD%E5%AE%9A\" class=\"code-line\" dir=\"auto\" data-line=\"682\">6.3 Keycloak\u304b\u3089JWKS\u306e\u8a2d\u5b9a<a id=\"index6.3\"><\/a><\/h3>\n<p class=\"code-line\" dir=\"auto\" data-line=\"683\">\u6b21\u306b Keycloak \u306e\u8a2d\u5b9a\u3067\u3059\u304c\u3001clients \u30bf\u30d6\u304b\u3089 test-client \u306e\u8a2d\u5b9a\u306b\u79fb\u52d5\u3057\u3066\u3001 Keys \u306e\u30bf\u30d6\u306b\u79fb\u52d5\u3057\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"685\">JWKS\u3092\u8aad\u307f\u8fbc\u307e\u305b\u308b\u305f\u3081\u306b\u3001\u4e0b\u8a18\u306eimport\u3092\u62bc\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"678\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-59492\" src=\"\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-key-1024x524.png\" alt=\"\" width=\"1024\" height=\"524\" srcset=\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-key-1024x524.png 1024w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-key-360x184.png 360w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-key-768x393.png 768w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-key.png 1266w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"681\">Archive format \u306e\u5024\u3092 JSON Web Key Set \u306b\u5909\u66f4\u3057\u307e\u3059\u3002\u305d\u306e\u5f8c Import file \u3067\u5148\u7a0b\u4f5c\u6210\u3057\u305f jwks \u3092\u542b\u3093\u3060\u30d5\u30a1\u30a4\u30eb\u3092\u6307\u5b9a\u3057\u3066 Import \u3092\u62bc\u3057\u3066\u304f\u3060\u3055\u3044\u3002<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-59493\" src=\"\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-key-import-jwks-1024x526.png\" alt=\"\" width=\"1024\" height=\"526\" srcset=\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-key-import-jwks-1024x526.png 1024w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-key-import-jwks-360x185.png 360w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-key-import-jwks-768x394.png 768w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-key-import-jwks.png 1262w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"684\">\u4e0b\u8a18\u306e\u3088\u3046\u306a\u8868\u793a\u304c\u3067\u305f\u3089\u5b8c\u4e86\u3067\u3059\u3002<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-59494\" src=\"\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-key-import-jwks-fin-1024x520.png\" alt=\"\" width=\"1024\" height=\"520\" srcset=\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-key-import-jwks-fin-1024x520.png 1024w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-key-import-jwks-fin-360x183.png 360w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-key-import-jwks-fin-768x390.png 768w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/client-key-import-jwks-fin.png 1259w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<h3 id=\"64-%E3%83%AA%E3%82%AF%E3%82%A8%E3%82%B9%E3%83%88%E3%82%AA%E3%83%96%E3%82%B8%E3%82%A7%E3%82%AF%E3%83%88%E3%81%AE%E4%BD%9C%E6%88%90\" class=\"code-line\" dir=\"auto\" data-line=\"695\">6.4 \u30ea\u30af\u30a8\u30b9\u30c8\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u4f5c\u6210<a id=\"index6.4\"><\/a><\/h3>\n<p class=\"code-line\" dir=\"auto\" data-line=\"696\">\u3067\u306f\u3001\u6b21\u306b\u30ea\u30af\u30a8\u30b9\u30c8\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3067\u3042\u308b JWS (\u7f72\u540d\u4ed8\u304d JWT)\u3092\u4f5c\u6210\u3057\u3066\u3044\u304d\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"698\">\u4eca\u56de\u306f Ruby \u3067 JWS \u3092\u4f5c\u6210\u3057\u3066\u3044\u304d\u307e\u3059\u3002Ruby \u306e\u5b9f\u884c\u74b0\u5883\u306b\u3064\u3044\u3066\u306f Docker \u3067\u9069\u5f53\u306a Ruby \u30b3\u30f3\u30c6\u30ca\u3092\u4f5c\u6210\u3057\u3001 irb (Ruby \u30b3\u30f3\u30bd\u30fc\u30eb)\u3067\u4f5c\u696d\u3057\u3066\u3044\u304d\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"700\">\u307e\u305a\u306f\u30b3\u30f3\u30c6\u30ca\u3092\u7acb\u3061\u4e0a\u3052\u3066\u63a5\u7d9a\u3057\u307e\u3059\u3002\u30a4\u30e1\u30fc\u30b8\u306f<a href=\"https:\/\/hub.docker.com\/_\/ruby\" data-href=\"https:\/\/hub.docker.com\/_\/ruby\">docker\u516c\u5f0f<\/a>\u306e\u3082\u306e\u3092\u4f7f\u3063\u3066\u3044\u304d\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">$ docker run -it --rm ruby:3.0 bash<\/pre>\n<p>&nbsp;<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"703\">\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3059\u308b\u3068\u3001\u30b3\u30de\u30f3\u30c9\u3092\u53d7\u3051\u4ed8\u3051\u308b\u72b6\u614b\u306b\u306a\u3063\u3066\u3044\u308b\u3068\u601d\u3044\u307e\u3059\u306e\u3067\u5f15\u304d\u7d9a\u304d\u3053\u306e\u74b0\u5883\u3067\u4f5c\u696d\u3092\u7d9a\u3051\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"705\">JWS\u306e\u4f5c\u6210\u306b\u306f\u00a0<a href=\"https:\/\/github.com\/nov\/json-jwt\" data-href=\"https:\/\/github.com\/nov\/json-jwt\">JSON::JWT<\/a>\u00a0\u3068\u3044\u3046 gem \u3092\u4f7f\u3063\u3066\u3044\u304d\u307e\u3059\u3002\u4e0b\u8a18\u306e\u30b3\u30de\u30f3\u30c9\u3067 gem \u3092 install \u3057\u307e\u3057\u3087\u3046\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">$ gem install json-jwt<\/pre>\n<p>&nbsp;<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"708\">grep \u30b3\u30de\u30f3\u30c9\u3067 gem \u304c\u5b58\u5728\u3059\u308b\u3053\u3068\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">$ gem list | grep json-jwt<\/pre>\n<p>&nbsp;<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"711\">\u3067\u306f\u3053\u3053\u3067 irb ( Ruby \u30b3\u30f3\u30bd\u30fc\u30eb)\u3092\u958b\u3044\u3066\u3044\u304d\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">$ irb<\/pre>\n<p>&nbsp;<\/p>\n<p>\u203b \u4ee5\u964d irb \u5185\u306e\u30d7\u30ed\u30b0\u30e9\u30e0\u306f &gt; \u8a18\u53f7\u306e\u5f8c\u308d\u306b\u7d9a\u3051\u3066\u8a18\u8f09\u3057\u3066\u3044\u304d\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"715\">\u3067\u306f JWS (\u7f72\u540d\u4ed8\u304d JWT)\u3092\u4f5c\u6210\u3057\u3066\u3044\u304d\u307e\u3059\u3002 \u307e\u305a\u306f gem \u3092\u8aad\u307f\u8fbc\u307f\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">&gt; require 'json\/jwt'\r\n=&gt; true<\/pre>\n<p>\u6b21\u306b\u79d8\u5bc6\u9375\u3092\u5909\u6570\u306b\u4fdd\u5b58\u3057\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">&gt; private_key = OpenSSL::PKey::RSA.new &lt;&lt;-PEM\r\n-----BEGIN PRIVATE KEY-----\r\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCCgNTun\/u7MRId\r\ngIMY3UQMKzNhKFEvzCgRvocpoaNQkOwHAPv0i952\/M9t3L+KzkAhY9Z93IRo2Y2L\r\nGh0RRCZeG89pufsAWevBeW4ZOtoAFMOKa5JlaAurSmRVcOI0DuSLchjD90eq7f9i\r\nR6yOQ5Lmy9IdUDkL\/Kp6CeS\/Yf0iPwRMjKej2\/OvgcqOmpVEjUKa4FF3V+CDwPaO\r\n7Slflxxzqj0Cg6CkNqgROFxilyh2AavFmGZEllrO+heSLMwYBdnrhmvLhEmhSPAl\r\nVNV1OPGMjD0p4jZLz+6jELviJQM6IGaLZIeiRfycJMNMuwIgygLNkz0FHVzAMu8V\r\n+DhvLSeRAgMBAAECggEAe3lXffsCWwc\/o4gvAXyAYJ8TOs7Bmd6o3rkM+1fCxHyJ\r\nxMqqmKMpthzWSZT96V\/hj3X9wBG\/edC0ujLX47k+L\/ZSFS9xC9EIXYL9p4NmNYNv\r\ny2yiE64QtF1rdueaLjUVCdbHFcrGFTSfWCaGXggTWqjnwPJhNzU1OshXlLgqn5Xx\r\nTm4Go1Pr4LqjyaMzh5wPNnTP4ElNSwCBTI35b8BDwCqSNiooWrR2VmDo0IsXLCSh\r\nX9l22kbcBMcjqhWRn3E6GP7knYprEffpEBMW+XVlog73zAAha7WC6LZd9Xpv4djN\r\ngTMzepPeo9kd3oPakHfoZMnUkOVzbjy1JtDR2UfSLQKBgQDPuUkjeznpdxELJymQ\r\n1muXDqtLeiXBA3r+MgQhL8y2W8BBaLrePd3zcFpwkVZw5MVdVM3xX9tJPmbdsG5B\r\ntCTvGGrjzZll6hPQq296EDdSbGca\/pfibfdvVJgJT5PrFlLc\/FGqq6Zj3QlUsXIe\r\nBp5r\/SEcbKOGQIKIEUqqJuc9EwKBgQCg1T2wyG5SDgm0bNEhL7rdi+89sgSbewwh\r\nwGY7FKWDGmK7ymrNrwjokg6DeniB7qH\/xd1f+72MdQdWCJjm0xcjv5Z07bEvp6fA\r\noXN6g2+79BYuLvC3IFDeAbQqsZypOpgHmII4W70jyQ\/oASRIXxL3iAJaatSXNpm6\r\nCqTTRCARSwKBgF2MuZakKXmuaNuYAI09M+ks7xIn6ZbahWqzhc6YY16BRb1veDEc\r\ntbesEt79ZWukbApTZghdvjlnRBZ1HcKzaarQWVtMvdf7Kn9gpezYHsIdFfY\/UJHm\r\nKnhWJb6Tuy81t43UiMcPVPlGk6wz2gwRuQkzT9UoTCDrLp4vA2xL5vpHAoGAY46c\r\neWoYoEKAT2dsrRZWnf2ZQp+Hqpcok1v97GSDb\/xNUeGi61+GLDD9OvX80rFdJm7c\r\n8iVq2B85Q1BfFcNld4OJJyhbnhwyA1Ptn9DswXP+puf3qeQfKs3zMNpxF3Bl243U\r\nTf67vgMgDYVnaEUyAHf4vO+UWWY7Eqa0EPMCxrECgYEAq0DCJvjKeBUZ1XODvQ1n\r\n7W2ZNjmVRztJZwvfssWWOX2I3e8X9krYTRin\/EnRJhtQsF8LNq17H01izW8hZ0uX\r\nET3KUr5F91bVP2Jxis2QHWt9l586cDmd9X1XeXWCQv1+vNI+9v0ULQ4sNxsN6u2q\r\nsiZWb2FpceQgn0qPRFuegaY=\r\n-----END PRIVATE KEY-----\r\nPEM\r\n=&gt; #&lt;OpenSSL::PKey::RSA:0x000055be5c356c48 oid=rsaEncryption&gt;<\/pre>\n<p>\u6b21\u306b\u30da\u30a4\u30ed\u30fc\u30c9\u7528\u306e\u5909\u6570\u3092\u6e96\u5099\u3057\u307e\u3059\u3002\u57fa\u672c\u7684\u306b\u306f\u8a8d\u53ef\u30ea\u30af\u30a8\u30b9\u30c8\u306b\u7528\u3044\u305f\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u5217\u6319\u3057\u3066\u3044\u307e\u3059\u304c\u3001<a href=\"https:\/\/openid-foundation-japan.github.io\/openid-connect-core-1_0.ja.html#RequestObject\" data-href=\"https:\/\/openid-foundation-japan.github.io\/openid-connect-core-1_0.ja.html#RequestObject\">OpenID Connect Core<\/a>\u306b\u5247\u308a JWS \u306a\u306e\u3067\u3001 iss \u53ca\u3073 aud \u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u30ea\u30af\u30a8\u30b9\u30c8\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306b\u542b\u3081\u308b\u305f\u3081\u3001payload\u306b\u542b\u3093\u3067\u3044\u304d\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">&gt; payload = {\r\n  'iss': 'test-client',\r\n  'aud': 'https:\/\/localhost:8443\/realms\/sample-realm',\r\n  'response_type': 'code',\r\n  'scope': 'openid email',\r\n  'client_id': 'test-client',\r\n  'nonce': 'abcdefghijk',\r\n  'state': 'abcdefghijk',\r\n  'redirect_uri': 'https:\/\/client.example.com\/test',\r\n  'code_challenge': 'x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE',\r\n  'code_challenge_method': 'S256'\r\n}\r\n=&gt;\r\n{:iss=&gt;\"test-client\",\r\n...<\/pre>\n<p>\u3067\u306f\u30da\u30a4\u30ed\u30fc\u30c9\u3092JWT\u5316\u3057\u307e\u3057\u3087\u3046\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">&gt; jwt = JSON::JWT.new payload\r\n=&gt;\r\n{\"iss\"=&gt;\"test-client\",\r\n...<\/pre>\n<p>\u307e\u305f\u3001kid \u3092 \"test\" \u3068\u3057\u305f\u306e\u3067\u305d\u308c\u3092\u542b\u3081\u3066\u3044\u304d\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">jwt.kid = \"test\"\r\n=&gt; \"test\"<\/pre>\n<p>JWT\u306b\u7f72\u540d\u3057\u3066\u3001JWS \u3092\u4f5c\u6210\u3057\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">&gt; signed_jwt = jwt.sign(private_key, :PS256)\r\n=&gt;\r\n{\"iss\"=&gt;\"test-client\",\r\n...