doc/application_usage.svg

<?xml version="1.0" encoding="UTF-8" standalone="no"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" contentScriptType="application/ecmascript" contentStyleType="text/css" height="2926px" preserveAspectRatio="none" style="width:2520px;height:2926px;" version="1.1" viewBox="0 0 2520 2926" width="2520px" zoomAndPan="magnify"><defs><filter height="300%" id="fo9m562hwezv9" width="300%" x="-1" y="-1"><feGaussianBlur result="blurOut" stdDeviation="4.0"/><feColorMatrix in="blurOut" result="blurOut2" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .4 0"/><feOffset dx="8.0" dy="8.0" in="blurOut2" result="blurOut3"/><feBlend in="SourceGraphic" in2="blurOut3" mode="normal"/></filter></defs><g><rect fill="#FFFFFF" filter="url(#fo9m562hwezv9)" height="816.627" style="stroke: #A80036; stroke-width: 2.0;" width="20" x="547" y="192.9766"/><rect fill="#FFFFFF" filter="url(#fo9m562hwezv9)" height="301.7266" style="stroke: #A80036; stroke-width: 2.0;" width="20" x="547" y="1966.8516"/><rect fill="#FFFFFF" filter="url(#fo9m562hwezv9)" height="375.7266" style="stroke: #A80036; stroke-width: 2.0;" width="20" x="1161" y="2268.5781"/><rect fill="#FFFFFF" filter="url(#fo9m562hwezv9)" height="229.7949" style="stroke: #A80036; stroke-width: 2.0;" width="20" x="1547" y="1009.6035"/><rect fill="#FFFFFF" filter="url(#fo9m562hwezv9)" height="208.4844" style="stroke: #A80036; stroke-width: 2.0;" width="20" x="1547" y="1308.0195"/><rect fill="#FFFFFF" filter="url(#fo9m562hwezv9)" height="500.9688" style="stroke: #A80036; stroke-width: 2.0;" width="20" x="1547" y="1575.125"/><rect fill="#FFFFFF" filter="url(#fo9m562hwezv9)" height="58.6211" style="stroke: #A80036; stroke-width: 2.0;" width="20" x="1547" y="2327.1992"/><rect fill="#FFFFFF" filter="url(#fo9m562hwezv9)" height="68.6211" style="stroke: #A80036; stroke-width: 2.0;" width="20" x="2117" y="1239.3984"/><rect fill="#FFFFFF" filter="url(#fo9m562hwezv9)" height="58.6211" style="stroke: #A80036; stroke-width: 2.0;" width="20" x="2117" y="1516.5039"/><rect fill="#FFFFFF" filter="url(#fo9m562hwezv9)" height="58.6211" style="stroke: #A80036; stroke-width: 2.0;" width="20" x="2331" y="1833.6094"/><rect fill="#FFFFFF" filter="url(#fo9m562hwezv9)" height="291.7266" style="stroke: #000000; stroke-width: 4.0;" width="2391" x="86" y="293.5977"/><rect fill="#FFFFFF" filter="url(#fo9m562hwezv9)" height="1432.7695" style="stroke: #000000; stroke-width: 4.0;" width="2453" x="24" y="699.9453"/><rect fill="#FFFFFF" filter="url(#fo9m562hwezv9)" height="558.2109" style="stroke: #000000; stroke-width: 4.0;" width="1459" x="218" y="2160.7148"/><line style="stroke: #A80036; stroke-width: 2.0; stroke-dasharray: 5.0,5.0;" x1="300" x2="300" y1="172.9766" y2="2752.9258"/><line style="stroke: #A80036; stroke-width: 2.0; stroke-dasharray: 5.0,5.0;" x1="556" x2="556" y1="172.9766" y2="2752.9258"/><line style="stroke: #A80036; stroke-width: 2.0; stroke-dasharray: 5.0,5.0;" x1="1170" x2="1170" y1="172.9766" y2="2752.9258"/><line style="stroke: #A80036; stroke-width: 2.0; stroke-dasharray: 5.0,5.0;" x1="1557" x2="1557" y1="172.9766" y2="2752.9258"/><line style="stroke: #A80036; stroke-width: 2.0; stroke-dasharray: 5.0,5.0;" x1="2127" x2="2127" y1="172.9766" y2="2752.9258"/><line style="stroke: #A80036; stroke-width: 2.0; stroke-dasharray: 5.0,5.0;" x1="2341" x2="2341" y1="172.9766" y2="2752.9258"/><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="112" x="238" y="167.0703">enduser</text><ellipse cx="300" cy="26" fill="#FEFECE" filter="url(#fo9m562hwezv9)" rx="16" ry="16" style="stroke: #A80036; stroke-width: 4.0;"/><path d="M300,42 L300,96 M274,58 L326,58 M300,96 L274,126 M300,96 L326,126 " fill="none" filter="url(#fo9m562hwezv9)" style="stroke: #A80036; stroke-width: 4.0;"/><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="112" x="238" y="2777.9961">enduser</text><ellipse cx="300" cy="2803.9023" fill="#FEFECE" filter="url(#fo9m562hwezv9)" rx="16" ry="16" style="stroke: #A80036; stroke-width: 4.0;"/><path d="M300,2819.9023 L300,2873.9023 M274,2835.9023 L326,2835.9023 M300,2873.9023 