{"id":22354,"date":"2022-06-03T17:33:24","date_gmt":"2022-06-03T08:33:24","guid":{"rendered":"https:\/\/www.skyarch.net\/blog\/?p=22354"},"modified":"2022-06-03T17:33:24","modified_gmt":"2022-06-03T08:33:24","slug":"auth0-%e3%81%ab%e3%82%88%e3%82%8b-aws-%e3%82%b3%e3%83%b3%e3%82%bd%e3%83%bc%e3%83%ab%e3%83%ad%e3%82%b0%e3%82%a4%e3%83%b3%e3%81%ab-sourceidentity-%e3%82%92%e5%b0%8e%e5%85%a5%e3%81%97%e3%83%88%e3%83%ac","status":"publish","type":"post","link":"https:\/\/www.skyarch.net\/blog\/auth0-%e3%81%ab%e3%82%88%e3%82%8b-aws-%e3%82%b3%e3%83%b3%e3%82%bd%e3%83%bc%e3%83%ab%e3%83%ad%e3%82%b0%e3%82%a4%e3%83%b3%e3%81%ab-sourceidentity-%e3%82%92%e5%b0%8e%e5%85%a5%e3%81%97%e3%83%88%e3%83%ac\/","title":{"rendered":"Auth0 \u306b\u3088\u308b AWS \u30b3\u30f3\u30bd\u30fc\u30eb\u30ed\u30b0\u30a4\u30f3\u306b SourceIdentity \u3092\u5c0e\u5165\u3057\u30c8\u30ec\u30fc\u30b5\u30d3\u30ea\u30c6\u30a3\u3092\u5411\u4e0a\u3059\u308b"},"content":{"rendered":"<h3>\u6982\u8981<\/h3>\n<p>Auth0 \u3092\u5229\u7528\u3057\u3001\u4ee5\u4e0b\u306e\u3088\u3046\u306aAWS\u30b3\u30f3\u30bd\u30fc\u30eb\u30ed\u30b0\u30a4\u30f3\u306e\u4ed5\u7d44\u307f\u3092\u69cb\u7bc9\u3059\u308b\u3053\u3068\u304c\u53ef\u80fd\u3067\u3059\u3002<\/p>\n<a href=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-plain.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-22355\" src=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-plain.png\" alt=\"\" width=\"962\" height=\"180\" srcset=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-plain.png 962w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-plain-300x56.png 300w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-plain-768x144.png 768w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-plain-728x136.png 728w\" sizes=\"auto, (max-width: 962px) 100vw, 962px\" \/><\/a>\n<p>\u56f3\u4e2d\u306e\u300c\u30d5\u30a7\u30c7\u30ec\u30fc\u30b7\u30e7\u30f3\u30ed\u30b0\u30a4\u30f3\u300d\u300c\u30b9\u30a4\u30c3\u30c1\u30ed\u30fc\u30eb\u300d\u306f AWS API \u3067\u3044\u3046\u3068 <a href=\"https:\/\/docs.aws.amazon.com\/STS\/latest\/APIReference\/API_AssumeRoleWithSAML.html\" target=\"_blank\" rel=\"noopener\">AssumeRoleWithSAML<\/a> \u3068 <a href=\"https:\/\/docs.aws.amazon.com\/STS\/latest\/APIReference\/API_AssumeRole.html\" target=\"_blank\" rel=\"noopener\">AssumeRole<\/a> \u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n<p>\u3053\u308c\u3089\u306e API \u3067\u306f\u3001AWS \u4e0a\u306e\u64cd\u4f5c\u306b\u5bfe\u3059\u308b\u8ffd\u8de1\u6027\u3092\u9ad8\u3081\u308b\u3053\u3068\u306e\u3067\u304d\u308b <code>SourceIdentity<\/code> \u3068\u3044\u3046\u30d1\u30e9\u30e1\u30fc\u30bf\u304c\u7528\u610f\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u3053\u306e <code>SourceIdentity<\/code> \u3092\u4e0a\u8a18\u306e\u30b3\u30f3\u30bd\u30fc\u30eb\u30ed\u30b0\u30a4\u30f3\u306e\u4ed5\u7d44\u307f\u306b\u5c0e\u5165\u3059\u308b\u6a5f\u4f1a\u304c\u3042\u308a\u307e\u3057\u305f\u306e\u3067\u5185\u5bb9\u3092\u7d39\u4ecb\u3057\u307e\u3059\u3002<\/p>\n<h3>SourceIdentity \u306e\u610f\u7fa9<\/h3>\n<h4>SourceIdentity \u3092\u5229\u7528\u3057\u306a\u3044\u5834\u5408\u306e\u8ffd\u8de1\u6027<\/h4>\n<p><code>SourceIdentity<\/code> \u3092\u5229\u7528\u3057\u306a\u3044\u5834\u5408\u3001Auth0 \u3084 AWS\u30a2\u30ab\u30a6\u30f3\u30c8\u9593\u3067\u4ee5\u4e0b\u306e\u3088\u3046\u306a\u60c5\u5831\u304c\u3084\u308a\u3068\u308a\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>(\u3042\u304f\u307e\u3067\u4f8b\u306a\u306e\u3067\u3001Auth0 \u7b49\u306e\u8a2d\u5b9a\u5185\u5bb9\u306b\u3088\u308a\u7570\u306a\u308a\u307e\u3059)<\/p>\n<a href=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-22369\" src=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-1.png\" alt=\"\" width=\"975\" height=\"420\" srcset=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-1.png 975w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-1-300x129.png 300w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-1-768x331.png 768w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-1-728x314.png 728w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/a>\n<p>\u6ce8\u76ee\u3057\u3066\u3044\u305f\u3060\u304d\u305f\u3044\u306e\u306f\u3001Auth0 \u306b\u30ed\u30b0\u30a4\u30f3\u3057\u305f\u30e6\u30fc\u30b6\u30fc\u306e\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9(xxxx@skyarch.net)\u304c <code>RoleSessionName<\/code> \u3068\u3044\u3046\u30d1\u30e9\u30e1\u30fc\u30bf\u3068\u3057\u3066\u6e21\u3055\u308c\u3066\u3044\u308b\u3053\u3068\u3067\u3059\u3002<\/p>\n<p>\u3053\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u306f\u3001CloudTrail \u306e\u30b3\u30f3\u30bd\u30fc\u30eb\u3067\u300c\u30e6\u30fc\u30b6\u30fc\u540d\u300d\u3068\u3057\u3066\u8868\u793a\u3055\u308c\u308b\u306e\u3067\u3001AWS \u4e0a\u306e\u64cd\u4f5c\u306e\u30c8\u30e9\u30c3\u30ad\u30f3\u30b0\u306b\u5f79\u7acb\u3061\u307e\u3059\u3002<\/p>\n<a href=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/2022-06-02_12h27_23.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-22357\" src=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/2022-06-02_12h27_23.png\" alt=\"\" width=\"557\" height=\"695\" srcset=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/2022-06-02_12h27_23.png 557w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/2022-06-02_12h27_23-240x300.png 240w\" sizes=\"auto, (max-width: 557px) 100vw, 557px\" \/><\/a>\n<p>\u305f\u3060\u3057\u300c\u8e0f\u307f\u53f0AWS\u30a2\u30ab\u30a6\u30f3\u30c8\u300d\u306b\u30ed\u30b0\u30a4\u30f3\u3057\u305f\u5f8c\u306f\u3001\u5404\u30e6\u30fc\u30b6\u30fc(xxxx@skyarch.net)\u304c AWS CLI \u3084 SDK \u3092\u4f7f\u3046\u3053\u3068\u3067\u4efb\u610f\u306e <code>RoleSessionName<\/code> \u3092\u8a2d\u5b9a\u3059\u308b\u3053\u3068\u304c\u51fa\u6765\u3066\u3057\u307e\u3044\u307e\u3059\u3002<\/p>\n<a href=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-via-CLI-1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-22370\" src=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-via-CLI-1.png\" alt=\"\" width=\"975\" height=\"420\" srcset=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-via-CLI-1.png 975w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-via-CLI-1-300x129.png 300w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-via-CLI-1-768x331.png 768w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-via-CLI-1-728x314.png 728w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/a>\n<p>\u305d\u306e\u305f\u3081\u3001\u5834\u5408\u306b\u3088\u3063\u3066\u306f\u300c\u5b9f\u5229\u7528AWS\u30a2\u30ab\u30a6\u30f3\u30c8\u300d\u306e CloudTrail \u30ed\u30b0\u306b\u6b8b\u308b <code>RoleSessionName<\/code> (\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9) \u304c\u5b9f\u969b\u306b\u30ed\u30b0\u30a4\u30f3\u3057\u305f\u30e6\u30fc\u30b6\u30fc(xxxx@skyarch.net)\u3068\u7570\u306a\u308b\u3001\u3068\u3044\u3046\u3053\u3068\u304c\u8d77\u3053\u308a\u5f97\u307e\u3059\u3002<\/p>\n<p>\u203b\u3053\u306e\u5834\u5408\u3067\u3082\u300c\u8e0f\u307f\u53f0AWS\u30a2\u30ab\u30a6\u30f3\u30c8\u300d\u306e