<\/pre>\n<p>\u4f5c\u6210\u3057\u305f JWS \u3092\u78ba\u8a8d\u3057\u3066\u307f\u307e\u3057\u3087\u3046\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">&gt; signed_jwt.to_s\r\n=&gt; \"eyJ0eXAiOiJKV1QiLCJhbGciOiJQUzI1NiIsImtpZCI6InRlc3QifQ.eyJpc3MiOiJ0ZXN0LWNsaWVudCIsImF1ZCI6Imh0dHBzOi8vbG9jYWxob3N0Ojg0NDMvcmVhbG1zL3NhbXBsZS1yZWFsbSIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIiwic2NvcGUiOiJvcGVuaWQgZW1haWwiLCJjbGllbnRfaWQiOiJ0ZXN0LWNsaWVudCIsIm5vbmNlIjoiYWJjZGVmZ2hpamsiLCJzdGF0ZSI6ImFiY2RlZmdoaWprIiwicmVkaXJlY3RfdXJpIjoiaHR0cHM6Ly9jbGllbnQuZXhhbXBsZS5jb20vdGVzdCIsImNvZGVfY2hhbGxlbmdlIjoieDVUelk3RjczcHd1cE4yTW14Vl9wNjVwYVJjN3ZKck43YjFjUkwyQ0lHRSIsImNvZGVfY2hhbGxlbmdlX21ldGhvZCI6IlMyNTYifQ.IVS25OPyr58_1gXzTrQIMEIud98Ie4zYu5iJts7tnpWO0d3JggRy8IV3c1d31fXiSTh_qccY8n5jYS-lDxqSfPYRMaSs_8WMIj55qC9A30kNPL14ywwgkQR04J9Jqv0EbEI5JmSt4JU-dPisLE3XcDCQCh_ezLftjorjIstE9e3FixD7YuFmYMeFxY33LGRUYR0DuzXqps6Aju-rtJ_kLBwyt5jE5sVstz433Ogi81kEwpJgHO-Plz7fQuWY52a9KfToY_qT8hq7BAy8xAvzmvj8L8gDFZjh_Ew9woWQsFZ9egY5jGJsqdeGrA-6pIjkWqQqeJ3ONHDAbvluXliFqA\"<\/pre>\n<p class=\"code-line \" dir=\"auto\" data-line=\"804\">\u74b0\u5883\u3054\u3068\u306b\u5024\u306f\u5909\u308f\u308a\u307e\u3059\u304c\u3001\u4e0a\u8a18\u306e\u3088\u3046\u306a JWS \u5f62\u5f0f\u306e\u6587\u5b57\u5217\u3092\u53d6\u5f97\u3067\u304d\u308b\u306e\u3067\u3001\u3053\u308c\u3092\u30ea\u30af\u30a8\u30b9\u30c8\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3068\u3057\u3066\u4f7f\u3063\u3066\u3044\u304d\u307e\u3059\u3002<\/p>\n<h3 id=\"65-jws%E4%BB%98%E3%81%8D%E3%81%AE%E8%AA%8D%E5%8F%AF%E3%83%AA%E3%82%AF%E3%82%A8%E3%82%B9%E3%83%88%E3%81%AE%E4%BD%9C%E6%88%90%E3%83%BB%E9%80%81%E4%BF%A1\" class=\"code-line\" dir=\"auto\" data-line=\"806\">6.5 JWS\u4ed8\u304d\u306e\u8a8d\u53ef\u30ea\u30af\u30a8\u30b9\u30c8\u306e\u4f5c\u6210\u30fb\u9001\u4fe1<a id=\"index6.5\"><\/a><\/h3>\n<p class=\"code-line\" dir=\"auto\" data-line=\"807\">\u3067\u306f\u6b21\u306b\u8a8d\u53ef\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u4f5c\u6210\u3057\u3066\u3044\u304d\u307e\u3059\u3002<\/p>\n<p class=\"code-line \" dir=\"auto\" data-line=\"809\">\u5148\u7a0b\u4f5c\u3063\u305f\u30ea\u30af\u30a8\u30b9\u30c8\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u4eca\u307e\u3067\u9001\u4fe1\u3057\u3066\u3044\u305f\u8a8d\u53ef\u30ea\u30af\u30a8\u30b9\u30c8\u306b\u4ed8\u4e0e\u3059\u308b\u306e\u3067\u3059\u304c\u3001\u30ea\u30af\u30a8\u30b9\u30c8\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u5185\u306b\u5b58\u5728\u3059\u308b\u306e\u3067\u4eca\u56de\u306f\u3001 state, nonce, redirect_uri \u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u7701\u7565\u3057\u307e\u3059\u3002<\/p>\n<ul class=\"code-line \" dir=\"auto\" data-line=\"811\">\n<li class=\"code-line \" dir=\"auto\" data-line=\"811\"><a href=\"https:\/\/localhost:8443\/realms\/sample-realm\/protocol\/openid-connect\/auth?response_type=code&amp;scope=openid%20email&amp;client_id=test-client&amp;code_challenge=x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE&amp;code_challenge_method=S256&amp;request=eyJ0eXAiOiJKV1QiLCJhbGciOiJQUzI1NiIsImtpZCI6InRlc3QifQ.eyJpc3MiOiJ0ZXN0LWNsaWVudCIsImF1ZCI6Imh0dHBzOi8vbG9jYWxob3N0Ojg0NDMvcmVhbG1zL3NhbXBsZS1yZWFsbSIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIiwic2NvcGUiOiJvcGVuaWQgZW1haWwiLCJjbGllbnRfaWQiOiJ0ZXN0LWNsaWVudCIsIm5vbmNlIjoiYWJjZGVmZ2hpamsiLCJzdGF0ZSI6ImFiY2RlZmdoaWprIiwicmVkaXJlY3RfdXJpIjoiaHR0cHM6Ly9jbGllbnQuZXhhbXBsZS5jb20vdGVzdCIsImNvZGVfY2hhbGxlbmdlIjoieDVUelk3RjczcHd1cE4yTW14Vl9wNjVwYVJjN3ZKck43YjFjUkwyQ0lHRSIsImNvZGVfY2hhbGxlbmdlX21ldGhvZCI6IlMyNTYifQ.IVS25OPyr58_1gXzTrQIMEIud98Ie4zYu5iJts7tnpWO0d3JggRy8IV3c1d31fXiSTh_qccY8n5jYS-lDxqSfPYRMaSs_8WMIj55qC9A30kNPL14ywwgkQR04J9Jqv0EbEI5JmSt4JU-dPisLE3XcDCQCh_ezLftjorjIstE9e3FixD7YuFmYMeFxY33LGRUYR0DuzXqps6Aju-rtJ_kLBwyt5jE5sVstz433Ogi81kEwpJgHO-Plz7fQuWY52a9KfToY_qT8hq7BAy8xAvzmvj8L8gDFZjh_Ew9woWQsFZ9egY5jGJsqdeGrA-6pIjkWqQqeJ3ONHDAbvluXliFqA\" data-href=\"https:\/\/localhost:8443\/realms\/sample-realm\/protocol\/openid-connect\/auth?response_type=code&amp;scope=openid%20email&amp;client_id=test-client&amp;code_challenge=x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE&amp;code_challenge_method=S256&amp;request=eyJ0eXAiOiJKV1QiLCJhbGciOiJQUzI1NiIsImtpZCI6InRlc3QifQ.eyJpc3MiOiJ0ZXN0LWNsaWVudCIsImF1ZCI6Imh0dHBzOi8vbG9jYWxob3N0Ojg0NDMvcmVhbG1zL3NhbXBsZS1yZWFsbSIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIiwic2NvcGUiOiJvcGVuaWQgZW1haWwiLCJjbGllbnRfaWQiOiJ0ZXN0LWNsaWVudCIsIm5vbmNlIjoiYWJjZGVmZ2hpamsiLCJzdGF0ZSI6ImFiY2RlZmdoaWprIiwicmVkaXJlY3RfdXJpIjoiaHR0cHM6Ly9jbGllbnQuZXhhbXBsZS5jb20vdGVzdCIsImNvZGVfY2hhbGxlbmdlIjoieDVUelk3RjczcHd1cE4yTW14Vl9wNjVwYVJjN3ZKck43YjFjUkwyQ0lHRSIsImNvZGVfY2hhbGxlbmdlX21ldGhvZCI6IlMyNTYifQ.U3FxYIWOvN38V42FELxDQ-5B-wSICtlb1mmvpPccIpV1SPtozO0VeEEeCtiWDCIgiCkyXY1OUIh3CUITmREeaEA3iUWpB8Nh8AKJFoQrLbTZhGUTPyRZQJ5rm-qAARj-LeQy8DX32PboW9erz94h8UYLvmj-721sCE-WH5EoMX-afvjwMlUTnPvf5LapqoGqO3Zs72dn-Um0jijLAxOwylQhSMU9NMVcqarVcD-mhw0TK7lYwuKFUE979iLTBEf7ExUuoSOhP0CfFn-ZVheI80hfmzBy6-pdoFd1R_qLB0NEKQrTbI5o0PA-3MtRvnmdd29SyeYRNLQLuzNWWQuHcg\">https:\/\/localhost:8443\/realms\/sample-realm\/protocol\/openid-connect\/auth?response_type=code&amp;scope=openid email&amp;client_id=test-client&amp;code_challenge=x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE&amp;code_challenge_method=S256&amp;request=eyJ0eXAiOiJKV1QiLCJhbGciOiJQUzI1NiIsImtpZCI6InRlc3QifQ.eyJpc3MiOiJ0ZXN0LWNsaWVudCIsImF1ZCI6Imh0dHBzOi8vbG9jYWxob3N0Ojg0NDMvcmVhbG1zL3NhbXBsZS1yZWFsbSIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIiwic2NvcGUiOiJvcGVuaWQgZW1haWwiLCJjbGllbnRfaWQiOiJ0ZXN0LWNsaWVudCIsIm5vbmNlIjoiYWJjZGVmZ2hpamsiLCJzdGF0ZSI6ImFiY2RlZmdoaWprIiwicmVkaXJlY3RfdXJpIjoiaHR0cHM6Ly9jbGllbnQuZXhhbXBsZS5jb20vdGVzdCIsImNvZGVfY2hhbGxlbmdlIjoieDVUelk3RjczcHd1cE4yTW14Vl9wNjVwYVJjN3ZKck43YjFjUkwyQ0lHRSIsImNvZGVfY2hhbGxlbmdlX21ldGhvZCI6IlMyNTYifQ.IVS25OPyr58_1gXzTrQIMEIud98Ie4zYu5iJts7tnpWO0d3JggRy8IV3c1d31fXiSTh_qccY8n5jYS-lDxqSfPYRMaSs_8WMIj55qC9A30kNPL14ywwgkQR04J9Jqv0EbEI5JmSt4JU-dPisLE3XcDCQCh_ezLftjorjIstE9e3FixD7YuFmYMeFxY33LGRUYR0DuzXqps6Aju-rtJ_kLBwyt5jE5sVstz433Ogi81kEwpJgHO-Plz7fQuWY52a9KfToY_qT8hq7BAy8xAvzmvj8L8gDFZjh_Ew9woWQsFZ9egY5jGJsqdeGrA-6pIjkWqQqeJ3ONHDAbvluXliFqA<\/a><\/li>\n<\/ul>\n<p class=\"code-line\" dir=\"auto\" data-line=\"813\">URL\u6b04\u304b\u3089\u30ec\u30b9\u30dd\u30f3\u30b9\u3092\u78ba\u8a8d\u3059\u308b\u3068\u4e0b\u8a18\u306e\u3088\u3046\u306a\u5024\u304c\u78ba\u8a8d\u3067\u304d\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">https:\/\/client.example.com\/test?error=invalid_request_object&amp;error_description=Missing+parameter+in+the+%27request%27+object%3A+exp&amp;state=abcdefghijk<\/pre>\n<p class=\"code-line \" dir=\"auto\" data-line=\"819\">URL \u306e\u30af\u30a8\u30ea\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u3092\u30c7\u30b3\u30fc\u30c9\u3057\u3066\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u898b\u3066\u307f\u308b\u3068\u3001\u30ea\u30af\u30a8\u30b9\u30c8\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306bexp\u30af\u30ec\u30fc\u30e0\u304c\u8db3\u308a\u306a\u3044\u3068\u308f\u304b\u308a\u307e\u3059\u3002<\/p>\n<table class=\"code-line\" dir=\"auto\" data-line=\"821\">\n<thead class=\"code-line\" dir=\"auto\" data-line=\"821\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"821\">\n<th>\u30d1\u30e9\u30e1\u30fc\u30bf\u540d<\/th>\n<th>\u5024<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"code-line\" dir=\"auto\" data-line=\"823\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"823\">\n<td>error<\/td>\n<td>invalid_request_object<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"824\">\n<td>error_description<\/td>\n<td>Missing parameter in the 'request' object: exp<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p class=\"code-line\" dir=\"auto\" data-line=\"826\">\u3067\u306f\u00a0<a href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html\" data-href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html\">FAPI1 Advanced<\/a>\u00a0\u306bexp\u30af\u30ec\u30fc\u30e0\u306b\u3064\u3044\u3066\u95a2\u9023\u3059\u308b\u8a18\u8ff0\u304c\u306a\u3044\u304b\u3092\u78ba\u8a8d\u3057\u3066\u307f\u307e\u3059\u3002<a href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0-final.html#authorization-server\" data-href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0-final.html#authorization-server\">\u8a8d\u53ef\u30b5\u30fc\u30d0\u30fc\u306b\u95a2\u3059\u308b\u8a18\u8ff0<\/a>\u306b\u4e0b\u8a18\u306e\u3088\u3046\u306a\u8a18\u8ff0\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">13. shall require the request object to contain an exp claim that has a lifetime of no longer than 60 minutes after the nbf claim;<\/pre>\n<p>&nbsp;<\/p>\n<p class=\"code-line \" dir=\"auto\" data-line=\"832\"><a href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html\" data-href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html\">FAPI1 Advanced<\/a>\u00a0\u3067\u306f\u00a0<a href=\"https:\/\/openid-foundation-japan.github.io\/openid-connect-core-1_0.ja.html#RequestObject\" data-href=\"https:\/\/openid-foundation-japan.github.io\/openid-connect-core-1_0.ja.html#RequestObject\">OpenID Connect Core<\/a>\u00a0\u306e\u4e2d\u3067\u306f\u5fc5\u9808\u3068\u3055\u308c\u3066\u3044\u306a\u3044 exp \u30af\u30ec\u30fc\u30e0\u3092\u542b\u3080\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002\u307e\u305f\u3053\u306e\u6587\u7ae0\u3067 nbf \u30af\u30ec\u30fc\u30e0\u5f8c\u306e\u751f\u5b58\u671f\u9593\u304c60\u5206\u4ee5\u5185\u3067\u3042\u308b\u3053\u3068\u3082\u8a18\u8f09\u3055\u308c\u3066\u3044\u308b\u306e\u3067\u3001 nbf \u30af\u30ec\u30fc\u30e0\u3082\u5fc5\u8981\u3067\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002<\/p>\n<p class=\"code-line \" dir=\"auto\" data-line=\"834\">\u3067\u306f irb \u3067\u30ea\u30af\u30a8\u30b9\u30c8\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u4f5c\u6210\u3059\u308b\u969b\u306b exp \u30af\u30ec\u30fc\u30e0\u3068 nbf \u30af\u30ec\u30fc\u30e0\u3092\u8ffd\u52a0\u3057\u3066\u307f\u307e\u3057\u3087\u3046\u3002\u4e0b\u8a18\u3067\u306f\u5909\u66f4\u90e8\u5206\u3060\u3051\u629c\u7c8b\u3057\u3066\u8a18\u8f09\u3057\u307e\u3059\u304c\u3001\u540c\u3058\u3088\u3046\u306b\u30ea\u30af\u30a8\u30b9\u30c8\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e JWS \u3092\u4f5c\u6210\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">&gt; payload = {\r\n  'iss': 'test-client',\r\n  'aud': 'https:\/\/localhost:8443\/realms\/sample-realm',\r\n  'response_type': 'code',\r\n  'scope': 'openid email',\r\n  'client_id': 'test-client',\r\n  'nonce': 'abcdefghijk',\r\n  'state': 'abcdefghijk',\r\n  'redirect_uri': 'https:\/\/client.example.com\/test',\r\n  