62 lines
3.1 KiB
JSON
62 lines
3.1 KiB
JSON
|
{
|
||
|
|
"schema_version": 1,
|
||
|
|
"diagram_type": "sequence",
|
||
|
|
"meta": {
|
||
|
|
"title": "User Direct Access with JWT",
|
||
|
|
"viewBox": [1000, 640],
|
||
|
|
"column_fit": "spread",
|
||
|
|
"quality_profile": "showcase"
|
||
|
|
},
|
||
|
|
"participants": [
|
||
|
|
{ "id": "user", "type": "external", "label": "User", "sublabel": "browser" },
|
||
|
|
{ "id": "app", "type": "frontend", "label": "Web App", "sublabel": "poimen UI" },
|
||
|
|
{ "id": "authentik", "type": "security", "label": "Authentik", "sublabel": "OIDC provider" },
|
||
|
|
{ "id": "memory", "type": "backend", "label": "Memory API", "sublabel": "poimen-memory" },
|
||
|
|
{ "id": "jwks", "type": "security", "label": "JWKS", "sublabel": "RS256 keys" }
|
||
|
|
],
|
||
|
|
"segments": [
|
||
|
|
{ "from": 150, "to": 370, "label": "OIDC Login" },
|
||
|
|
{ "from": 380, "to": 540, "label": "API + RBAC" }
|
||
|
|
],
|
||
|
|
"messages": [
|
||
|
|
{ "id": "click-login", "from": "user", "to": "app", "y": 165, "label": "click Login", "variant": "default" },
|
||
|
|
{ "id": "redirect-auth", "from": "app", "to": "authentik", "y": 200, "label": "redirect /authorize", "variant": "emphasis", "note": "scope=openid groups roles" },
|
||
|
|
{ "id": "show-login", "from": "authentik", "to": "user", "y": 235, "label": "login form", "variant": "default" },
|
||
|
|
{ "id": "submit-creds", "from": "user", "to": "authentik", "y": 270, "label": "username + password", "variant": "security" },
|
||
|
|
{ "id": "auth-code", "from": "authentik", "to": "app", "y": 305, "label": "redirect ?code=xxx", "variant": "return" },
|
||
|
|
{ "id": "exchange-token", "from": "app", "to": "authentik", "y": 340, "label": "POST /token code=xxx", "variant": "emphasis" },
|
||
|
|
{ "id": "jwt-resp", "from": "authentik", "to": "app", "y": 375, "label": "JWT {groups,roles,sub}", "variant": "return" },
|
||
|
|
{ "id": "query-api", "from": "app", "to": "memory", "y": 420, "label": "GET /memory/query", "variant": "emphasis", "note": "Authorization: Bearer <JWT>" },
|
||
|
|
{ "id": "fetch-jwks", "from": "memory", "to": "jwks", "y": 455, "label": "GET /jwks (cached)", "variant": "dashed" },
|
||
|
|
{ "id": "jwks-keys", "from": "jwks", "to": "memory", "y": 490, "label": "RSA pubkey", "variant": "return" },
|
||
|
|
{ "id": "query-resp", "from": "memory", "to": "app", "y": 525, "label": "200 JSON results", "variant": "return", "note": "has_capability(memory:read) ✓" }
|
||
|
|
],
|
||
|
|
"activations": [
|
||
|
|
{ "participant": "user", "from": 160, "to": 276, "type": "external" },
|
||
|
|
{ "participant": "app", "from": 165, "to": 531, "type": "frontend" },
|
||
|
|
{ "participant": "authentik", "from": 195, "to": 381, "type": "security" },
|
||
|
|
{ "participant": "memory", "from": 415, "to": 531, "type": "backend" },
|
||
|
|
{ "participant": "jwks", "from": 450, "to": 496, "type": "security" }
|
||
|
|
],
|
||
|
|
"cards": [
|
||
|
|
{
|
||
|
|
"dot": "emerald",
|
||
|
|
"title": "Authorization Code Flow",
|
||
|
|
"items": [
|
||
|
|
"User authenticates directly with Authentik",
|
||
|
|
"App exchanges code for JWT",
|
||
|
|
"Scopes: openid groups roles permissions"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"dot": "rose",
|
||
|
|
"title": "JWT Contents",
|
||
|
|
"items": [
|
||
|
|
"iss: .../application/o/poimen/",
|
||
|
|
"aud: poimen (provider client_id)",
|
||
|
|
"groups: user's group memberships"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|