CloudTrail \u30ed\u30b0\u307e\u3067\u3055\u304b\u306e\u307c\u3063\u3066\u8abf\u3079\u308c\u3070\u5b9f\u969b\u306b\u30ed\u30b0\u30a4\u30f3\/\u64cd\u4f5c\u3057\u305f\u30e6\u30fc\u30b6\u30fc\u3092\u7279\u5b9a\u3059\u308b\u3053\u3068\u306f\u53ef\u80fd\u3067\u3059<\/p>\n<h4>SourceIdentity \u3092\u5229\u7528\u3057\u305f\u5834\u5408\u306e\u8ffd\u8de1\u6027<\/h4>\n<p><code>SourceIdentity<\/code> \u3092\u5229\u7528\u3057\u305f\u5834\u5408\u3001Auth0 \u3084 AWS\u30a2\u30ab\u30a6\u30f3\u30c8\u9593\u3067\u4ee5\u4e0b\u306e\u3088\u3046\u306a\u60c5\u5831\u304c\u3084\u308a\u3068\u308a\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<a href=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-with-SourceIdentity-1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-22371\" src=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-with-SourceIdentity-1.png\" alt=\"\" width=\"975\" height=\"420\" srcset=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-with-SourceIdentity-1.png 975w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-with-SourceIdentity-1-300x129.png 300w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-with-SourceIdentity-1-768x331.png 768w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-with-SourceIdentity-1-728x314.png 728w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/a>\n<p><code>SourceIdentity<\/code> \u304c <code>RoleSessionName<\/code> \u3068\u5927\u304d\u304f\u7570\u306a\u308b\u306e\u306f\u3001\u30ed\u30fc\u30eb\u30bb\u30c3\u30b7\u30e7\u30f3\u3067\u6700\u521d\u306b\u8a2d\u5b9a\u3057\u305f <code>SourceIdentity<\/code> \u306f\u5909\u66f4\u3067\u304d\u306a\u3044\u3068\u3044\u3046\u70b9\u3067\u3059\u3002<\/p>\n<p>\u4ee5\u4e0b\u306e\u3088\u3046\u306b\u3001AWS CLI \u306a\u3069\u306b\u3088\u308b <code>AssumeRole<\/code> \u3067 <code>RoleSessionName<\/code> \u3092\u5909\u66f4\u3057\u3066\u3082\u3001<code>SourceIdentity<\/code> \u306f\u5143\u306e\u5024\u304c\u4fdd\u6301\u3055\u308c\u307e\u3059\u3002<\/p>\n<a href=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-with-SourceIdentity-via-CLI-2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-22372\" src=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-with-SourceIdentity-via-CLI-2.png\" alt=\"\" width=\"975\" height=\"420\" srcset=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-with-SourceIdentity-via-CLI-2.png 975w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-with-SourceIdentity-via-CLI-2-300x129.png 300w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-with-SourceIdentity-via-CLI-2-768x331.png 768w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-with-SourceIdentity-via-CLI-2-728x314.png 728w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/a>\n<p>CloudTrail \u3067\u306f\u3001\u4ee5\u4e0b\u306e\u3088\u3046\u306b\u78ba\u8a8d\u53ef\u80fd\u3067\u3059\u3002<\/p>\n<a href=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/2022-06-02_16h09_11.