'code_challenge': 'x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE',\r\n  'code_challenge_method': 'S256'\r\n}<\/pre>\n<p class=\"code-line\" dir=\"auto\" data-line=\"812\">\u3053\u306e\u60c5\u5831\u3067\u4f5c\u308a\u51fa\u3057\u305f\u30ea\u30af\u30a8\u30b9\u30c8\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u4f8b\u304c\u4e0b\u8a18\u3067\u3059\u3002<\/p>\n<div>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">eyJ0eXAiOiJKV1QiLCJhbGciOiJQUzI1NiIsImtpZCI6InRlc3QifQ.eyJpc3MiOiJ0ZXN0LWNsaWVudCIsImF1ZCI6Imh0dHBzOi8vbG9jYWxob3N0Ojg0NDMvcmVhbG1zL3NhbXBsZS1yZWFsbSIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIiwic2NvcGUiOiJvcGVuaWQgZW1haWwiLCJjbGllbnRfaWQiOiJ0ZXN0LWNsaWVudCIsIm5vbmNlIjoiYWJjZGVmZ2hpamsiLCJzdGF0ZSI6ImFiY2RlZmdoaWprIiwicmVkaXJlY3RfdXJpIjoiaHR0cHM6Ly9jbGllbnQuZXhhbXBsZS5jb20vdGVzdCIsImNvZGVfY2hhbGxlbmdlIjoieDVUelk3RjczcHd1cE4yTW14Vl9wNjVwYVJjN3ZKck43YjFjUkwyQ0lHRSIsImNvZGVfY2hhbGxlbmdlX21ldGhvZCI6IlMyNTYiLCJuYmYiOjE2ODExNjkyMzIsImV4cCI6MTY4MTE3MjgzMn0.ARyVgGffpejqpJAHeScOQXZLHPprvoxnqbjWNVMica6NoghLbfIin09W0YRYnRczUDZvpMgXWwbMi8hGmRdXgw1pofOBZ-K-xK9VE5aaTgmkh2ArSW8P2W4IeyZaRS83iD6KiZnM-8qalcy7eB9imOnd8A1LPg0bFcA-eU5_7BCjed47_Pb7HyJcu0EraSJh4ESOQrvMRxMfu6HsrIS6CiJZjp-jfbDTZMcTyTlqMemcCQAFWQrLTZypwbIrs7W2WaYUZWjpg_oAzX53Fdy0r3o9uL3nvGZ1JdJ8U4ppPDnCYzJwHEdlO-Hhyil5lPAjd8UU5FgcM5QqHWLxufOw_A<\/pre>\n<\/div>\n<p class=\"code-line\" dir=\"auto\" data-line=\"859\">\u3067\u306f\u8a8d\u53ef\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u4f5c\u6210\u3057\u3066\u958b\u3044\u3066\u307f\u307e\u3057\u3087\u3046\u3002<\/p>\n<ul class=\"code-line\" dir=\"auto\" data-line=\"860\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"860\"><a href=\"https:\/\/localhost:8443\/realms\/sample-realm\/protocol\/openid-connect\/auth?response_type=code&amp;scope=openid%20email&amp;client_id=test-client&amp;code_challenge=x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE&amp;code_challenge_method=S256&amp;request=eyJ0eXAiOiJKV1QiLCJhbGciOiJQUzI1NiIsImtpZCI6InRlc3QifQ.eyJpc3MiOiJ0ZXN0LWNsaWVudCIsImF1ZCI6Imh0dHBzOi8vbG9jYWxob3N0Ojg0NDMvcmVhbG1zL3NhbXBsZS1yZWFsbSIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIiwic2NvcGUiOiJvcGVuaWQgZW1haWwiLCJjbGllbnRfaWQiOiJ0ZXN0LWNsaWVudCIsIm5vbmNlIjoiYWJjZGVmZ2hpamsiLCJzdGF0ZSI6ImFiY2RlZmdoaWprIiwicmVkaXJlY3RfdXJpIjoiaHR0cHM6Ly9jbGllbnQuZXhhbXBsZS5jb20vdGVzdCIsImNvZGVfY2hhbGxlbmdlIjoieDVUelk3RjczcHd1cE4yTW14Vl9wNjVwYVJjN3ZKck43YjFjUkwyQ0lHRSIsImNvZGVfY2hhbGxlbmdlX21ldGhvZCI6IlMyNTYiLCJuYmYiOjE2ODExNjkyMzIsImV4cCI6MTY4MTE3MjgzMn0.ARyVgGffpejqpJAHeScOQXZLHPprvoxnqbjWNVMica6NoghLbfIin09W0YRYnRczUDZvpMgXWwbMi8hGmRdXgw1pofOBZ-K-xK9VE5aaTgmkh2ArSW8P2W4IeyZaRS83iD6KiZnM-8qalcy7eB9imOnd8A1LPg0bFcA-eU5_7BCjed47_Pb7HyJcu0EraSJh4ESOQrvMRxMfu6HsrIS6CiJZjp-jfbDTZMcTyTlqMemcCQAFWQrLTZypwbIrs7W2WaYUZWjpg_oAzX53Fdy0r3o9uL3nvGZ1JdJ8U4ppPDnCYzJwHEdlO-Hhyil5lPAjd8UU5FgcM5QqHWLxufOw_A\" data-href=\"https:\/\/localhost:8443\/realms\/sample-realm\/protocol\/openid-connect\/auth?response_type=code&amp;scope=openid%20email&amp;client_id=test-client&amp;code_challenge=x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE&amp;code_challenge_method=S256&amp;request=eyJ0eXAiOiJKV1QiLCJhbGciOiJQUzI1NiIsImtpZCI6InRlc3QifQ.eyJpc3MiOiJ0ZXN0LWNsaWVudCIsImF1ZCI6Imh0dHBzOi8vbG9jYWxob3N0Ojg0NDMvcmVhbG1zL3NhbXBsZS1yZWFsbSIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIiwic2NvcGUiOiJvcGVuaWQgZW1haWwiLCJjbGllbnRfaWQiOiJ0ZXN0LWNsaWVudCIsIm5vbmNlIjoiYWJjZGVmZ2hpamsiLCJzdGF0ZSI6ImFiY2RlZmdoaWprIiwicmVkaXJlY3RfdXJpIjoiaHR0cHM6Ly9jbGllbnQuZXhhbXBsZS5jb20vdGVzdCIsImNvZGVfY2hhbGxlbmdlIjoieDVUelk3RjczcHd1cE4yTW14Vl9wNjVwYVJjN3ZKck43YjFjUkwyQ0lHRSIsImNvZGVfY2hhbGxlbmdlX21ldGhvZCI6IlMyNTYiLCJuYmYiOjE2Nzc3NTMzMjMsImV4cCI6MTY3Nzc1NjkyM30.ORnQzQMAaj6U8YPMElgA9xPnunvtNjC-eVmpjQrlNdmMzy0TuZeC4uS6sZoYvBYJwL2iU1Pp82i8uzZQI3z95LE1QJ9gFNfDpOKiseL3MJOracULdFbNSRSIiiqGgqLZI0X9UZclOqU1Tlel2K159sqx5H6uYcWEPkWS2kU_H5hR9IBUyx0rUDx6Q5EE32zxEl_3R5c2X92gRtqoJPT5AwGRiSspQ4y5iAq0Vd7wY3sRlOYW8skSnB9Bhi7KKxvUSF1a7SFmECxLhRUkka3naPUkYf7WYWufWip0EXxFUDEQiRjymIoqUlHFDq6xS3NxPWXkjUZswJs4vsCS-bqsDw\">https:\/\/localhost:8443\/realms\/sample-realm\/protocol\/openid-connect\/auth?response_type=code&amp;scope=openid email&amp;client_id=test-client&amp;code_challenge=x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE&amp;code_challenge_method=S256&amp;request=eyJ0eXAiOiJKV1QiLCJhbGciOiJQUzI1NiIsImtpZCI6InRlc3QifQ.eyJpc3MiOiJ0ZXN0LWNsaWVudCIsImF1ZCI6Imh0dHBzOi8vbG9jYWxob3N0Ojg0NDMvcmVhbG1zL3NhbXBsZS1yZWFsbSIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIiwic2NvcGUiOiJvcGVuaWQgZW1haWwiLCJjbGllbnRfaWQiOiJ0ZXN0LWNsaWVudCIsIm5vbmNlIjoiYWJjZGVmZ2hpamsiLCJzdGF0ZSI6ImFiY2RlZmdoaWprIiwicmVkaXJlY3RfdXJpIjoiaHR0cHM6Ly9jbGllbnQuZXhhbXBsZS5jb20vdGVzdCIsImNvZGVfY2hhbGxlbmdlIjoieDVUelk3RjczcHd1cE4yTW14Vl9wNjVwYVJjN3ZKck43YjFjUkwyQ0lHRSIsImNvZGVfY2hhbGxlbmdlX21ldGhvZCI6IlMyNTYiLCJuYmYiOjE2ODExNjkyMzIsImV4cCI6MTY4MTE3MjgzMn0.ARyVgGffpejqpJAHeScOQXZLHPprvoxnqbjWNVMica6NoghLbfIin09W0YRYnRczUDZvpMgXWwbMi8hGmRdXgw1pofOBZ-K-xK9VE5aaTgmkh2ArSW8P2W4IeyZaRS83iD6KiZnM-8qalcy7eB9imOnd8A1LPg0bFcA-eU5_7BCjed47_Pb7HyJcu0EraSJh4ESOQrvMRxMfu6HsrIS6CiJZjp-jfbDTZMcTyTlqMemcCQAFWQrLTZypwbIrs7W2WaYUZWjpg_oAzX53Fdy0r3o9uL3nvGZ1JdJ8U4ppPDnCYzJwHEdlO-Hhyil5lPAjd8UU5FgcM5QqHWLxufOw_A<\/a><\/li>\n<\/ul>\n<p class=\"code-line\" dir=\"auto\" data-line=\"862\">URL\u6b04\u304b\u3089\u30ec\u30b9\u30dd\u30f3\u30b9\u3092\u78ba\u8a8d\u3059\u308b\u3068\u4e0b\u8a18\u306e\u3088\u3046\u306a\u5024\u304c\u78ba\u8a8d\u3067\u304d\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">https:\/\/client.example.com\/test?error=invalid_request&amp;error_description=invalid+response_type&amp;state=abcdefghijk\r\n<\/pre>\n<p class=\"code-line\" dir=\"auto\" data-line=\"868\">URL \u306e\u30af\u30a8\u30ea\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u3092\u30c7\u30b3\u30fc\u30c9\u3057\u3066\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u898b\u3066\u307f\u308b\u3068\u3001\u6307\u5b9a\u3055\u308c\u305f response_type \u3067\u30d6\u30e9\u30a6\u30b6\u30ed\u30b0\u30a4\u30f3\u3092\u958b\u59cb\u3067\u304d\u306a\u3044\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002<\/p>\n<table class=\"code-line\" dir=\"auto\" data-line=\"870\">\n<thead class=\"code-line\" dir=\"auto\" data-line=\"870\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"870\">\n<th>\u30d1\u30e9\u30e1\u30fc\u30bf\u540d<\/th>\n<th>\u5024<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"code-line \" dir=\"auto\" data-line=\"872\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"872\">\n<td>error<\/td>\n<td>invalid_request<\/td>\n<\/tr>\n<tr class=\"code-line \" dir=\"auto\" data-line=\"873\">\n<td>error_description<\/td>\n<td>invalid response_type<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p class=\"code-line\" dir=\"auto\" data-line=\"875\">\u3067\u306f\u00a0<a href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html\" data-href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html\">FAPI1 Advanced<\/a>\u00a0\u306e\u4e2d\u3067 response_type \u306b\u95a2\u9023\u3059\u308b\u8a18\u8ff0\u304c\u306a\u3044\u304b\u3092\u78ba\u8a8d\u3057\u3066\u307f\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"877\"><a href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html#authorization-server\" data-href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html#authorization-server\">\u8a8d\u53ef\u30b5\u30fc\u30d0\u30fc\u306b\u95a2\u3059\u308b\u8a18\u8ff0<\/a>\u306b\u4e0b\u8a18\u306e\u3088\u3046\u306a\u8a18\u8ff0\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">2. shall require\r\n  1. the response_type value code id_token, or\r\n  2. the response_type value code in conjunction with the response_mode value jwt;<\/pre>\n<p class=\"code-line\" dir=\"auto\" data-line=\"859\">\u307e\u305f\u3001<a href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0-final.html#id-token-as-detached-signature-1\" data-href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0-final.html#id-token-as-detached-signature-1\">ID Token\u306b\u95a2\u3059\u308b\u8a18\u8ff0<\/a>\u306b\u4e0b\u8a18\u306e\u3088\u3046\u306a\u8a18\u8ff0\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">In addition, if the response_type value code id_token is used, the authorization server\r\n\r\n  4. shall return ID Token as a detached signature to the authorization response;<\/pre>\n<p class=\"code-line\" dir=\"auto\" data-line=\"913\">\u3064\u307e\u308aID Token\u3092 detached signature \u3068\u3057\u3066\u7528\u3044\u308b\u305f\u3081\u3001response_type \u306e\u5024\u3068\u3057\u3066 code id_token \u3092\u6307\u5b9a\u3059\u308b\u304b\u3001\u3082\u3057\u304f\u306f response_type \u306b code \u3092\u6307\u5b9a\u3057\u306a\u304c\u3089 response_mode \u306b jwt \u3092\u6307\u5b9a\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002response_mode \u306b jwt \u3092\u6307\u5b9a\u3059\u308b JARM \u3092\u7528\u3044\u305f\u65b9\u6cd5\u3082\u3042\u308a\u307e\u3059\u304c\u3001\u4eca\u56de\u306f\u3067\u304d\u308b\u9650\u308a\u30b7\u30f3\u30d7\u30eb\u306b\u3059\u308b\u305f\u3081\u3001 response_type \u3092 code id_token \u3092\u6307\u5b9a\u3059\u308b\u65b9\u5411\u3067\u9032\u3081\u3066\u307f\u307e\u3057\u3087\u3046\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"918\">\u3067\u306f\u30ea\u30af\u30a8\u30b9\u30c8\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e response_type \u30af\u30ec\u30fc\u30e0\u3092\u5909\u66f4\u3057\u3066\u4f5c\u308a\u76f4\u3057\u3066\u307f\u307e\u3057\u3087\u3046\u3002 \u4e0b\u8a18\u3067\u306f\u5909\u66f4\u90e8\u5206\u3060\u3051\u629c\u7c8b\u3057\u3066\u8a18\u8f09\u3057\u307e\u3059\u304c\u3001\u540c\u3058\u3088\u3046\u306b\u30ea\u30af\u30a8\u30b9\u30c8\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e JWS \u3092\u4f5c\u6210\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">&gt; payload = {\r\n  'iss': 'test-client',\r\n  'aud': 'https:\/\/localhost:8443\/realms\/sample-realm',\r\n  'response_type': 'code id_token',\r\n  'scope': 'openid email',\r\n  'client_id': 'test-client',\r\n  'nonce': 'abcdefghijk',\r\n  'state': 'abcdefghijk',\r\n  'redirect_uri': 'https:\/\/client.example.com\/test',\r\n  'code_challenge': 'x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE',\r\n  'code_challenge_method': 'S256',\r\n  'nbf': Time.now.to_i,\r\n  'exp': (Time.now + 1.hour).to_i\r\n}<\/pre>\n<p