L274,2903.9023 M300,2873.9023 L326,2903.9023 " fill="none" filter="url(#fo9m562hwezv9)" style="stroke: #A80036; stroke-width: 4.0;"/><rect fill="#FEFECE" filter="url(#fo9m562hwezv9)" height="93.9531" style="stroke: #A80036; stroke-width: 3.0;" width="342" x="382" y="69.0234"/><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="70" x="518" y="110.0938">app1</text><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="314" x="396" y="143.0703">(id=cluster1:ns1:app1)</text><rect fill="#FEFECE" filter="url(#fo9m562hwezv9)" height="93.9531" style="stroke: #A80036; stroke-width: 3.0;" width="342" x="382" y="2750.9258"/><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="70" x="518" y="2791.9961">app1</text><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="314" x="396" y="2824.9727">(id=cluster1:ns1:app1)</text><rect fill="#FEFECE" filter="url(#fo9m562hwezv9)" height="93.9531" style="stroke: #A80036; stroke-width: 3.0;" width="342" x="996" y="69.0234"/><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="70" x="1132" y="110.0938">app2</text><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="314" x="1010" y="143.0703">(id=cluster1:ns1:app2)</text><rect fill="#FEFECE" filter="url(#fo9m562hwezv9)" height="93.9531" style="stroke: #A80036; stroke-width: 3.0;" width="342" x="996" y="2750.9258"/><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="70" x="1132" y="2791.9961">app2</text><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="314" x="1010" y="2824.9727">(id=cluster1:ns1:app2)</text><rect fill="#FEFECE" filter="url(#fo9m562hwezv9)" height="93.9531" style="stroke: #A80036; stroke-width: 3.0;" width="192" x="1457" y="69.0234"/><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="164" x="1471" y="110.0938">TokenDings</text><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="0" x="1557" y="143.0703"/><rect fill="#FEFECE" filter="url(#fo9m562hwezv9)" height="93.9531" style="stroke: #A80036; stroke-width: 3.0;" width="192" x="1457" y="2750.9258"/><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="164" x="1471" y="2791.9961">TokenDings</text><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="0" x="1557" y="2824.9727"/><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="144" x="2049" y="167.0703">clientstore</text><path d="M2091,68 C2091,48 2127,48 2127,48 C2127,48 2163,48 2163,68 L2163,120 C2163,140 2127,140 2127,140 C2127,140 2091,140 2091,120 L2091,68 " fill="#FEFECE" filter="url(#fo9m562hwezv9)" style="stroke: #000000; stroke-width: 3.0;"/><path d="M2091,68 C2091,88 2127,88 2127,88 C2127,88 2163,88 2163,68 " fill="none" style="stroke: #000000; stroke-width: 3.0;"/><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="144" x="2049" y="2777.9961">clientstore</text><path d="M2091,2803.9023 C2091,2783.9023 2127,2783.9023 2127,2783.9023 C2127,2783.9023 2163,2783.9023 2163,2803.9023 L2163,2855.9023 C2163,2875.9023 2127,2875.9023 2127,2875.9023 C2127,2875.9023 2091,2875.9023 2091,2855.9023 L2091,2803.9023 " fill="#FEFECE" filter="url(#fo9m562hwezv9)" style="stroke: #000000; stroke-width: 3.0;"/><path d="M2091,2803.9023 C2091,2823.9023 2127,2823.9023 2127,2823.9023 C2127,2823.9023 2163,2823.9023 2163,2803.9023 " fill="none" style="stroke: #000000; stroke-width: 3.0;"/><rect fill="#FEFECE" filter="url(#fo9m562hwezv9)" height="93.9531" style="stroke: #A80036; stroke-width: 3.0;" width="224" x="2225" y="69.0234"/><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="142" x="2266" y="110.0938">idprovider</text><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="196" x="2239" y="143.0703">(e.g. IDPorten)</text><rect fill="#FEFECE" filter="url(#fo9m562hwezv9)" height="93.9531" style="stroke: #A80036; stroke-width: 3.0;" width="224" x="2225" y="2750.9258"/><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="142" x="2266" y="2791.9961">idprovider</text><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="196" x="2239" y="2824.9727">(e.g. IDPorten)</text><rect fill="#FFFFFF" filter="url(#fo9m562hwezv9)" height="816.627" style="stroke: #A80036; stroke-width: 2.0;" width="20" x="547" y="192.9766"/><rect