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-22366\" src=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/2022-06-02_16h09_11-456x1024.png\" alt=\"\" width=\"539\" height=\"1210\" srcset=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/2022-06-02_16h09_11-456x1024.png 456w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/2022-06-02_16h09_11-134x300.png 134w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/2022-06-02_16h09_11.png 553w\" sizes=\"auto, (max-width: 539px) 100vw, 539px\" \/><\/a>\n<p>\u3064\u307e\u308a\u3001<code>SourceIdentity<\/code> \u3092\u5229\u7528\u3059\u308b\u3053\u3068\u3067\u3088\u308a\u6b63\u78ba\u306b AWS \u4e0a\u306e\u64cd\u4f5c\u3092\u884c\u3063\u305f\u500b\u4eba\u3092\u30c8\u30e9\u30c3\u30ad\u30f3\u30b0\u3059\u308b\u3053\u3068\u304c\u53ef\u80fd\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n<h3>SourceIdentity \u306e\u5c0e\u5165<\/h3>\n<h4>\u5c0e\u5165\u524d\u306e\u8a2d\u5b9a<\/h4>\n<p><code>SourceIdentity<\/code> \u5c0e\u5165\u524d\u306f\u3001\u5404\u7a2e\u8a2d\u5b9a\u306f\u4ee5\u4e0b\u306e\u3088\u3046\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n<a href=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-settings-1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-22374\" src=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-settings-1-1024x724.png\" alt=\"\" width=\"833\" height=\"589\" srcset=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-settings-1-1024x724.png 1024w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-settings-1-300x212.png 300w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-settings-1-768x543.png 768w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-settings-1-728x515.png 728w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-without-SourceIdentity-settings-1.png 1062w\" sizes=\"auto, (max-width: 833px) 100vw, 833px\" \/><\/a>\n<p>Auth0 Rule (1-1) \u306f\u3001\u8e0f\u307f\u53f0AWS\u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u30ed\u30fc\u30eb\u540d\u306a\u3069\u3092\u542b\u3093\u3060 SAML \u30a2\u30b5\u30fc\u30b7\u30e7\u30f3\u3092\u751f\u6210\u3057\u307e\u3059\u3002<\/p>\n<p><a href=\"https:\/\/auth0.com\/docs\/customize\/integrations\/aws\/configure-amazon-web-services-for-sso#configure-session-expiration\" target=\"_blank\" rel=\"noopener\">\u53c2\u8003: Auth0 - Configure Amazon Web Services for Single Sign-On<\/a><\/p>\n<pre># (1-1) Auth0 Rule JavaScript \u306e\u4e00\u90e8\ncontext.samlConfiguration.mappings = {\n  'https:\/\/aws.amazon.com\/SAML\/Attributes\/Role': 'YOUR-AWS-ROLE-NAME',\n  'https:\/\/aws.amazon.com\/SAML\/Attributes\/RoleSessionName': 'YOUR-AWS-ROLE-SESSION-NAME',\n  'https:\/\/aws.amazon.com\/SAML\/Attributes\/SessionDuration': 'time'\n};\n<\/pre>\n<p>IAM\u30ed\u30fc\u30eb\u306e\u8a2d\u5b9a (1-2 \uff5e 1-4) \u306b\u3064\u3044\u3066\u306f\u305d\u308c\u305e\u308c\u4ee5\u4e0b\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u7d30\u304b\u3044\u5185\u5bb9\u306f\u7f6e\u3044\u3066\u304a\u3044\u3066\u3001<code>sts:AssumeRoleWithSAML<\/code> \u3068 <code>sts:AssumeRole<\/code> \u3092\u8a31\u53ef\u3057\u3066\u3044\u308b\u3053\u3068\u304c\u5206\u304b\u308a\u307e\u3059\u3002<\/p>\n<pre># (1-2) \u30ed\u30fc\u30eb\u306e\u4fe1\u983c\u30dd\u30ea\u30b7\u30fc\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"Federated\": \"[SAML ID Provider \u306e ARN]\"\n            },\n            \"Action\": [\n                \"sts:AssumeRoleWithSAML\"\n            ],\n            \"Condition\": {\n                \"StringEquals\": {\n                    \"SAML:aud\": \"https:\/\/signin.aws.amazon.com\/saml\"\n                }\n            }\n        }\n    ]\n}\n\n# (1-3) \u30ed\u30fc\u30eb\u306eIAM\u30dd\u30ea\u30b7\u30fc\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Action\": [\n                \"sts:AssumeRole\"\n            ],\n            \"Resource\": [\n                \"[\u5b9f\u5229\u7528\u30ed\u30fc\u30eb ARN]\"\n            ],\n            \"Effect\": \"Allow\"\n        }\n    ]\n}\n\n# (1-4) \u30ed\u30fc\u30eb\u306e\u4fe1\u983c\u30dd\u30ea\u30b7\u30fc\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"AWS\": [\n                    \"[\u8e0f\u307f\u53f0\u30ed\u30fc\u30eb ARN]\"\n                ]\n            },\n            \"Action\": [\n                \"sts:AssumeRole\"\n            ]\n        }\n    ]\n}\n<\/pre>\n<h4>SourceIdentity \u3092\u5c0e\u5165\u3059\u308b\u305f\u3081\u306e\u8a2d\u5b9a<\/h4>\n<p>\u672c\u8a18\u4e8b\u3067\u66f8\u304d\u305f\u304b\u3063\u305f\u30e1\u30a4\u30f3\u306e\u90e8\u5206\u3067\u3059\u3002<\/p>\n<p><code>SourceIdentity<\/code> \u3092\u5c0e\u5165\u3059\u308b\u306b\u3042\u305f\u308a\u3001\u5404\u7a2e\u30ea\u30bd\u30fc\u30b9\u306b\u4ee5\u4e0b\u306e\u3088\u3046\u306b\u8a2d\u5b9a\u3092\u52a0\u3048\u307e\u3057\u305f\u3002<\/p>\n<a href=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-with-SourceIdentity-settings.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-22375\" src=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-with-SourceIdentity-settings-1024x724.png\" alt=\"\" width=\"924\" height=\"654\" srcset=\"https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-with-SourceIdentity-settings-1024x724.png 1024w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-with-SourceIdentity-settings-300x212.png 300w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-with-SourceIdentity-settings-768x543.png 768w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-with-SourceIdentity-settings-728x515.png 728w, https:\/\/www.skyarch.net\/blog\/wp-content\/uploads\/2022\/06\/AWS-login-model-with-SourceIdentity-settings.png 1062w\" sizes=\"auto, (max-width: 924px) 100vw, 924px\" \/><\/a>\n<p>Auth0 Rule (2-1) \u3067\u306f\u3001\u8e0f\u307f\u53f0AWS\u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u30ed\u30fc\u30eb\u540d\u306b\u52a0\u3048\u3001<code>SourceIdentity<\/code> \u3092\u542b\u3093\u3060 SAML \u30a2\u30b5\u30fc\u30b7\u30e7\u30f3\u3092\u751f\u6210\u3057\u307e\u3059\u3002<\/p>\n<p><a href=\"https:\/\/docs.aws.amazon.com\/ja_jp\/IAM\/latest\/UserGuide\/id_roles_providers_create_saml_assertions.html#saml_sourceidentity\" target=\"_blank\" rel=\"noopener\">\u53c2\u8003: SAML SourceIdentityAttribute<\/a><\/p>\n<p>\u203b\u4eca\u56de\u306f <code>RoleSessionName<\/code> \u3068 <code>SourceIdentity<\/code> \u306b\u540c\u3058\u5024(\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9=xxxx@skyarch.net)\u3092\u8a2d\u5b9a\u3057\u3066\u3044\u307e\u3059<\/p>\n<pre># (2-1) Auth0 Rule JavaScript \u306e\u4e00\u90e8\ncontext.samlConfiguration.mappings = {\n  'https:\/\/aws.amazon.com\/SAML\/Attributes\/Role': 'YOUR-AWS-ROLE-NAME',\n  'https:\/\/aws.amazon.com\/SAML\/Attributes\/RoleSessionName': 'YOUR-AWS-ROLE-SESSION-NAME',\n  'https:\/\/aws.amazon.com\/SAML\/Attributes\/SessionDuration': 'time',\n  <span style=\"color: #ffff00;\">'https:\/\/aws.amazon.com\/SAML\/Attributes\/SourceIdentity': 'YOUR-AWS-ROLE-SESSION-NAME'<\/span>\n};\n<\/pre>\n<p>IAM\u30ed\u30fc\u30eb\u306e\u8a2d\u5b9a (2-2 \uff5e 2-4) \u306b\u3064\u3044\u3066\u306f\u305d\u308c\u305e\u308c\u4ee5\u4e0b\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><code>sts:AssumeRoleWithSAML<\/code> \u3068 <code>sts:AssumeRole<\/code> \u306b\u52a0\u3048\u3001<code>sts:SetSourceIdentity<\/code> \u3092\u8a31\u53ef\u3057\u3066\u3044\u308b\u3053\u3068\u304c\u5206\u304b\u308a\u307e\u3059\u3002<\/p>\n<p>STS \u306b\u306f <code>SetSourceIdentity<\/code> \u3068\u3044\u3046 