class=\"code-line\" dir=\"auto\" data-line=\"870\">\u3053\u306e\u60c5\u5831\u3067\u4f5c\u308a\u51fa\u3057\u305f\u30ea\u30af\u30a8\u30b9\u30c8\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u4f8b\u304c\u4e0b\u8a18\u3067\u3059<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">eyJ0eXAiOiJKV1QiLCJhbGciOiJQUzI1NiIsImtpZCI6InRlc3QifQ.eyJpc3MiOiJ0ZXN0LWNsaWVudCIsImF1ZCI6Imh0dHBzOi8vbG9jYWxob3N0Ojg0NDMvcmVhbG1zL3NhbXBsZS1yZWFsbSIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIGlkX3Rva2VuIiwic2NvcGUiOiJvcGVuaWQgZW1haWwiLCJjbGllbnRfaWQiOiJ0ZXN0LWNsaWVudCIsIm5vbmNlIjoiYWJjZGVmZ2hpamsiLCJzdGF0ZSI6ImFiY2RlZmdoaWprIiwicmVkaXJlY3RfdXJpIjoiaHR0cHM6Ly9jbGllbnQuZXhhbXBsZS5jb20vdGVzdCIsImNvZGVfY2hhbGxlbmdlIjoieDVUelk3RjczcHd1cE4yTW14Vl9wNjVwYVJjN3ZKck43YjFjUkwyQ0lHRSIsImNvZGVfY2hhbGxlbmdlX21ldGhvZCI6IlMyNTYiLCJuYmYiOjE2ODExNjkzOTksImV4cCI6MTY4MTE3Mjk5OX0.UapN3S0QQ6TMJWK23MKC1K9lc5JNFCdmlYfac4Y4DZHWvacQomZ6IytiwUkira25t4vuJreJNwCgpgi0yP319XqoQdalEcudGsM69SSnvIJRd4cdO10axXQwDyiOYzV2wRcoGdB6zUAFMxaqCVdgXXpesJR9xHHIH4o71Q_3Hdm6rjPZAGBW6WAhu8CM-5Rb-9HM9huyu6C0tahTbJo8cBVa5vxhtMAFbVfazw4zlT8fbbJkdXTe2Wy0Mm_kMxmJ5AOW_xpS70DnRVtKeXQaGwfAUzkazHR1ViffQIdXKnt47Wh1yBnTkoCFEnSh81QFEG7qyRvbIKWda0nUxoXokA<\/pre>\n<p class=\"code-line code-active-line\" dir=\"auto\" data-line=\"922\">\u3067\u306f\u8a8d\u53ef\u30ea\u30af\u30a8\u30b9\u30c8\u306e response_type \u66f8\u304d\u63db\u3048\u3066\u518d\u5ea6\u958b\u3044\u3066\u307f\u307e\u3057\u3087\u3046\u3002<\/p>\n<ul class=\"code-line\" dir=\"auto\" data-line=\"923\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"923\"><a href=\"https:\/\/localhost:8443\/realms\/sample-realm\/protocol\/openid-connect\/auth?response_type=code%20id_token&amp;scope=openid%20email&amp;client_id=test-client&amp;code_challenge=x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE&amp;code_challenge_method=S256&amp;request=eyJ0eXAiOiJKV1QiLCJhbGciOiJQUzI1NiIsImtpZCI6InRlc3QifQ.eyJpc3MiOiJ0ZXN0LWNsaWVudCIsImF1ZCI6Imh0dHBzOi8vbG9jYWxob3N0Ojg0NDMvcmVhbG1zL3NhbXBsZS1yZWFsbSIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIGlkX3Rva2VuIiwic2NvcGUiOiJvcGVuaWQgZW1haWwiLCJjbGllbnRfaWQiOiJ0ZXN0LWNsaWVudCIsIm5vbmNlIjoiYWJjZGVmZ2hpamsiLCJzdGF0ZSI6ImFiY2RlZmdoaWprIiwicmVkaXJlY3RfdXJpIjoiaHR0cHM6Ly9jbGllbnQuZXhhbXBsZS5jb20vdGVzdCIsImNvZGVfY2hhbGxlbmdlIjoieDVUelk3RjczcHd1cE4yTW14Vl9wNjVwYVJjN3ZKck43YjFjUkwyQ0lHRSIsImNvZGVfY2hhbGxlbmdlX21ldGhvZCI6IlMyNTYiLCJuYmYiOjE2ODExNjkzOTksImV4cCI6MTY4MTE3Mjk5OX0.UapN3S0QQ6TMJWK23MKC1K9lc5JNFCdmlYfac4Y4DZHWvacQomZ6IytiwUkira25t4vuJreJNwCgpgi0yP319XqoQdalEcudGsM69SSnvIJRd4cdO10axXQwDyiOYzV2wRcoGdB6zUAFMxaqCVdgXXpesJR9xHHIH4o71Q_3Hdm6rjPZAGBW6WAhu8CM-5Rb-9HM9huyu6C0tahTbJo8cBVa5vxhtMAFbVfazw4zlT8fbbJkdXTe2Wy0Mm_kMxmJ5AOW_xpS70DnRVtKeXQaGwfAUzkazHR1ViffQIdXKnt47Wh1yBnTkoCFEnSh81QFEG7qyRvbIKWda0nUxoXokA\" data-href=\"https:\/\/localhost:8443\/realms\/sample-realm\/protocol\/openid-connect\/auth?response_type=code%20id_token&amp;scope=openid%20email&amp;client_id=test-client&amp;code_challenge=x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE&amp;code_challenge_method=S256&amp;request=eyJ0eXAiOiJKV1QiLCJhbGciOiJQUzI1NiIsImtpZCI6InRlc3QifQ.eyJpc3MiOiJ0ZXN0LWNsaWVudCIsImF1ZCI6Imh0dHBzOi8vbG9jYWxob3N0Ojg0NDMvcmVhbG1zL3NhbXBsZS1yZWFsbSIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIGlkX3Rva2VuIiwic2NvcGUiOiJvcGVuaWQgZW1haWwiLCJjbGllbnRfaWQiOiJ0ZXN0LWNsaWVudCIsIm5vbmNlIjoiYWJjZGVmZ2hpamsiLCJzdGF0ZSI6ImFiY2RlZmdoaWprIiwicmVkaXJlY3RfdXJpIjoiaHR0cHM6Ly9jbGllbnQuZXhhbXBsZS5jb20vdGVzdCIsImNvZGVfY2hhbGxlbmdlIjoieDVUelk3RjczcHd1cE4yTW14Vl9wNjVwYVJjN3ZKck43YjFjUkwyQ0lHRSIsImNvZGVfY2hhbGxlbmdlX21ldGhvZCI6IlMyNTYiLCJuYmYiOjE2Nzc3NTMzOTMsImV4cCI6MTY3Nzc1Njk5M30.HELCG8_JmJP38oq2MubfcyHFclpEdqjvr1o-bFva_-cO3iYaWRmoIUokyjHFbk3sfrdP2-8x7Wnc5xdddTVfnpa_DbMKa4XLu_aAORKKN6VIt-F-LP6MI_YDBIYr_vTA0vsJgGAquADHda2FVfk6zV_JChBSeAqba5_WG2sBsjkCqXm6vhCswHpIBnYeCl2hGM48HTmO8KBoPy1SyKufB-5yykCJXJlOgeopRTAoRxaPxvq6bYkjf3kCba00cCu_wKfRvffAr4cFtQQF1Tz_YMQQLhELoTJzZLYBpF6QuRYxeUAJSmzT1EGGvYo_hzW0Vu5ont-J3aAAY6X9MrECqA\">https:\/\/localhost:8443\/realms\/sample-realm\/protocol\/openid-connect\/auth?response_type=code id_token&amp;scope=openid email&amp;client_id=test-client&amp;code_challenge=x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE&amp;code_challenge_method=S256&amp;request=eyJ0eXAiOiJKV1QiLCJhbGciOiJQUzI1NiIsImtpZCI6InRlc3QifQ.eyJpc3MiOiJ0ZXN0LWNsaWVudCIsImF1ZCI6Imh0dHBzOi8vbG9jYWxob3N0Ojg0NDMvcmVhbG1zL3NhbXBsZS1yZWFsbSIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIGlkX3Rva2VuIiwic2NvcGUiOiJvcGVuaWQgZW1haWwiLCJjbGllbnRfaWQiOiJ0ZXN0LWNsaWVudCIsIm5vbmNlIjoiYWJjZGVmZ2hpamsiLCJzdGF0ZSI6ImFiY2RlZmdoaWprIiwicmVkaXJlY3RfdXJpIjoiaHR0cHM6Ly9jbGllbnQuZXhhbXBsZS5jb20vdGVzdCIsImNvZGVfY2hhbGxlbmdlIjoieDVUelk3RjczcHd1cE4yTW14Vl9wNjVwYVJjN3ZKck43YjFjUkwyQ0lHRSIsImNvZGVfY2hhbGxlbmdlX21ldGhvZCI6IlMyNTYiLCJuYmYiOjE2ODExNjkzOTksImV4cCI6MTY4MTE3Mjk5OX0.UapN3S0QQ6TMJWK23MKC1K9lc5JNFCdmlYfac4Y4DZHWvacQomZ6IytiwUkira25t4vuJreJNwCgpgi0yP319XqoQdalEcudGsM69SSnvIJRd4cdO10axXQwDyiOYzV2wRcoGdB6zUAFMxaqCVdgXXpesJR9xHHIH4o71Q_3Hdm6rjPZAGBW6WAhu8CM-5Rb-9HM9huyu6C0tahTbJo8cBVa5vxhtMAFbVfazw4zlT8fbbJkdXTe2Wy0Mm_kMxmJ5AOW_xpS70DnRVtKeXQaGwfAUzkazHR1ViffQIdXKnt47Wh1yBnTkoCFEnSh81QFEG7qyRvbIKWda0nUxoXokA<\/a><\/li>\n<\/ul>\n<p class=\"code-line\" dir=\"auto\" data-line=\"925\">URL\u6b04\u304b\u3089\u30ec\u30b9\u30dd\u30f3\u30b9\u3092\u78ba\u8a8d\u3059\u308b\u3068\u4e0b\u8a18\u306e\u3088\u3046\u306a\u5024\u304c\u78ba\u8a8d\u3067\u304d\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">https:\/\/client.example.com\/test#error=unauthorized_client&amp;error_description=Client+is+not+allowed+to+initiate+browser+login+with+given+response_type.+Implicit+flow+is+disabled+for+the+client.&amp;state=abcdefghijk<\/pre>\n<p class=\"code-line code-active-line\" dir=\"auto\" data-line=\"931\">URL \u306e\u30af\u30a8\u30ea\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u3092\u30c7\u30b3\u30fc\u30c9\u3057\u3066\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u898b\u3066\u307f\u308b\u3068\u3001implicit flow \u304c\u8a31\u53ef\u3055\u308c\u3066\u3044\u306a\u3044\u3068\u3044\u3046\u30a8\u30e9\u30fc\u306e\u3088\u3046\u306b\u898b\u3048\u307e\u3059\u3002<\/p>\n<table class=\"code-line\" dir=\"auto\" data-line=\"933\">\n<thead class=\"code-line\" dir=\"auto\" data-line=\"933\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"933\">\n<th>\u30d1\u30e9\u30e1\u30fc\u30bf\u540d<\/th>\n<th>\u5024<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"code-line\" dir=\"auto\" data-line=\"935\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"935\">\n<td>error<\/td>\n<td>unauthorized_client<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"936\">\n<td>error_description<\/td>\n<td>Client is not allowed to initiate browser login with given response_type. Implicit flow is disabled for the client.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p class=\"code-line\" dir=\"auto\" data-line=\"938\">FAPI\u306b\u6e96\u62e0\u3059\u308b\u305f\u3081 response_type \u3092 code id_token \u3068\u6307\u5b9a\u3057\u305f\u306e\u3067\u3001\u3053\u308c\u306f\u30cf\u30a4\u30d6\u30ea\u30c3\u30c9\u30d5\u30ed\u30fc\u3068\u306a\u308a\u307e\u3059\u3002<a href=\"https:\/\/www.keycloak.org\/docs\/latest\/securing_apps\/#_javascript_implicit_flow\" data-href=\"https:\/\/www.keycloak.org\/docs\/latest\/securing_apps\/#_javascript_implicit_flow\">Keycloak\u306e\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8<\/a>\u3092\u78ba\u8a8d\u3057\u3066\u307f\u308b\u3068\u3001\u30cf\u30a4\u30d6\u30ea\u30c3\u30c9\u30d5\u30ed\u30fc\u3092\u6709\u52b9\u306b\u3059\u308b\u305f\u3081\u306b\u306f\u3001\u4e0b\u8a18\uff12\u3064\u306e\u30d5\u30e9\u30b0\u3092\u6709\u52b9\u306b\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<ul class=\"code-line\" dir=\"auto\" data-line=\"940\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"940\">Standard flow<\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"941\">Implicit flow<\/li>\n<\/ul>\n<p class=\"code-line \" dir=\"auto\" data-line=\"943\">\u3067\u306fKeycloak \u306e\u8a2d\u5b9a\u3092\u5909\u66f4\u3057\u3066\u307f\u307e\u3057\u3087\u3046\u3002Keycloak \u306e\u8a2d\u5b9a\u3067\u3059\u304c\u3001clients \u30bf\u30d6\u304b\u3089 test-client \u306e\u8a2d\u5b9a\u306b\u79fb\u52d5\u3057\u3066\u3001 Settings \u306e\u30bf\u30d6\u306b\u79fb\u52d5\u3057\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"945\">\u305d\u3057\u3066 Implicit Flow Enabled \u306e\u30c1\u30a7\u30c3\u30af\u30dc\u30c3\u30af\u30b9 \u3092\u62bc\u3057\u3066 Save \u304b\u3089\u8a2d\u5b9a\u3092\u4fdd\u5b58\u3057\u307e\u3057\u3087\u3046\u3002 \u3059\u308b\u3068\u4e0b\u8a18\u306e\u30a8\u30e9\u30fc\u304c\u30dd\u30c3\u30d7\u30a2\u30c3\u30d7\u3067\u8868\u793a\u3055\u308c\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">Client could not be updated: Invalid rootUrl<\/pre>\n<p class=\"code-line\" dir=\"auto\" data-line=\"952\">\u3053\u3053\u307e\u3067\u306e\u8a2d\u5b9a\u6642\u306f\u4e00\u65e6\u7121\u52b9\u5316\u3057\u3066\u9032\u3081\u307e\u3057\u305f\u304c\u3001\u4eca\u56de\u306f\u3053\u308c\u3089\u3092\u5168\u3066\u89e3\u6c7a\u3057\u3066\u304b\u3089\u9032\u3081\u3066\u307f\u307e\u3057\u3087\u3046\u3002\u3053\u306e\u30a8\u30e9\u30fc\u306f Root URL \u304c\u5165\u529b\u3055\u308c\u3066\u3044\u306a\u3044\u3053\u3068\u306b\u8d77\u56e0\u3057\u307e\u3059\u3002 \u4eca\u56de\u306f\u691c\u8a3c\u76ee\u7684\u306a\u306e\u3067 Settings \u30bf\u30d6\u306b\u3044\u308b\u306f\u305a\u306a\u306e\u3067\u305d\u306e\u30bf\u30d6\u306e\u307e\u307e\u3067\u3001\u66ab\u5b9a\u3067\u4e0b\u8a18\u306e\u3088\u3046\u306a\u5024\u3092\u5165\u529b\u3057\u3066\u307f\u307e\u3057\u3087\u3046\u3002<\/p>\n<table class=\"code-line\" dir=\"auto\" data-line=\"954\">\n<thead class=\"code-line\" dir=\"auto\" data-line=\"954\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"954\">\n<th>\u30d5\u30a3\u30fc\u30eb\u30c9<\/th>\n<th>\u5024<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"code-line\" dir=\"auto\" data-line=\"956\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"956\">\n<td>Root URL<\/td>\n<td><a href=\"https:\/\/client.example.com\/\" data-href=\"https:\/\/client.example.com\">https:\/\/client.example.com<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p class=\"code-line\" dir=\"auto\" data-line=\"958\">\u5165\u529b\u5f8c\u306b Save \u3092\u62bc\u3059\u3068\u4e0b\u8a18\u306e\u30a8\u30e9\u30fc\u304c\u30dd\u30c3\u30d7\u30a2\u30c3\u30d7\u3067\u8868\u793a\u3055\u308c\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">Client could not be updated: Invalid adminUrl<\/pre>\n<p class=\"code-line\" dir=\"auto\" data-line=\"979\">\u3053\u306e\u30a8\u30e9\u30fc\u306f