fill="#FFFFFF" filter="url(#fo9m562hwezv9)" height="301.7266" style="stroke: #A80036; stroke-width: 2.0;" width="20" x="547" y="1966.8516"/><rect fill="#FFFFFF" filter="url(#fo9m562hwezv9)" height="375.7266" style="stroke: #A80036; stroke-width: 2.0;" width="20" x="1161" y="2268.5781"/><rect fill="#FFFFFF" filter="url(#fo9m562hwezv9)" height="229.7949" style="stroke: #A80036; stroke-width: 2.0;" width="20" x="1547" y="1009.6035"/><rect fill="#FFFFFF" filter="url(#fo9m562hwezv9)" height="208.4844" style="stroke: #A80036; stroke-width: 2.0;" width="20" x="1547" y="1308.0195"/><rect fill="#FFFFFF" filter="url(#fo9m562hwezv9)" height="500.9688" style="stroke: #A80036; stroke-width: 2.0;" width="20" x="1547" y="1575.125"/><rect fill="#FFFFFF" filter="url(#fo9m562hwezv9)" height="58.6211" style="stroke: #A80036; stroke-width: 2.0;" width="20" x="1547" y="2327.1992"/><rect fill="#FFFFFF" filter="url(#fo9m562hwezv9)" height="68.6211" style="stroke: #A80036; stroke-width: 2.0;" width="20" x="2117" y="1239.3984"/><rect fill="#FFFFFF" filter="url(#fo9m562hwezv9)" height="58.6211" style="stroke: #A80036; stroke-width: 2.0;" width="20" x="2117" y="1516.5039"/><rect fill="#FFFFFF" filter="url(#fo9m562hwezv9)" height="58.6211" style="stroke: #A80036; stroke-width: 2.0;" width="20" x="2331" y="1833.6094"/><rect fill="#EEEEEE" filter="url(#fo9m562hwezv9)" height="6" style="stroke: #EEEEEE; stroke-width: 2.0;" width="2491" x="6" y="234.2871"/><line style="stroke: #000000; stroke-width: 2.0;" x1="6" x2="2497" y1="234.2871" y2="234.2871"/><line style="stroke: #000000; stroke-width: 2.0;" x1="6" x2="2497" y1="240.2871" y2="240.2871"/><rect fill="#EEEEEE" filter="url(#fo9m562hwezv9)" height="46.6211" style="stroke: #000000; stroke-width: 4.0;" width="232" x="1135.5" y="212.9766"/><text fill="#000000" font-family="sans-serif" font-size="26" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="196" x="1147.5" y="246.1133">Enduser Login</text><path d="M86,293.5977 L814,293.5977 L814,307.5977 L794,327.5977 L86,327.5977 L86,293.5977 " fill="#EEEEEE" style="stroke: #000000; stroke-width: 2.0;"/><rect fill="none" height="291.7266" style="stroke: #000000; stroke-width: 4.0;" width="2391" x="86" y="293.5977"/><text fill="#000000" font-family="sans-serif" font-size="26" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="638" x="116" y="320.7344">OIDC Authorization Code Flow (simplified view)</text><polygon fill="#A80036" points="523,362.8398,543,370.8398,523,378.8398,531,370.8398" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="300" x2="535" y1="370.8398" y2="370.8398"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="154" x="314" y="361.3555">access app1</text><polygon fill="#A80036" points="2317,421.4609,2337,429.4609,2317,437.4609,2325,429.4609" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="567" x2="2329" y1="429.4609" y2="429.4609"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="166" x="581" y="419.9766">send to login</text><polygon fill="#A80036" points="589,520.7031,569,528.7031,589,536.7031,581,528.7031" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="577" x2="2339" y1="528.7031" y2="528.7031"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="254" x="601" y="519.2188">return access_token</text><path d="M106,455.4609 L106,565.4609 L528,565.4609 L528,475.4609 L508,455.4609 L106,455.4609 " fill="#FBFB77" filter="url(#fo9m562hwezv9)" style="stroke: #A80036; stroke-width: 2.0;"/><path d="M508,455.4609 L508,475.4609 L528,475.4609 L508,455.4609 " fill="#FBFB77" style="stroke: #A80036; stroke-width: 2.0;"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="250" x="118" y="490.5977">iss: "idprovider-url"</text><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="182" x="118" y="521.2188">sub: "enduser"</text><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="380" x="118" y="551.8398">aud: "app1" id from idprovider</text><rect fill="#EEEEEE" filter="url(#fo9m562hwezv9)" height="6" style="stroke: #EEEEEE; stroke-width: 2.0;" width="2491" x="6" y="640.6348"/><line style="stroke: #000000; stroke-width: 