API \u306f\u3042\u308a\u307e\u305b\u3093\u304c\u3001<code>SourceIdentity<\/code> \u3092\u6307\u5b9a\u3057\u3066 <code>AssumeRole<\/code> \/ <code>AssumeRoleWithSAML<\/code> API \u3092\u53e9\u304f\u5834\u5408\u306b\u5fc5\u8981\u3068\u306a\u308b\u6a29\u9650\u3067\u3059\u3002<\/p>\n<pre># (2-2) \u30ed\u30fc\u30eb\u306e\u4fe1\u983c\u30dd\u30ea\u30b7\u30fc\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"Federated\": \"[SAML ID Provider \u306e ARN]\"\n            },\n            \"Action\": [\n                \"sts:AssumeRoleWithSAML\",\n                <span style=\"color: #ffff00;\">\"sts:SetSourceIdentity\"<\/span>\n            ],\n            \"Condition\": {\n                \"StringEquals\": {\n                    \"SAML:aud\": \"https:\/\/signin.aws.amazon.com\/saml\"\n                }\n            }\n        }\n    ]\n}\n\n# (2-3) \u30ed\u30fc\u30eb\u306eIAM\u30dd\u30ea\u30b7\u30fc\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Action\": [\n                \"sts:AssumeRole\",\n                <span style=\"color: #ffff00;\">\"sts:SetSourceIdentity\"<\/span>\n            ],\n            \"Resource\": [\n                \"[\u5b9f\u5229\u7528\u30ed\u30fc\u30eb ARN]\"\n            ],\n            \"Effect\": \"Allow\"\n        }\n    ]\n}\n\n# (2-4) \u30ed\u30fc\u30eb\u306e\u4fe1\u983c\u30dd\u30ea\u30b7\u30fc\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"AWS\": [\n                    \"[\u8e0f\u307f\u53f0\u30ed\u30fc\u30eb ARN]\"\n                ]\n            },\n            \"Action\": [\n                \"sts:AssumeRole\",\n                <span style=\"color: #ffff00;\">\"sts:SetSourceIdentity\"<\/span>\n            ]\n        }\n    ]\n}\n<\/pre>\n<p><code>sts:SetSourceIdentity<\/code> \u306e\u8a31\u53ef\u8a2d\u5b9a\u306f\u3001\u30d5\u30a7\u30c7\u30ec\u30fc\u30b7\u30e7\u30f3\u30ed\u30b0\u30a4\u30f3\u7528\u30ed\u30fc\u30eb(\u8e0f\u307f\u53f0AWS\u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u30ed\u30fc\u30eb)\u3060\u3051\u3067\u306a\u304f\u30b9\u30a4\u30c3\u30c1\u30ed\u30fc\u30eb\u7528\u30ed\u30fc\u30eb(\u5b9f\u5229\u7528AWS\u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u30ed\u30fc\u30eb)\u306b\u3082\u8a2d\u5b9a\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<p><a href=\"https:\/\/docs.aws.amazon.com\/ja_jp\/IAM\/latest\/UserGuide\/id_credentials_temp_control-access_monitor.html#id_credentials_temp_control-access_monitor-perms\" target=\"_blank\" rel=\"noopener\">\u30bd\u30fc\u30b9 ID \u3092\u8a2d\u5b9a\u3059\u308b\u305f\u3081\u306b\u5fc5\u8981\u306a\u30a2\u30af\u30bb\u30b9\u8a31\u53ef<\/a><\/p>\n<blockquote>\n<ul class=\"itemizedlist\" type=\"disc\">\n<li class=\"listitem\">\u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u5883\u754c\u3092\u8d8a\u3048\u3066\u30bd\u30fc\u30b9ID\u3092\u8a2d\u5b9a\u3059\u308b\u306b\u306f\u30012 \u7b87\u6240\u306b\u00a0<code>sts:SetSourceIdentity<\/code>\u00a0\u30a2\u30af\u30bb\u30b9\u8a31\u53ef\u3092\u542b\u3081\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002\u3053\u308c\u306f\u3001\u5143\u306e\u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u30d7\u30ea\u30f3\u30b7\u30d1\u30eb\u306e\u30a2\u30af\u30bb\u30b9\u8a31\u53ef\u30dd\u30ea\u30b7\u30fc\u3068\u3001<strong>\u30bf\u30fc\u30b2\u30c3\u30c8\u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u30ed\u30fc\u30eb\u306e\u30ed\u30fc\u30eb\u4fe1\u983c\u30dd\u30ea\u30b7\u30fc<\/strong>\u306b\u3042\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002\u305f\u3068\u3048\u3070\u3001\u30ed\u30fc\u30eb\u304c<a