Admin URL \u304c\u5165\u529b\u3055\u308c\u3066\u3044\u306a\u3044\u3053\u3068\u306b\u8d77\u56e0\u3057\u307e\u3059\u3002 \u66ab\u5b9a\u3067\u4e0b\u8a18\u306e\u3088\u3046\u306a\u5024\u3092\u5165\u529b\u3057\u3066\u307f\u307e\u3057\u3087\u3046\u3002<\/p>\n<table class=\"code-line\" dir=\"auto\" data-line=\"981\">\n<thead class=\"code-line\" dir=\"auto\" data-line=\"981\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"981\">\n<th>\u30d5\u30a3\u30fc\u30eb\u30c9<\/th>\n<th>\u5024<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"code-line\" dir=\"auto\" data-line=\"983\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"983\">\n<td>Admin URL<\/td>\n<td><a title=\"https:\/\/client.example.com\/admin\" href=\"https:\/\/client.example.com\/admin\" data-href=\"https:\/\/client.example.com\/admin\">https:\/\/client.example.com\/admin<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p class=\"code-line\" dir=\"auto\" data-line=\"985\">\u5165\u529b\u5f8c\u306b Save \u3092\u62bc\u3059\u3068\u4e0b\u8a18\u306e\u30a8\u30e9\u30fc\u304c\u30dd\u30c3\u30d7\u30a2\u30c3\u30d7\u3067\u8868\u793a\u3055\u308c\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">Client could not be updated: Invalid baseUrl<\/pre>\n<p class=\"code-line\" dir=\"auto\" data-line=\"991\">\u3053\u306e\u30a8\u30e9\u30fc\u306f Home URL \u304c\u5165\u529b\u3055\u308c\u3066\u3044\u306a\u3044\u3053\u3068\u306b\u8d77\u56e0\u3057\u307e\u3059\u3002 \u66ab\u5b9a\u3067\u4e0b\u8a18\u306e\u3088\u3046\u306a\u5024\u3092\u5165\u529b\u3057\u3066\u307f\u307e\u3057\u3087\u3046\u3002<\/p>\n<table class=\"code-line\" dir=\"auto\" data-line=\"993\">\n<thead class=\"code-line\" dir=\"auto\" data-line=\"993\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"993\">\n<th>\u30d5\u30a3\u30fc\u30eb\u30c9<\/th>\n<th>\u5024<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"code-line\" dir=\"auto\" data-line=\"995\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"995\">\n<td>Home URL<\/td>\n<td><a title=\"https:\/\/client.example.com\" href=\"https:\/\/client.example.com\/\" data-href=\"https:\/\/client.example.com\">https:\/\/client.example.com<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p class=\"code-line\" dir=\"auto\" data-line=\"997\">\u5165\u529b\u5f8c\u306b Save \u3092\u62bc\u3059\u3068\u4e0b\u8a18\u306e\u30a8\u30e9\u30fc\u304c\u30dd\u30c3\u30d7\u30a2\u30c3\u30d7\u3067\u8868\u793a\u3055\u308c\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">Client could not be updated: Invalid logoutUrl<\/pre>\n<p class=\"code-line\" dir=\"auto\" data-line=\"1003\">\u3053\u306e\u30a8\u30e9\u30fc\u306f Backchannel logout URL \u304c\u5165\u529b\u3055\u308c\u3066\u3044\u306a\u3044\u3053\u3068\u306b\u8d77\u56e0\u3057\u307e\u3059\u3002 \u66ab\u5b9a\u3067\u4e0b\u8a18\u306e\u3088\u3046\u306a \u5024\u3092\u5165\u529b\u3057\u3066\u307f\u307e\u3057\u3087\u3046\u3002<\/p>\n<table class=\"code-line\" dir=\"auto\" data-line=\"1005\">\n<thead class=\"code-line\" dir=\"auto\" data-line=\"1005\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"1005\">\n<th>\u30d5\u30a3\u30fc\u30eb\u30c9<\/th>\n<th>\u5024<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"code-line\" dir=\"auto\" data-line=\"1007\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"1007\">\n<td>Backchannel logout URL<\/td>\n<td><a title=\"https:\/\/client.example.com\/logout\" href=\"https:\/\/client.example.com\/logout\" data-href=\"https:\/\/client.example.com\/logout\">https:\/\/client.example.com\/logout<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p class=\"code-line\" dir=\"auto\" data-line=\"1009\">\u5165\u529b\u5f8c\u306b Save \u3092\u62bc\u3059\u3068\u4e0b\u8a18\u306e\u30a8\u30e9\u30fc\u304c\u30dd\u30c3\u30d7\u30a2\u30c3\u30d7\u3067\u8868\u793a\u3055\u308c\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">Client could not be updated: not allowed signature algorithm.<\/pre>\n<p class=\"code-line\" dir=\"auto\" data-line=\"1015\">\u3053\u306e\u30a8\u30e9\u30fc\u306f\u7f72\u540d\u306e\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u3068\u3057\u3066\u8a2d\u5b9a\u3057\u3066\u3044\u308b\u4e00\u90e8\u304c\u3001\u8a31\u53ef\u3055\u308c\u3066\u3044\u306a\u3044\u5024\u3068\u306a\u3063\u3066\u3044\u308b\u3053\u3068\u3067\u3059\u3002 \u305d\u308c\u3067\u306f\u7f72\u540d\u5468\u308a\u306e\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u306e\u8a2d\u5b9a\u3092\u78ba\u8a8d\u3057\u3066\u307f\u307e\u3057\u3087\u3046\u3002Advanced \u30bf\u30d6\u306e\u4e0b\u8a18\u306e\u9805\u76ee\u3092\u5909\u66f4\u3057\u307e\u3059\u3002<\/p>\n<table class=\"code-line\" dir=\"auto\" data-line=\"1018\">\n<thead class=\"code-line\" dir=\"auto\" data-line=\"1018\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"1018\">\n<th>\u30d5\u30a3\u30fc\u30eb\u30c9<\/th>\n<th>\u5024<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"code-line\" dir=\"auto\" data-line=\"1020\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"1020\">\n<td>Access token signature algorithm<\/td>\n<td>PS256<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"1021\">\n<td>ID token signature algorithm<\/td>\n<td>PS256<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"1022\">\n<td>User info signed response algorithm<\/td>\n<td>PS256<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"1023\">\n<td>Request object signature algorithm<\/td>\n<td>PS256<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p class=\"code-line\" dir=\"auto\" data-line=\"1025\">\u5909\u66f4\u5f8c\u306b Save \u3092\u62bc\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u4e0b\u8a18\u306e\u30dd\u30c3\u30d7\u30a2\u30c3\u30d7\u304c\u51fa\u3066\u4fdd\u5b58\u304c\u6210\u529f\u3057\u3066\u3044\u308b\u3068\u308f\u304b\u308a\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">Client successfully updated<\/pre>\n<p class=\"code-line\" dir=\"auto\" data-line=\"1032\">\u3067\u306f\u518d\u5ea6\u8a8d\u53ef\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u9001\u4fe1\u3057\u3066\u307f\u307e\u3059\u3002<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"1034\"><a title=\"https:\/\/localhost:8443\/realms\/sample-realm\/protocol\/openid-connect\/auth?response_type=code%20id_token&amp;scope=openid%20email&amp;client_id=test-client&amp;code_challenge=x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE&amp;code_challenge_method=S256&amp;request=eyJ0eXAiOiJKV1QiLCJhbGciOiJQUzI1NiIsImtpZCI6InRlc3QifQ.eyJpc3MiOiJ0ZXN0LWNsaWVudCIsImF1ZCI6Imh0dHBzOi8vbG9jYWxob3N0Ojg0NDMvcmVhbG1zL3NhbXBsZS1yZWFsbSIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIGlkX3Rva2VuIiwic2NvcGUiOiJvcGVuaWQgZW1haWwiLCJjbGllbnRfaWQiOiJ0ZXN0LWNsaWVudCIsIm5vbmNlIjoiYWJjZGVmZ2hpamsiLCJzdGF0ZSI6ImFiY2RlZmdoaWprIiwicmVkaXJlY3RfdXJpIjoiaHR0cHM6Ly9jbGllbnQuZXhhbXBsZS5jb20vdGVzdCIsImNvZGVfY2hhbGxlbmdlIjoieDVUelk3RjczcHd1cE4yTW14Vl9wNjVwYVJjN3ZKck43YjFjUkwyQ0lHRSIsImNvZGVfY2hhbGxlbmdlX21ldGhvZCI6IlMyNTYiLCJuYmYiOjE2Nzc3NTM4NzUsImV4cCI6MTY3Nzc1NzQ3NX0.bjcK7zrQV-0u24YBVm-PzjwJDP7ApB92To2sGoXggW69f1a9cswUikCbSxXC-I53fCb-Z4rqXdnN7oiMY6HYrE6gg0nOT4MKQnroD36V9JLm9kd11gsoP3qLDDJEVYWL9uIgl75_kclKTiwayEu5E__XR6q1S2_LaQ4ztZG15mQLy2lH6YKDPVSOrHb6k25dcqcvE0BND9zPnQtQ19K0boWmIZ0E9dnhWbJ1DBhmB33w4ci3hmqVSg31mSsn4P6GZC1dFv2P-11y5_eVnojdBj-wiYRnRlQx1oelf3E2Xk8zDkRn9CicCkvDnwkeEqSXB9u0coxIXd12DXqrHj8gtA\" href=\"https:\/\/localhost:8443\/realms\/sample-realm\/protocol\/openid-connect\/auth?response_type=code%20id_token&amp;scope=openid%20email&amp;client_id=test-client&amp;code_challenge=x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE&amp;code_challenge_method=S256&amp;request=eyJ0eXAiOiJKV1QiLCJhbGciOiJQUzI1NiIsImtpZCI6InRlc3QifQ.eyJpc3MiOiJ0ZXN0LWNsaWVudCIsImF1ZCI6Imh0dHBzOi8vbG9jYWxob3N0Ojg0NDMvcmVhbG1zL3NhbXBsZS1yZWFsbSIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIGlkX3Rva2VuIiwic2NvcGUiOiJvcGVuaWQgZW1haWwiLCJjbGllbnRfaWQiOiJ0ZXN0LWNsaWVudCIsIm5vbmNlIjoiYWJjZGVmZ2hpamsiLCJzdGF0ZSI6ImFiY2RlZmdoaWprIiwicmVkaXJlY3RfdXJpIjoiaHR0cHM6Ly9jbGllbnQuZXhhbXBsZS5jb20vdGVzdCIsImNvZGVfY2hhbGxlbmdlIjoieDVUelk3RjczcHd1cE4yTW14Vl9wNjVwYVJjN3ZKck43YjFjUkwyQ0lHRSIsImNvZGVfY2hhbGxlbmdlX21ldGhvZCI6IlMyNTYiLCJuYmYiOjE2ODExNzAyOTcsImV4cCI6MTY4MTE3Mzg5N30.gPd79ZtTVVLTCyew2_yClXGmu-AG1rtF-tz_A2UqeIJgJFFG09aDOVPkFWKyfufnC4YJ5UK_rVxsTTXRpqFysddutvSHRGVYXywtYKbVLQPH6SoakppY5YlbDz_1Gr0IyIFta3qpnIpew691G2idBI7PnL9vRZPWms5cG2Uw0kJX5VvOuDDayCgegxHrUiA4cQE1tpPj7vw2RauTOOJzDVQbENiDQt_CJrvsKvzU8S3lcDrWqMquxKzjcM7HNDb0PPprFRM3OLWRq4Hjhxlqn5rU_EzUwE7HohOsll3fLLD5b0yvg9Z_jphVUyyMoFXFmTklKolwfWfqmjhEbfqyUQ\" data-href=\"https:\/\/localhost:8443\/realms\/sample-realm\/protocol\/openid-connect\/auth?response_type=code%20id_token&amp;scope=openid%20email&amp;client_id=test-client&amp;code_challenge=x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE&amp;code_challenge_method=S256&amp;request=eyJ0eXAiOiJKV1QiLCJhbGciOiJQUzI1NiIsImtpZCI6InRlc3QifQ.eyJpc3MiOiJ0ZXN0LWNsaWVudCIsImF1ZCI6Imh0dHBzOi8vbG9jYWxob3N0Ojg0NDMvcmVhbG1zL3NhbXBsZS1yZWFsbSIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIGlkX3Rva2VuIiwic2NvcGUiOiJvcGVuaWQgZW1haWwiLCJjbGllbnRfaWQiOiJ0ZXN0LWNsaWVudCIsIm5vbmNlIjoiYWJjZGVmZ2hpamsiLCJzdGF0ZSI6ImFiY2RlZmdoaWprIiwicmVkaXJlY3RfdXJpIjoiaHR0cHM6Ly9jbGllbnQuZXhhbXBsZS5jb20vdGVzdCIsImNvZGVfY2hhbGxlbmdlIjoieDVUelk3RjczcHd1cE4yTW14Vl9wNjVwYVJjN3ZKck43YjFjUkwyQ0lHRSIsImNvZGVfY2hhbGxlbmdlX21ldGhvZCI6IlMyNTYiLCJuYmYiOjE2Nzc3NTM4NzUsImV4cCI6MTY3Nzc1NzQ3NX0.bjcK7zrQV-0u24YBVm-PzjwJDP7ApB92To2sGoXggW69f1a9cswUikCbSxXC-I53fCb-Z4rqXdnN7oiMY6HYrE6gg0nOT4MKQnroD36V9JLm9kd11gsoP3qLDDJEVYWL9uIgl75_kclKTiwayEu5E__XR6q1S2_LaQ4ztZG15mQLy2lH6YKDPVSOrHb6k25dcqcvE0BND9zPnQtQ19K0boWmIZ0E9dnhWbJ1DBhmB33w4ci3hmqVSg31mSsn4P6GZC1dFv2P-11y5_eVnojdBj-wiYRnRlQx1oelf3E2Xk8zDkRn9CicCkvDnwkeEqSXB9u0coxIXd12DXqrHj8gtA\">https:\/\/localhost:8443\/realms\/sample-realm\/protocol\/openid-connect\/auth?response_type=code id_token&amp;scope=openid email&amp;client_id=test-client&amp;code_challenge=x5TzY7F73pwupN2MmxV_p65paRc7vJrN7b1cRL2CIGE&amp;code_challenge_method=S256&amp;request=eyJ0eXAiOiJKV1QiLCJhbGciOiJQUzI1NiIsImtpZCI6InRlc3QifQ.eyJpc3MiOiJ0ZXN0LWNsaWVudCIsImF1ZCI6Imh0dHBzOi8vbG9jYWxob3N0Ojg0NDMvcmVhbG1zL3NhbXBsZS1yZWFsbSIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIGlkX3Rva2VuIiwic2NvcGUiOiJvcGVuaWQgZW1haWwiLCJjbGllbnRfaWQiOiJ0ZXN0LWNsaWVudCIsIm5vbmNlIjoiYWJjZGVmZ2hpamsiLCJzdGF0ZSI6ImFiY2RlZmdoaWprIiwicmVkaXJlY3RfdXJpIjoiaHR0cHM6Ly9jbGllbnQuZXhhbXBsZS5jb20vdGVzdCIsImNvZGVfY2hhbGxlbmdlIjoieDVUelk3RjczcHd1cE4yTW14Vl9wNjVwYVJjN3ZKck43YjFjUkwyQ0lHRSIsImNvZGVfY2hhbGxlbmdlX21ldGhvZCI6IlMyNTYiLCJuYmYiOjE2ODExNzAyOTcsImV4cCI6MTY4MTE3Mzg5N30.gPd79ZtTVVLTCyew2_yClXGmu-AG1rtF-tz_A2UqeIJgJFFG09aDOVPkFWKyfufnC4YJ5UK_rVxsTTXRpqFysddutvSHRGVYXywtYKbVLQPH6SoakppY5YlbDz_1Gr0IyIFta3qpnIpew691G2idBI7PnL9vRZPWms5cG2Uw0kJX5VvOuDDayCgegxHrUiA4cQE1tpPj7vw2RauTOOJzDVQbENiDQt_CJrvsKvzU8S3lcDrWqMquxKzjcM7HNDb0PPprFRM3OLWRq4Hjhxlqn5rU_EzUwE7HohOsll3fLLD5b0yvg9Z_jphVUyyMoFXFmTklKolwfWfqmjhEbfqyUQ<\/a><\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"1036\">\u4e0b\u8a18\u306e\u3088\u3046\u306a\u30ed\u30b0\u30a4\u30f3\u753b\u9762\u304c\u78ba\u8a8d\u3067\u304d\u307e\u3059\u3002\u6700\u521d\u306b\u4f5c\u6210\u3057\u305f