2.0;" x1="6" x2="2497" y1="640.6348" y2="640.6348"/><line style="stroke: #000000; stroke-width: 2.0;" x1="6" x2="2497" y1="646.6348" y2="646.6348"/><rect fill="#EEEEEE" filter="url(#fo9m562hwezv9)" height="46.6211" style="stroke: #000000; stroke-width: 4.0;" width="460" x="1021.5" y="619.3242"/><text fill="#000000" font-family="sans-serif" font-size="26" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="432" x="1033.5" y="652.4609">Invoke API on behalf of enduser</text><path d="M24,699.9453 L706,699.9453 L706,713.9453 L686,733.9453 L24,733.9453 L24,699.9453 " fill="#EEEEEE" style="stroke: #000000; stroke-width: 2.0;"/><rect fill="none" height="1432.7695" style="stroke: #000000; stroke-width: 4.0;" width="2453" x="24" y="699.9453"/><text fill="#000000" font-family="sans-serif" font-size="26" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="592" x="54" y="727.082">Get token using OAuth 2.0 Token Exchange</text><line style="stroke: #A80036; stroke-width: 2.0;" x1="567" x2="651" y1="838.4297" y2="838.4297"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="651" x2="651" y1="838.4297" y2="864.4297"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="569" x2="651" y1="864.4297" y2="864.4297"/><polygon fill="#A80036" points="589,856.4297,569,864.4297,589,872.4297,581,864.4297" style="stroke: #A80036; stroke-width: 2.0;"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="268" x="581" y="767.7031">create self signed jwt</text><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="306" x="581" y="798.3242">with keypair from secret</text><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="236" x="581" y="828.9453">as client_assertion</text><path d="M44,747.5664 L44,857.5664 L528,857.5664 L528,767.5664 L508,747.5664 L44,747.5664 " fill="#FBFB77" filter="url(#fo9m562hwezv9)" style="stroke: #A80036; stroke-width: 2.0;"/><path d="M508,747.5664 L508,767.5664 L528,767.5664 L508,747.5664 " fill="#FBFB77" style="stroke: #A80036; stroke-width: 2.0;"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="298" x="56" y="782.7031">iss: "cluster1:ns1:app1"</text><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="308" x="56" y="813.3242">sub: "cluster1:ns1:app1"</text><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="442" x="56" y="843.9453">aud: https://tokendings-url/token</text><polygon fill="#A80036" points="1523,1001.6035,1543,1009.6035,1523,1017.6035,1531,1009.6035" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="557" x2="1535" y1="1009.6035" y2="1009.6035"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="158" x="571" y="1000.1191">POST /token</text><path d="M1576,890.4297 L1576,1092.4297 L2110,1092.4297 L2110,910.4297 L2090,890.4297 L1576,890.4297 " fill="#FBFB77" filter="url(#fo9m562hwezv9)" style="stroke: #A80036; stroke-width: 2.0;"/><path d="M2090,890.4297 L2090,910.4297 L2110,910.4297 L2090,890.4297 " fill="#FBFB77" style="stroke: #A80036; stroke-width: 2.0;"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="492" x="1588" y="925.5664">client_assertion=&lt;..self-signed-jwt..&gt;</text><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="484" x="1588" y="956.1875">client_assertion_type=&lt;..:jwt-bearer&gt;</text><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="426" x="1588" y="986.8086">grant_type=&lt;..:token-exchange&gt;</text><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="486" x="1588" y="1017.4297">subject_token=&lt;..idprovider-token..&gt;</text><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="368" x="1588" y="1048.0508">subject_token_type=&lt;..:jwt&gt;</text><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="358" x="1588" y="1078.6719">audience=cluster1:ns1:app2</text><line style="stroke: #A80036; stroke-width: 2.0;" x1="1567" x2="1651" y1="1154.7773" y2="1154.7773"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1651" x2="1651" y1="1154.7773" y2="1180.7773"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1569" x2="1651" y1="1180.7773" y2="1180.7773"/><polygon fill="#A80036" points="1589,1172.7773,1569,1180.7773,1589,1188.7773,1581,1180.7773" style="stroke: #A80036; stroke-width: 2.0;"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="522" x="1581" y="1145.293">get sub from client_assertion as client_id</text><polygon fill="#A80036" points="2093,1231.3984,2113,1239.3984,2093,1247.3984,2101,1239.3984" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1557" x2="2105" y1="1239.3984" y2="1239.3984"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="356" x="1571" y="1229.9141">get client based on client_id</text><polygon fill="#A80036" points="1589,1300.0195,1569,1308.0195,1589,1316.0195,1581,1308.0195" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1577" x2="2125" y1="1308.0195" y2="1308.0195"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="268" x="1601" y="1298.5352">return client - "app1"</text><path d="M1128,1265.3984 L1128,1315.3984 L1528,1315.3984 L1528,1285.3984 L1508,1265.3984 L1128,1265.3984 " fill="#FBFB77" filter="url(#fo9m562hwezv9)" style="stroke: #A80036; stroke-width: 2.0;"/><path d="M1508,1265.3984 L1508,1285.3984 L1528,1285.3984 L1508,1265.3984 " fill="#FBFB77" style="stroke: #A80036; stroke-width: 2.0;"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="358" x="1140" y="1300.5352">client_id, accesspolicy, jwks</text><line style="stroke: #A80036; stroke-width: 2.0;" x1="1567" x2="1651" y1="1388.9512" y2="1388.9512"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1651" x2="1651" y1="1388.9512" y2="1414.9512"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1569" x2="1651" y1="1414.9512" y2="1414.9512"/><polygon fill="#A80036" points="1589,1406.9512,1569,1414.9512,1589,1422.9512,1581,1414.9512" style="stroke: #A80036; stroke-width: 2.0;"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="278" x="1581" y="1379.4668">verify client_assertion</text><path d="M1040,1344.0195 L1040,1424.0195 L1528,1424.0195 L1528,1364.0195 L1508,1344.0195 L1040,1344.0195 " fill="#FBFB77" filter="url(#fo9m562hwezv9)" style="stroke: #A80036; stroke-width: 2.0;"/><path d="M1508,1344.0195 L1508,1364.0195 L1528,1364.0195 L1508,1344.0195 " fill="#FBFB77" style="stroke: #A80036; stroke-width: 2.0;"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="228" x="1052" y="1379.1563">use retrieved jwks</text><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="446" x="1052" y="1409.7773">aud=https://tokendings-url/token</text><polygon fill="#A80036" points="2093,1508.5039,2113,1516.5039,2093,1524.5039,2101,1516.5039" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1557" x2="2105" y1="1516.5039" y2="1516.5039"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="380" x="1571" y="1476.3984">get client based on "audience"</text><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="214" x="1571" y="1507.0195">(in tokenrequest)</text><polygon fill="#A80036" points="1589,1567.125,1569,1575.125,1589,1583.125,1581,1575.125" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1577" x2="2125" y1="1575.125" y2="1575.125"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="268" x="1601" y="1565.6406">return client - "app2"</text><line style="stroke: #A80036; stroke-width: 2.0;" x1="1567" x2="1651" y1="1633.7461" y2="1633.7461"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1651" x2="1651" y1="1633.7461" y2="1659.7461"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1569" x2="1651" y1="1659.7461" y2="1659.7461"/><polygon fill="#A80036" points="1589,1651.7461,1569,1659.7461,1589,1667.7461,1581,1659.7461" style="stroke: #A80036; stroke-width: 2.0;"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="242" x="1581" y="1624.2617">check accesspolicy</text><path d="M1200,1604.125 L1200,1654.125 L1528,1654.125 L1528,1624.125 L1508,1604.125 L1200,1604.125 " fill="#FBFB77" filter="url(#fo9m562hwezv9)" style="stroke: #A80036; stroke-width: 2.0;"/><path d="M1508,1604.125 L1508,1624.125 L1528,1624.125 L1508,1604.125 " fill="#FBFB77" style="stroke: #A80036; stroke-width: 2.0;"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="286" x="1212" y="1639.2617">can app1 invoke app2?