href=\"https:\/\/docs.aws.amazon.com\/ja_jp\/IAM\/latest\/UserGuide\/id_roles_terms-and-concepts.html#iam-term-role-chaining\">\u30ed\u30fc\u30eb\u306e\u9023\u9396<\/a>\u3092\u4f7f\u7528\u3057\u3066\u5225\u306e\u30a2\u30ab\u30a6\u30f3\u30c8\u3067\u30ed\u30fc\u30eb\u3092\u5f15\u304d\u53d7\u3051\u308b\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u308b\u5834\u5408\u3001\u3053\u308c\u3092\u884c\u3046\u5fc5\u8981\u304c\u3042\u308b\u5834\u5408\u304c\u3042\u308a\u307e\u3059\u3002<\/li>\n<\/ul>\n<\/blockquote>\n<h3>\u6240\u611f\u306a\u3069<\/h3>\n<p><code>RoleSessionName<\/code> \u304c\u500b\u4eba\u3092\u7279\u5b9a\u3059\u308b\u78ba\u5b9f\u306a\u8a3c\u8de1\u306b\u306f\u306a\u3089\u306a\u3044\u3053\u3068\u3092\u77e5\u308a\u3001<code>SourceIdentity<\/code> \u3092\u5c0e\u5165\u3057\u3066\u307f\u305f\u3044\u3068\u8003\u3048\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3057\u305f\u3002<\/p>\n<p>\u305f\u3060 Auth0 \u3078 <code>SourceIdentity<\/code> \u3092\u5c0e\u5165\u3059\u308b\u3088\u3046\u306a\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3084\u30d6\u30ed\u30b0\u8a18\u4e8b\u304c\u898b\u3064\u3051\u3089\u308c\u306a\u304b\u3063\u305f\u306e\u3067\u3001\u8a2d\u5b9a\u7b87\u6240\u30fb\u8a2d\u5b9a\u5024\u304c\u5206\u304b\u3089\u305a\u8a66\u884c\u932f\u8aa4\u3057\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<p>\u540c\u3058\u3088\u3046\u306a\u72b6\u6cc1\u3067\u82e6\u52b4\u3057\u3066\u3044\u308b\u65b9\u304c\u3053\u306e\u8a18\u4e8b\u3092\u898b\u3064\u3051\u3066\u3044\u305f\u3060\u3051\u308b\u3068\u5b09\u3057\u3044\u3067\u3059\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u6982\u8981 Auth0 \u3092\u5229\u7528\u3057\u3001\u4ee5\u4e0b\u306e\u3088\u3046\u306aAWS\u30b3\u30f3\u30bd\u30fc\u30eb\u30ed\u30b0\u30a4\u30f3\u306e\u4ed5\u7d44\u307f\u3092\u69cb\u7bc9\u3059\u308b\u3053\u3068\u304c\u53ef\u80fd\u3067\u3059\u3002 \u56f3\u4e2d\u306e\u300c\u30d5\u30a7\u30c7\u30ec\u30fc\u30b7\u30e7\u30f3\u30ed\u30b0\u30a4\u30f3\u300d\u300c\u30b9\u30a4\u30c3\u30c1\u30ed\u30fc\u30eb\u300d\u306f AWS API \u3067\u3044\u3046\u3068 AssumeRoleWithSAML &#8230;<\/p>\n","protected":false},"author":60,"featured_media":22389,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_locale":"ja","_original_post":"https:\/\/www.skyarch.net\/blog\/?p=22354","footnotes":""},"categories":[20,7],"tags":[1163,102,54,1162],"class_list":{"0":"post-22354","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-aws","8":"category-security","9":"tag-auth0","10":"tag-aws","11":"tag-iam","12":"tag-saml","13":"ja"},"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/posts\/22354","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/users\/60"}],"replies":[{"embeddable":true,"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/comments?post=22354"}],"version-history":[{"count":18,"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/posts\/22354\/revisions"}],"predecessor-version":[{"id":22405,"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/posts\/22354\/revisions\/22405"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/media\/22389"}],"wp:attachment":[{"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/media?parent=22354"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/categories?post=22354"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.skyarch.net\/blog\/wp-json\/wp\/v2\/tags?post=22354"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}