cl-taro \u3055\u3093\u3067\u30ed\u30b0\u30a4\u30f3\u3057\u3066\u307f\u307e\u3057\u3087\u3046\u3002<\/p>\n<p dir=\"auto\" data-line=\"1036\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-59516\" src=\"\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/login-page.png\" alt=\"\" width=\"986\" height=\"567\" srcset=\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/login-page.png 986w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/login-page-360x207.png 360w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/login-page-768x442.png 768w\" sizes=\"auto, (max-width: 986px) 100vw, 986px\" \/><\/p>\n<table class=\"code-line\" dir=\"auto\" data-line=\"1039\">\n<thead class=\"code-line\" dir=\"auto\" data-line=\"1039\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"1039\">\n<th>\u30d5\u30a3\u30fc\u30eb\u30c9<\/th>\n<th>\u5024<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"code-line\" dir=\"auto\" data-line=\"1041\">\n<tr class=\"code-line\" dir=\"auto\" data-line=\"1041\">\n<td>Username<\/td>\n<td>cl-taro<\/td>\n<\/tr>\n<tr class=\"code-line\" dir=\"auto\" data-line=\"1042\">\n<td>Password<\/td>\n<td>password<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p class=\"code-line\" dir=\"auto\" data-line=\"1045\">\u307e\u305f\u3001\u4e0b\u8a18\u306e\u3088\u3046\u306a\u8a8d\u53ef\u753b\u9762\u304c\u3067\u305f\u3089\u3001Yes\u3067\u8a31\u53ef\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<p dir=\"auto\" data-line=\"1045\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-59517\" src=\"\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/user-authz.png\" alt=\"\" width=\"995\" height=\"569\" srcset=\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/user-authz.png 995w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/user-authz-360x206.png 360w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/user-authz-768x439.png 768w\" sizes=\"auto, (max-width: 995px) 100vw, 995px\" \/><\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"987\">\u30ed\u30b0\u30a4\u30f3\u3059\u308b\u3068\u3001\u30ec\u30b9\u30dd\u30f3\u30b9\u3068\u3057\u3066\u306f\u4e0b\u8a18\u306e\u3088\u3046\u306a\u5024\u304c\u8fd4\u3063\u3066\u304f\u308b\u3053\u3068\u3092\u78ba\u8a8d\u3067\u304d\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">https:\/\/client.example.com\/test#state=abcdefghijk&amp;session_state=3d5d6617-1b29-4ba2-90e2-f15cd09e5419&amp;code=2cd4f024-3c77-41db-8274-57f535b59254.3d5d6617-1b29-4ba2-90e2-f15cd09e5419.acbfc69e-c9ca-416e-8c60-2d66ce39e389&amp;id_token=eyJhbGciOiJQUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJxYlFualA1YVpnMmZGUVlWZnBHcGw5YlI1Zi1wdDNRTS13TmotdmllWjhJIn0.eyJleHAiOjE2ODExNzEwMDksImlhdCI6MTY4MTE3MDcwOSwiYXV0aF90aW1lIjoxNjgxMTcwNDA5LCJqdGkiOiI2NzIzYjkzNi1kMGFkLTQxMjktOTJhYy05ZDg5YTliYTA0ZDUiLCJpc3MiOiJodHRwczovL2xvY2FsaG9zdDo4NDQzL3JlYWxtcy9zYW1wbGUtcmVhbG0iLCJhdWQiOiJ0ZXN0LWNsaWVudCIsInN1YiI6IjExZWI5NDAzLWYyNjQtNDBkOC1hZjJmLWE2NDUwOWY1ODU2MSIsInR5cCI6IklEIiwiYXpwIjoidGVzdC1jbGllbnQiLCJub25jZSI6ImFiY2RlZmdoaWprIiwic2Vzc2lvbl9zdGF0ZSI6IjNkNWQ2NjE3LTFiMjktNGJhMi05MGUyLWYxNWNkMDllNTQxOSIsImNfaGFzaCI6Ik5Mc29WbENPRmp4V0ZINGlBenRtcEEiLCJzX2hhc2giOiJ5aThnYWVvTWJrWllJaTRHLU4xamxnIiwic2lkIjoiM2Q1ZDY2MTctMWIyOS00YmEyLTkwZTItZjE1Y2QwOWU1NDE5In0.TDPkLYssza3hBrqQ6k7D6l9-kPpfDL33CQecPHQ5XGDOGpZB_MKBUY4m5fyCLoyd1KnU0ZKpE45jbbZqp5GtP78CeB31ylWw984vTXLIOJ_oLmdiMxL7rXjFraAzVC16EwsWWbaP6_fbpKDs6QZL_kuCd8baQfvjPW8zcPx9d3xW7Te0RTqjd3I01tk9PAmZGaEGi5ONvX1yqT59DycXBVxOvjYG08-Qyemi5_M_sblX2VUC0ywG7Nw9Z8y3urRAhL8-0MSjXK1wKee9DDc_KWNjZA_0_louFyTxaR4aqeUR5MYJJRvgBGsbLsu3ZSVnE_9pipZ927QqU_hs3BCzhA<\/pre>\n<h3 id=\"66-detached-signature\" class=\"code-line \" dir=\"auto\" data-line=\"1147\">6.6 Detached Signature<a id=\"index6.6\"><\/a><\/h3>\n<p class=\"code-line\" dir=\"auto\" data-line=\"1148\">\u8a8d\u53ef\u30ea\u30af\u30a8\u30b9\u30c8\u306e\u30ec\u30b9\u30dd\u30f3\u30b9\u304b\u3089ID Token\u3092\u53d6\u308a\u51fa\u3057\u3066\u3001<a title=\"https:\/\/jwt.io\/\" href=\"https:\/\/jwt.io\/\" data-href=\"https:\/\/jwt.io\/\">jwt.io<\/a>\u00a0\u7b49\u3067JWT\u306e\u4e2d\u8eab\u3092\u898b\u3066\u307f\u307e\u3057\u3087\u3046\u3002\u3059\u308b\u3068\u4e0b\u8a18\u306ePayload\u3092\u78ba\u8a8d\u3067\u304d\u307e\u3059\u3002\u3059\u308b\u3068\u3001c_hash \u53ca\u3073 s_hash \u3068\u3044\u3046\u5024\u304c\u78ba\u8a8d\u3067\u304d\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">{\r\n  \"exp\": 1681171009,\r\n  \"iat\": 1681170709,\r\n  \"auth_time\": 1681170409,\r\n  \"jti\": \"6723b936-d0ad-4129-92ac-9d89a9ba04d5\",\r\n  \"iss\": \"https:\/\/localhost:8443\/realms\/sample-realm\",\r\n  \"aud\": \"test-client\",\r\n  \"sub\": \"11eb9403-f264-40d8-af2f-a64509f58561\",\r\n  \"typ\": \"ID\",\r\n  \"azp\": \"test-client\",\r\n  \"nonce\": \"abcdefghijk\",\r\n  \"session_state\": \"3d5d6617-1b29-4ba2-90e2-f15cd09e5419\",\r\n  \"c_hash\": \"NLsoVlCOFjxWFH4iAztmpA\",\r\n  \"s_hash\": \"yi8gaeoMbkZYIi4G-N1jlg\",\r\n  \"sid\": \"3d5d6617-1b29-4ba2-90e2-f15cd09e5419\"\r\n}<\/pre>\n<p>&nbsp;<\/p>\n<p class=\"code-line code-active-line\" dir=\"auto\" data-line=\"1169\">\u3053\u308c\u306f\u4eca\u56de\u306e\u691c\u8a3c\u3067\u306fJARM\u3092\u7528\u3044\u305a\u306b\u3001response_type\u306bid_token\u3092\u542b\u3081\u3066\u304a\u308a\u3001ID Token\u3092Detached Signature\u3068\u3057\u3066\u7528\u3044\u3066\u3044\u308b\u304b\u3089\u3067\u3059\u3002<\/p>\n<p class=\"code-line \" dir=\"auto\" data-line=\"1171\">ID token \u81ea\u4f53\u306f\u8a8d\u53ef\u30b5\u30fc\u30d0\u30fc\u306b\u3088\u3063\u3066\u7f72\u540d\u3055\u308c\u307e\u3059\u304c\u3001ID Token\u4ee5\u5916\u306e\u305d\u306e\u4ed6\u306e\u30c7\u30fc\u30bf(code, state\u306a\u3069)\u306b\u3064\u3044\u3066\u306f\u306a\u3093\u3089\u304b\u306e\u5bfe\u7b56\u3092\u3057\u3066\u3044\u306a\u3044\u9650\u308a\u306f\u6539\u3056\u3093\u3092\u691c\u77e5\u3067\u304d\u307e\u305b\u3093\u3002\u305d\u3053\u3067\u305d\u308c\u305e\u308c\u306e\u30cf\u30c3\u30b7\u30e5\u5024\u3092ID token\u306b\u542b\u3081\u308b\u3053\u3068\u3067\u6539\u3056\u3093\u3092\u691c\u77e5\u3067\u304d\u308b\u3068\u3044\u3046\u4ed5\u7d44\u307f\u3067\u3059\u3002<\/p>\n<p dir=\"auto\" data-line=\"1171\">\u3067\u306f\u00a0<a href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html\" data-href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html\">FAPI1 Advanced<\/a>\u00a0\u306bDetached Signature\u306b\u95a2\u3059\u308b\u8a18\u8ff0\u304c\u306a\u3044\u304b\u78ba\u8a8d\u3059\u308b\u3068\u3001\u4e0b\u8a18\u306e\u3088\u3046\u306a\u8a18\u8ff0\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">5.1.1.  ID Token as Detached Signature\r\nWhile the name ID Token (as used in the OpenID Connect Hybrid Flow) suggests that it is something that provides the identity of the resource owner (subject), it is not necessarily so. While it does identify the authorization server by including the issuer identifier, it is perfectly fine to have an ephemeral subject identifier. In this case, the ID Token acts as a detached signature of the issuer to the authorization response and it was an explicit design decision of OpenID Connect Core to make the ID Token act as a detached signature.\r\n\r\nThis document leverages this fact and protects the authorization response by including the hash of all of the unprotected response parameters, e.g. code and state, in the ID Token.<\/pre>\n<p>\u307e\u305f\u3001<a href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html\" data-href=\"https:\/\/openid.net\/specs\/openid-financial-api-part-2-1_0.html\">FAPI1 Advanced<\/a>\u00a0\u306e\u8cc7\u6599\u3067\u306f\u4e0b\u8a18\u306e\u3088\u3046\u306bs_hash\u306e\u5b9a\u7fa9\u3082\u884c\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">While the hash of the code is defined in OIDC, the hash of the state is not defined. Thus this document defines it as follows.\r\n\r\ns_hash\r\n\r\nState hash value. Its value is the base64url encoding of the left-most half of the hash of the octets of the ASCII representation of the state value, where the hash algorithm used is the hash algorithm used in the alg header parameter of the ID Token's JOSE header. For instance, if the alg is HS512, hash the state value with SHA-512, then take the left-most 256 bits and base64url encode them. The s_hash value is a case sensitive string.<\/pre>\n<p>\u307e\u305f\u3001\u7c21\u6613\u306e\u30a4\u30e1\u30fc\u30b8\u56f3\u3092\u51fa\u3059\u3068\u4e0b\u8a18\u306e\u3088\u3046\u306a\u30a4\u30e1\u30fc\u30b8\u3067\u3059<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-59986\" src=\"\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/04\/detached-signature.png\" alt=\"\" width=\"800\" height=\"281\" srcset=\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/04\/detached-signature.png 800w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/04\/detached-signature-360x126.png 360w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/04\/detached-signature-768x270.png 768w\" sizes=\"auto, (max-width: 800px) 100vw, 800px\" \/><\/p>\n<h3 id=\"67-%E3%83%88%E3%83%BC%E3%82%AF%E3%83%B3%E3%83%AA%E3%82%AF%E3%82%A8%E3%82%B9%E3%83%88\" class=\"code-line\" dir=\"auto\" data-line=\"1172\">6.7 \u30c8\u30fc\u30af\u30f3\u30ea\u30af\u30a8\u30b9\u30c8<a id=\"index6.7\"><\/a><\/h3>\n<p class=\"code-line\" dir=\"auto\" data-line=\"990\">\u3067\u306f\u8fd4\u3063\u3066\u304d\u305f\u60c5\u5831\u306e code \u306e\u5024\u3092\u4f7f\u3044\u3001\u30c8\u30fc\u30af\u30f3\u306e\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u884c\u3063\u3066\u307f\u307e\u3057\u3087\u3046<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">curl -i -X POST \\\r\n   -H \"Content-Type:application\/x-www-form-urlencoded\" \\\r\n   -d \"client_id=test-client\" \\\r\n   -d \"grant_type=authorization_code\" \\\r\n   -d \"code=2cd4f024-3c77-41db-8274-57f535b59254.3d5d6617-1b29-4ba2-90e2-f15cd09e5419.acbfc69e-c9ca-416e-8c60-2d66ce39e389\" \\\r\n   -d \"code_verifier=09CgSwrVcqat4ZE6JXzWkIW9Ox61aX8rDY_oWcBWgkA\" \\\r\n   -d \"redirect_uri=https:\/\/client.example.com\/test\" \\\r\n   --cacert .