</text><line style="stroke: #A80036; stroke-width: 2.0;" x1="1567" x2="1651" y1="1748.9883" y2="1748.9883"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1651" x2="1651" y1="1748.9883" y2="1774.9883"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1569" x2="1651" y1="1774.9883" y2="1774.9883"/><polygon fill="#A80036" points="1589,1766.9883,1569,1774.9883,1589,1782.9883,1581,1774.9883" style="stroke: #A80036; stroke-width: 2.0;"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="260" x="1581" y="1708.8828">check subject_token</text><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="460" x="1581" y="1739.5039">against list of supported idproviders</text><polygon fill="#A80036" points="2307,1825.6094,2327,1833.6094,2307,1841.6094,2315,1833.6094" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1567" x2="2319" y1="1833.6094" y2="1833.6094"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="336" x="1581" y="1824.125">get jwks for subject_token</text><polygon fill="#A80036" points="1589,1884.2305,1569,1892.2305,1589,1900.2305,1581,1892.2305" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1577" x2="2339" y1="1892.2305" y2="1892.2305"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="142" x="1601" y="1882.7461">return jwks</text><line style="stroke: #A80036; stroke-width: 2.0;" x1="1567" x2="1661" y1="1940.8516" y2="1940.8516"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1661" x2="1661" y1="1940.8516" y2="1966.8516"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1579" x2="1661" y1="1966.8516" y2="1966.8516"/><polygon fill="#A80036" points="1599,1958.8516,1579,1966.8516,1599,1974.8516,1591,1966.8516" style="stroke: #A80036; stroke-width: 2.0;"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="382" x="1591" y="1931.3672">verify subject_token signature</text><polygon fill="#A80036" points="589,2068.0938,569,2076.0938,589,2084.0938,581,2076.0938" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="577" x2="1555" y1="2076.0938" y2="2076.0938"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="856" x="601" y="2066.6094">return token response with new access_token signed by tokendings</text><path d="M178,2002.8516 L178,2112.8516 L528,2112.8516 L528,2022.8516 L508,2002.8516 L178,2002.8516 " fill="#FBFB77" filter="url(#fo9m562hwezv9)" style="stroke: #A80036; stroke-width: 2.0;"/><path d="M508,2002.8516 L508,2022.8516 L528,2022.8516 L508,2002.8516 " fill="#FBFB77" style="stroke: #A80036; stroke-width: 2.0;"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="264" x="190" y="2037.9883">iss: "tokendings-url"</text><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="182" x="190" y="2068.6094">sub: "enduser"</text><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="308" x="190" y="2099.2305">aud: "cluster1:ns1:app2"</text><path d="M218,2160.7148 L698,2160.7148 L698,2174.7148 L678,2194.7148 L218,2194.7148 L218,2160.7148 " fill="#EEEEEE" style="stroke: #000000; stroke-width: 2.0;"/><rect fill="none" height="558.2109" style="stroke: #000000; stroke-width: 4.0;" width="1459" x="218" y="2160.7148"/><text fill="#000000" font-family="sans-serif" font-size="26" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="390" x="248" y="2187.8516">Invoke API with bearer token</text><polygon fill="#A80036" points="1137,2260.5781,1157,2268.5781,1137,2276.5781,1145,2268.5781" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="557" x2="1149" y1="2268.5781" y2="2268.5781"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="234" x="571" y="2228.4727">Invoke API in app2</text><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="556" x="571" y="2259.0938">(with token from tokendings in auth header)</text><polygon fill="#A80036" points="1523,2319.1992,1543,2327.1992,1523,2335.1992,1531,2327.1992" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1181" x2="1535" y1="2327.1992" y2="2327.1992"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="230" x="1195" y="2317.7148">get jwks for token</text><polygon fill="#A80036" points="1203,2377.8203,1183,2385.8203,1203,2393.8203,1195,2385.8203" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1191" x2="1555" y1="2385.8203" y2="2385.8203"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="142" x="1215" y="2376.3359">return