\/certs\/ca.crt  \\\r\n   --key .\/certs\/client.key  \\\r\n   --cert .\/certs\/client.crt \\\r\n 'https:\/\/localhost:8443\/realms\/sample-realm\/protocol\/openid-connect\/token'<\/pre>\n<p class=\"code-line\" dir=\"auto\" data-line=\"990\">\u4e0b\u8a18\u306e\u3088\u3046\u306b\u30a2\u30af\u30bb\u30b9\u30c8\u30fc\u30af\u30f3\u304c\u53d6\u5f97\u3067\u304d\u305f\u3089\u51e6\u7406\u3068\u3057\u3066\u306f\u6210\u529f\u3057\u3066\u3044\u307e\u3059<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">{\"access_token\":\"eyJhbGciOiJQUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJxYlFualA1YVpnMmZGUVlWZnBHcGw5YlI1Zi1wdDNRTS13TmotdmllWjhJIn0.eyJleHAiOjE2ODExNzExODksImlhdCI6MTY4MTE3MDg4OSwiYXV0aF90aW1lIjoxNjgxMTcwNDA5LCJqdGkiOiIxNGY5ODFlYS0wYjQ0LTRkNTgtOTg5ZC0yMWEzOWNhYmVhZTAiLCJpc3MiOiJodHRwczovL2xvY2FsaG9zdDo4NDQzL3JlYWxtcy9zYW1wbGUtcmVhbG0iLCJzdWIiOiIxMWViOTQwMy1mMjY0LTQwZDgtYWYyZi1hNjQ1MDlmNTg1NjEiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJ0ZXN0LWNsaWVudCIsIm5vbmNlIjoiYWJjZGVmZ2hpamsiLCJzZXNzaW9uX3N0YXRlIjoiM2Q1ZDY2MTctMWIyOS00YmEyLTkwZTItZjE1Y2QwOWU1NDE5IiwiYWNyIjoiMCIsImFsbG93ZWQtb3JpZ2lucyI6WyJodHRwczovL2NsaWVudC5leGFtcGxlLmNvbSJdLCJjbmYiOnsieDV0I1MyNTYiOiJBVzNBYWtWeTQ4Nk44aE12X0VSSFRUQ1BEWUM2WnZ3LVJjS3pVa2RBaWpRIn0sInNjb3BlIjoib3BlbmlkIHByb2ZpbGUgZW1haWwiLCJzaWQiOiIzZDVkNjYxNy0xYjI5LTRiYTItOTBlMi1mMTVjZDA5ZTU0MTkiLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsInByZWZlcnJlZF91c2VybmFtZSI6ImNsLXRhcm8iLCJnaXZlbl9uYW1lIjoiIiwiZmFtaWx5X25hbWUiOiIifQ.jWa79RfJcbrjIseduwwelHBpzzTofb8UW32vJ6Ee40G8mmhjo7PaztBCRLPVxUT_3pSQTd3WqKymroCTVT68HzEG21ki7E4cLsT5oUt-tCsnCj7y_FG0YJrHkQ9SYMwzijoyssYvBN1q_y0jsrTshZ9K5ZMrOud59aXLj6VJolBzLE_aimdeqXQyDP_Ts3HuzMQ3hUJtnoQ0bWcOOrrtZXZsjCo01ThsIMPnF8SkZZ1AIKQsPRfvY51oIPmiYQTIRyjIX69k6Xsz9wnIvUqfKc0opbN0KiZQ9GQGWi1G454oJQlB4uCU4DQ9mR64c8_uwOrvqpgk5HwLr4Krcr_OTw\",\"expires_in\":300,\"refresh_expires_in\":1800,\"refresh_token\":\"eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICIyYmZmMGZmMC0wM2U5LTRlODgtYTYwZC1lM2IxODAzNzcxNWEifQ.eyJleHAiOjE2ODExNzI2ODksImlhdCI6MTY4MTE3MDg4OSwianRpIjoiZGU1NzcxNTEtZGE4Zi00OTA1LWI4ZjktMTc1NjQ3Mzg0YzNiIiwiaXNzIjoiaHR0cHM6Ly9sb2NhbGhvc3Q6ODQ0My9yZWFsbXMvc2FtcGxlLXJlYWxtIiwiYXVkIjoiaHR0cHM6Ly9sb2NhbGhvc3Q6ODQ0My9yZWFsbXMvc2FtcGxlLXJlYWxtIiwic3ViIjoiMTFlYjk0MDMtZjI2NC00MGQ4LWFmMmYtYTY0NTA5ZjU4NTYxIiwidHlwIjoiUmVmcmVzaCIsImF6cCI6InRlc3QtY2xpZW50Iiwibm9uY2UiOiJhYmNkZWZnaGlqayIsInNlc3Npb25fc3RhdGUiOiIzZDVkNjYxNy0xYjI5LTRiYTItOTBlMi1mMTVjZDA5ZTU0MTkiLCJjbmYiOnsieDV0I1MyNTYiOiJBVzNBYWtWeTQ4Nk44aE12X0VSSFRUQ1BEWUM2WnZ3LVJjS3pVa2RBaWpRIn0sInNjb3BlIjoib3BlbmlkIHByb2ZpbGUgZW1haWwiLCJzaWQiOiIzZDVkNjYxNy0xYjI5LTRiYTItOTBlMi1mMTVjZDA5ZTU0MTkifQ.YsmsL4k91BRZcWowWixrpuFpzHFQ36h0Dt3svPTph7o\",\"token_type\":\"Bearer\",\"id_token\":\"eyJhbGciOiJQUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJxYlFualA1YVpnMmZGUVlWZnBHcGw5YlI1Zi1wdDNRTS13TmotdmllWjhJIn0.eyJleHAiOjE2ODExNzExODksImlhdCI6MTY4MTE3MDg4OSwiYXV0aF90aW1lIjoxNjgxMTcwNDA5LCJqdGkiOiJiNmQ5YzNjMS05MjViLTRkNTYtODdhMS1hZDVmMjUyMWNkMzciLCJpc3MiOiJodHRwczovL2xvY2FsaG9zdDo4NDQzL3JlYWxtcy9zYW1wbGUtcmVhbG0iLCJhdWQiOiJ0ZXN0LWNsaWVudCIsInN1YiI6IjExZWI5NDAzLWYyNjQtNDBkOC1hZjJmLWE2NDUwOWY1ODU2MSIsInR5cCI6IklEIiwiYXpwIjoidGVzdC1jbGllbnQiLCJub25jZSI6ImFiY2RlZmdoaWprIiwic2Vzc2lvbl9zdGF0ZSI6IjNkNWQ2NjE3LTFiMjktNGJhMi05MGUyLWYxNWNkMDllNTQxOSIsImF0X2hhc2giOiJ6WW5aR2txMENxdEN5cTh0WHByTjlRIiwiYWNyIjoiMCIsInNpZCI6IjNkNWQ2NjE3LTFiMjktNGJhMi05MGUyLWYxNWNkMDllNTQxOSIsImVtYWlsX3ZlcmlmaWVkIjpmYWxzZSwicHJlZmVycmVkX3VzZXJuYW1lIjoiY2wtdGFybyIsImdpdmVuX25hbWUiOiIiLCJmYW1pbHlfbmFtZSI6IiJ9.H4j68Rw_hZax815nrtp36SFKlwBEV8T-8DgCUrOMRMRBPG3eHopxV0OSRMzPTw474CDhYsgc_epe7eFMYBqxFBbj4neQe6a2W_3l6oLPSJsdI3YYwW1EVpVJimoMHeWfz82VPV6a5CMpbVwMOduvgCkWvTeOHIjhlVilQtPV2SQKO4KAzHHFPpjxg9VTPeu6wxffWX37D1rEYivQGaYzUUUp9RW4B7Z8cupUVbNLrqe5hddS1WgUgiY8x822MYG8iuhPWZpkSwM6YXDT5wbmc0fSGTx6M6V2Ho99tSFePn5cjhNMx9MbzkXjPhqLWAU-mvRlXFoPkWVIqFCLMUY3gw\",\"not-before-policy\":0,\"session_state\":\"3d5d6617-1b29-4ba2-90e2-f15cd09e5419\",\"scope\":\"openid profile email\"}<\/pre>\n<p>&nbsp;<\/p>\n<h2 id=\"7-%E5%BE%8C%E6%9B%B8%E3%81%8D\" class=\"code-line\" dir=\"auto\" data-line=\"1075\">7. \u5f8c\u66f8\u304d<a id=\"index7\"><\/a><\/h2>\n<div>\n<div>\u3053\u306e\u8a18\u4e8b\u3068\u524d\u56de\u306e\u8a18\u4e8b\u3067 Keycloak \u306e\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc\u3068\u3001FAPI \u3092\u7c21\u5358\u306b\u3075\u308c\u3066\u3044\u304f\u904e\u7a0b\u3067<\/div>\n<div>\n<ul class=\"code-line\" dir=\"auto\" data-line=\"1199\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"1199\">PKCE \u3092\u7528\u3044\u3066\u8a8d\u53ef\u30b3\u30fc\u30c9\u306e\u6a2a\u53d6\u308a\u5bfe\u7b56<\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"1200\">mTLS \u3092\u7528\u3044\u3066\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u8a8d\u8a3c\u3001\u53ca\u3073\u30c8\u30fc\u30af\u30f3\u306e\u6a2a\u53d6\u308a\u5bfe\u7b56<\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"1201\">\u30ea\u30af\u30a8\u30b9\u30c8\u30aa\u30d6\u30b8\u30a7\u30af\u30c8 \u3092\u7528\u3044\u3066\u8a8d\u53ef\u30ea\u30af\u30a8\u30b9\u30c8\u306e\u6539\u3056\u3093\u5bfe\u7b56<\/li>\n<li class=\"code-line code-active-line\" dir=\"auto\" data-line=\"1202\">ID Token \u3092 Detached Signature \u3068\u3057\u3066\u7528\u3044\u308b\u3053\u3068\u3067\u8a8d\u53ef\u30b3\u30fc\u30c9\u306a\u3069\u306e\u6539\u3056\u3093\u5bfe\u7b56<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<div><\/div>\n<div><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-59902\" src=\"\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/fapi-image.png\" alt=\"\" width=\"850\" height=\"376\" srcset=\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/fapi-image.png 850w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/fapi-image-360x159.png 360w, https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/03\/fapi-image-768x340.png 768w\" sizes=\"auto, (max-width: 850px) 100vw, 850px\" \/><\/div>\n<div>\n<div>\u306a\u3069\u3092\u7c21\u5358\u306b\u898b\u305f\u308a\u30fb\u8a66\u3057\u3066\u307f\u305f\u308a\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u8a18\u4e8b\u3092\u8aad\u3080\u3053\u3068\u3067\u3001Keycloak \u306e\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc\u3084\u305d\u308c\u306b\u3088\u3063\u3066 FAPI \u306b\u6e96\u62e0\u3057\u3066\u3044\u304f\u904e\u7a0b\u306e\u30a4\u30e1\u30fc\u30b8\u3084\u30ea\u30af\u30a8\u30b9\u30c8\u306e\u3084\u308a\u3068\u308a\u3092\u63b4\u3080\u3053\u3068\u306b\u5bfe\u3057\u3066\u5c11\u3057\u3067\u3082\u53c2\u8003\u306b\u306a\u308c\u3070\u5e78\u3044\u3067\u3059\u3002<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>1. \u76ee\u6b21 \u76ee\u6b21 \u6982\u8981 2.1 \u672c\u8a18\u4e8b\u5185\u3067\u306e\u7565\u79f0\u306b\u3064\u3044\u3066 2.2 \u4eca\u56de\u306e\u8a18\u4e8b\u3067\u8aac\u660e\u3059\u308b\u7b87\u6240 2.3 \u4eca\u56de\u306e\u8a18\u4e8b\u3067\u8aac\u660e\u3057\u306a\u3044\u7b87\u6240 \u74b0\u5883\u306e\u8aac\u660e 3.1 \u30ec\u30eb\u30e0\u306e\u8a2d\u5b9a 3.2 \u30e6\u30fc\u30b6\u30fc\u306e\u8a2d\u5b9a 3.3 \u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306e [&#8230;]<\/p>\n","protected":false},"author":1,"featured_media":60140,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"content-type":"","footnotes":""},"categories":[520],"tags":[],"class_list":["post-59520","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-keycloak"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.2 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Keycloak (21.0.2) \u3067 \u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc + FAPI1 advanced \u3092\u8a66\u3059 #keycloak #oauth #oidc - Tech Blog\uff5c\u30af\u30ea\u30a8\u30fc\u30b7\u30e7\u30f3\u30e9\u30a4\u30f3<\/title>\n<meta name=\"description\" content=\"keycloak |1. \u76ee\u6b21 \u76ee\u6b21 \u6982\u8981 2.1 \u672c\u8a18\u4e8b\u5185\u3067\u306e\u7565\u79f0\u306b\u3064\u3044\u3066 2.2 \u4eca\u56de\u306e\u8a18\u4e8b\u3067\u8aac\u660e\u3059\u308b\u7b87\u6240 2.3 \u4eca\u56de\u306e\u8a18\u4e8b\u3067\u8aac\u660e\u3057\u306a\u3044\u7b87\u6240 \u74b0\u5883\u306e\u8aac\u660e 3.1\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520\" \/>\n<meta property=\"og:locale\" content=\"ja_JP\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Keycloak (21.0.2) \u3067 \u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc + FAPI1 advanced \u3092\u8a66\u3059 #keycloak #oauth #oidc - Tech Blog\uff5c\u30af\u30ea\u30a8\u30fc\u30b7\u30e7\u30f3\u30e9\u30a4\u30f3\" \/>\n<meta property=\"og:description\" content=\"keycloak |1. \u76ee\u6b21 \u76ee\u6b21 \u6982\u8981 2.1 \u672c\u8a18\u4e8b\u5185\u3067\u306e\u7565\u79f0\u306b\u3064\u3044\u3066 2.2 \u4eca\u56de\u306e\u8a18\u4e8b\u3067\u8aac\u660e\u3059\u308b\u7b87\u6240 2.3 \u4eca\u56de\u306e\u8a18\u4e8b\u3067\u8aac\u660e\u3057\u306a\u3044\u7b87\u6240 \u74b0\u5883\u306e\u8aac\u660e 3.1\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520\" \/>\n<meta property=\"og:site_name\" content=\"Tech Blog\uff5c\u30af\u30ea\u30a8\u30fc\u30b7\u30e7\u30f3\u30e9\u30a4\u30f3\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/creationline\" \/>\n<meta property=\"article:published_time\" content=\"2023-04-14T03:00:41+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-04-18T05:24:42+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/04\/keycloak.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@creationline\" \/>\n<meta name=\"twitter:site\" content=\"@creationline\" \/>\n<meta name=\"twitter:label1\" content=\"\u57f7\u7b46\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u63a8\u5b9a\u8aad\u307f\u53d6\u308a\u6642\u9593\" \/>\n\t<meta name=\"twitter:data2\" content=\"25\u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/www.creationline.com\/tech-blog\/#\/schema\/person\/7d923d1c017568a1a5e66d7bb1c8764a\"},\"headline\":\"Keycloak (21.0.2) \u3067 \u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc + FAPI1 advanced \u3092\u8a66\u3059 #keycloak #oauth #oidc\",\"datePublished\":\"2023-04-14T03:00:41+00:00\",\"dateModified\":\"2023-04-18T05:24:42+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520\"},\"wordCount\":1534,\"image\":{\"@id\":\"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/04\/keycloak.jpg\",\"articleSection\":[\"keycloak\"],\"inLanguage\":\"ja\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520\",\"url\":\"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520\",\"name\":\"Keycloak (21.0.2) \u3067 \u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc + FAPI1 advanced \u3092\u8a66\u3059 #keycloak #oauth #oidc - Tech Blog\uff5c\u30af\u30ea\u30a8\u30fc\u30b7\u30e7\u30f3\u30e9\u30a4\u30f3\",\"isPartOf\":{\"@id\":\"https:\/\/www.creationline.com\/tech-blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/04\/keycloak.jpg\",\"datePublished\":\"2023-04-14T03:00:41+00:00\",\"dateModified\":\"2023-04-18T05:24:42+00:00\",\"author\":{\"@id\":\"https:\/\/www.creationline.com\/tech-blog\/#\/schema\/person\/7d923d1c017568a1a5e66d7bb1c8764a\"},\"description\":\"keycloak |1. \u76ee\u6b21 \u76ee\u6b21 \u6982\u8981 2.1 \u672c\u8a18\u4e8b\u5185\u3067\u306e\u7565\u79f0\u306b\u3064\u3044\u3066 2.2 \u4eca\u56de\u306e\u8a18\u4e8b\u3067\u8aac\u660e\u3059\u308b\u7b87\u6240 2.3 \u4eca\u56de\u306e\u8a18\u4e8b\u3067\u8aac\u660e\u3057\u306a\u3044\u7b87\u6240 \u74b0\u5883\u306e\u8aac\u660e 3.1\",\"breadcrumb\":{\"@id\":\"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520#breadcrumb\"},\"inLanguage\":\"ja\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"ja\",\"@id\":\"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520#primaryimage\",\"url\":\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/04\/keycloak.jpg\",\"contentUrl\":\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/04\/keycloak.jpg\",\"width\":1200,\"height\":630},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"HOME\",\"item\":\"https:\/\/www.creationline.com\/tech-blog\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u30af\u30e9\u30a6\u30c9\u30cd\u30a4\u30c6\u30a3\u30d6\",\"item\":\"https:\/\/www.creationline.com\/tech-blog\/cloudnative\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"keycloak\",\"item\":\"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Keycloak (21.0.2) \u3067 \u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc + FAPI1 advanced \u3092\u8a66\u3059 #keycloak #oauth #oidc\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.creationline.com\/tech-blog\/#website\",\"url\":\"https:\/\/www.creationline.com\/tech-blog\/\",\"name\":\"Tech Blog\uff5c\u30af\u30ea\u30a8\u30fc\u30b7\u30e7\u30f3\u30e9\u30a4\u30f3\",\"description\":\"\u30a2\u30b8\u30e3\u30a4\u30eb\uff06DevOps\u3001\u30af\u30e9\u30a6\u30c9\u30cd\u30a4\u30c6\u30a3\u30d6\u3001AI\uff06LLM\u306e\u5148\u7aef\u6280\u8853\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.creationline.com\/tech-blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"ja\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.creationline.com\/tech-blog\/#\/schema\/person\/7d923d1c017568a1a5e66d7bb1c8764a\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"ja\",\"@id\":\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2021\/12\/avatar.png\",\"url\":\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2021\/12\/avatar.png\",\"contentUrl\":\"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2021\/12\/avatar.png\",\"caption\":\"admin\"},\"url\":\"https:\/\/www.creationline.com\/tech-blog\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Keycloak (21.0.2) \u3067 \u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc + FAPI1 advanced \u3092\u8a66\u3059 #keycloak #oauth #oidc - Tech Blog\uff5c\u30af\u30ea\u30a8\u30fc\u30b7\u30e7\u30f3\u30e9\u30a4\u30f3","description":"keycloak |1. \u76ee\u6b21 \u76ee\u6b21 \u6982\u8981 2.1 \u672c\u8a18\u4e8b\u5185\u3067\u306e\u7565\u79f0\u306b\u3064\u3044\u3066 2.2 \u4eca\u56de\u306e\u8a18\u4e8b\u3067\u8aac\u660e\u3059\u308b\u7b87\u6240 2.3 \u4eca\u56de\u306e\u8a18\u4e8b\u3067\u8aac\u660e\u3057\u306a\u3044\u7b87\u6240 \u74b0\u5883\u306e\u8aac\u660e 3.1","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520","og_locale":"ja_JP","og_type":"article","og_title":"Keycloak (21.0.2) \u3067 \u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc + FAPI1 advanced \u3092\u8a66\u3059 #keycloak #oauth #oidc - Tech Blog\uff5c\u30af\u30ea\u30a8\u30fc\u30b7\u30e7\u30f3\u30e9\u30a4\u30f3","og_description":"keycloak |1. \u76ee\u6b21 \u76ee\u6b21 \u6982\u8981 2.1 \u672c\u8a18\u4e8b\u5185\u3067\u306e\u7565\u79f0\u306b\u3064\u3044\u3066 2.2 \u4eca\u56de\u306e\u8a18\u4e8b\u3067\u8aac\u660e\u3059\u308b\u7b87\u6240 2.3 \u4eca\u56de\u306e\u8a18\u4e8b\u3067\u8aac\u660e\u3057\u306a\u3044\u7b87\u6240 \u74b0\u5883\u306e\u8aac\u660e 3.1","og_url":"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520","og_site_name":"Tech Blog\uff5c\u30af\u30ea\u30a8\u30fc\u30b7\u30e7\u30f3\u30e9\u30a4\u30f3","article_publisher":"https:\/\/www.facebook.com\/creationline","article_published_time":"2023-04-14T03:00:41+00:00","article_modified_time":"2023-04-18T05:24:42+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/04\/keycloak.jpg","type":"image\/jpeg"}],"author":"admin","twitter_card":"summary_large_image","twitter_creator":"@creationline","twitter_site":"@creationline","twitter_misc":{"\u57f7\u7b46\u8005":"admin","\u63a8\u5b9a\u8aad\u307f\u53d6\u308a\u6642\u9593":"25\u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520#article","isPartOf":{"@id":"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520"},"author":{"name":"admin","@id":"https:\/\/www.creationline.com\/tech-blog\/#\/schema\/person\/7d923d1c017568a1a5e66d7bb1c8764a"},"headline":"Keycloak (21.0.2) \u3067 \u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc + FAPI1 advanced \u3092\u8a66\u3059 #keycloak #oauth #oidc","datePublished":"2023-04-14T03:00:41+00:00","dateModified":"2023-04-18T05:24:42+00:00","mainEntityOfPage":{"@id":"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520"},"wordCount":1534,"image":{"@id":"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520#primaryimage"},"thumbnailUrl":"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/04\/keycloak.jpg","articleSection":["keycloak"],"inLanguage":"ja"},{"@type":"WebPage","@id":"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520","url":"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520","name":"Keycloak (21.0.2) \u3067 \u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc + FAPI1 advanced \u3092\u8a66\u3059 #keycloak #oauth #oidc - Tech Blog\uff5c\u30af\u30ea\u30a8\u30fc\u30b7\u30e7\u30f3\u30e9\u30a4\u30f3","isPartOf":{"@id":"https:\/\/www.creationline.com\/tech-blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520#primaryimage"},"image":{"@id":"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520#primaryimage"},"thumbnailUrl":"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/04\/keycloak.jpg","datePublished":"2023-04-14T03:00:41+00:00","dateModified":"2023-04-18T05:24:42+00:00","author":{"@id":"https:\/\/www.creationline.com\/tech-blog\/#\/schema\/person\/7d923d1c017568a1a5e66d7bb1c8764a"},"description":"keycloak |1. \u76ee\u6b21 \u76ee\u6b21 \u6982\u8981 2.1 \u672c\u8a18\u4e8b\u5185\u3067\u306e\u7565\u79f0\u306b\u3064\u3044\u3066 2.2 \u4eca\u56de\u306e\u8a18\u4e8b\u3067\u8aac\u660e\u3059\u308b\u7b87\u6240 2.3 \u4eca\u56de\u306e\u8a18\u4e8b\u3067\u8aac\u660e\u3057\u306a\u3044\u7b87\u6240 \u74b0\u5883\u306e\u8aac\u660e 3.1","breadcrumb":{"@id":"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520#breadcrumb"},"inLanguage":"ja","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520"]}]},{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520#primaryimage","url":"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/04\/keycloak.jpg","contentUrl":"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2023\/04\/keycloak.jpg","width":1200,"height":630},{"@type":"BreadcrumbList","@id":"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak\/59520#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"HOME","item":"https:\/\/www.creationline.com\/tech-blog"},{"@type":"ListItem","position":2,"name":"\u30af\u30e9\u30a6\u30c9\u30cd\u30a4\u30c6\u30a3\u30d6","item":"https:\/\/www.creationline.com\/tech-blog\/cloudnative"},{"@type":"ListItem","position":3,"name":"keycloak","item":"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/keycloak"},{"@type":"ListItem","position":4,"name":"Keycloak (21.0.2) \u3067 \u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30dd\u30ea\u30b7\u30fc + FAPI1 advanced \u3092\u8a66\u3059 #keycloak #oauth #oidc"}]},{"@type":"WebSite","@id":"https:\/\/www.creationline.com\/tech-blog\/#website","url":"https:\/\/www.creationline.com\/tech-blog\/","name":"Tech Blog\uff5c\u30af\u30ea\u30a8\u30fc\u30b7\u30e7\u30f3\u30e9\u30a4\u30f3","description":"\u30a2\u30b8\u30e3\u30a4\u30eb\uff06DevOps\u3001\u30af\u30e9\u30a6\u30c9\u30cd\u30a4\u30c6\u30a3\u30d6\u3001AI\uff06LLM\u306e\u5148\u7aef\u6280\u8853","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.creationline.com\/tech-blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ja"},{"@type":"Person","@id":"https:\/\/www.creationline.com\/tech-blog\/#\/schema\/person\/7d923d1c017568a1a5e66d7bb1c8764a","name":"admin","image":{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2021\/12\/avatar.png","url":"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2021\/12\/avatar.png","contentUrl":"https:\/\/www.creationline.com\/tech-blog\/cms_x3GWkuX\/wp-content\/uploads\/2021\/12\/avatar.png","caption":"admin"},"url":"https:\/\/www.creationline.com\/tech-blog\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.creationline.com\/tech-blog\/wp-json\/wp\/v2\/posts\/59520","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.creationline.com\/tech-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.creationline.com\/tech-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.creationline.com\/tech-blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.creationline.com\/tech-blog\/wp-json\/wp\/v2\/comments?post=59520"}],"version-history":[{"count":31,"href":"https:\/\/www.creationline.com\/tech-blog\/wp-json\/wp\/v2\/posts\/59520\/revisions"}],"predecessor-version":[{"id":60287,"href":"https:\/\/www.creationline.com\/tech-blog\/wp-json\/wp\/v2\/posts\/59520\/revisions\/60287"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.creationline.com\/tech-blog\/wp-json\/wp\/v2\/media\/60140"}],"wp:attachment":[{"href":"https:\/\/www.creationline.com\/tech-blog\/wp-json\/wp\/v2\/media?parent=59520"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.creationline.com\/tech-blog\/wp-json\/wp\/v2\/categories?post=59520"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.creationline.com\/tech-blog\/wp-json\/wp\/v2\/tags?post=59520"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}