jwks</text><line style="stroke: #A80036; stroke-width: 2.0;" x1="1181" x2="1265" y1="2475.0625" y2="2475.0625"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1265" x2="1265" y1="2475.0625" y2="2501.0625"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1183" x2="1265" y1="2501.0625" y2="2501.0625"/><polygon fill="#A80036" points="1203,2493.0625,1183,2501.0625,1203,2509.0625,1195,2501.0625" style="stroke: #A80036; stroke-width: 2.0;"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="150" x="1195" y="2434.957">verify token</text><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="278" x="1195" y="2465.5781">(signature and claims)</text><path d="M726,2430.1309 L726,2480.1309 L1142,2480.1309 L1142,2450.1309 L1122,2430.1309 L726,2430.1309 " fill="#FBFB77" filter="url(#fo9m562hwezv9)" style="stroke: #A80036; stroke-width: 2.0;"/><path d="M1122,2430.1309 L1122,2450.1309 L1142,2450.1309 L1122,2430.1309 " fill="#FBFB77" style="stroke: #A80036; stroke-width: 2.0;"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="374" x="738" y="2465.2676">check aud=cluster1:ns1:app2</text><line style="stroke: #A80036; stroke-width: 2.0;" x1="1181" x2="1265" y1="2559.6836" y2="2559.6836"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1265" x2="1265" y1="2559.6836" y2="2585.6836"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1183" x2="1265" y1="2585.6836" y2="2585.6836"/><polygon fill="#A80036" points="1203,2577.6836,1183,2585.6836,1203,2593.6836,1195,2585.6836" style="stroke: #A80036; stroke-width: 2.0;"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="338" x="1195" y="2550.1992">access controll on enduser</text><polygon fill="#A80036" points="579,2636.3047,559,2644.3047,579,2652.3047,571,2644.3047" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="567" x2="1169" y1="2644.3047" y2="2644.3047"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="198" x="591" y="2634.8203">return response</text><polygon fill="#A80036" points="322,2694.9258,302,2702.9258,322,2710.9258,314,2702.9258" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="310" x2="555" y1="2702.9258" y2="2702.9258"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="198" x="334" y="2693.4414">return response</text><!--MD5=[385f3590a6abc417713b8feb440ab397]
@startuml component
actor enduser as enduser
participant app1 as "app1\n(id=cluster1:ns1:app1)"
participant app2 as "app2\n(id=cluster1:ns1:app2)"
participant tokendings as "TokenDings\n"
database clientstore
participant idprovider as "idprovider\n(e.g. IDPorten)"
==Enduser Login ==
group OIDC Authorization Code Flow (simplified view)
enduser -> app1: access app1
app1 -> idprovider: send to login
idprovider -> app1: return access_token
note left: iss: "idprovider-url"\nsub: "enduser"\naud: "app1" id from idprovider
end
==Invoke API on behalf of enduser==
group Get token using OAuth 2.0 Token Exchange
activate app1
app1 -> app1: create self signed jwt\nwith keypair from secret\nas client_assertion
note left: iss: "cluster1:ns1:app1"\nsub: "cluster1:ns1:app1"\naud: https://tokendings-url/token
app1 -> tokendings: POST /token
note right: client_assertion=<..self-signed-jwt..>\nclient_assertion_type=<..:jwt-bearer>\ngrant_type=<..:token-exchange>\nsubject_token=<..idprovider-token..>\nsubject_token_type=<..:jwt>\naudience=cluster1:ns1:app2
deactivate app1
activate tokendings
tokendings -> tokendings: get sub from client_assertion as client_id
tokendings -> clientstore: get client based on client_id
deactivate tokendings
activate clientstore
clientstore -> tokendings: return client - "app1"
deactivate clientstore
activate tokendings
note left: client_id, accesspolicy, jwks
tokendings -> tokendings: verify client_assertion
note left: use retrieved jwks\naud=https://tokendings-url/token
tokendings -> clientstore: get client based on "audience"\n(in tokenrequest)
deactivate tokendings
activate clientstore
clientstore -> tokendings: return client - "app2"
deactivate clientstore
activate tokendings
tokendings -> tokendings: check accesspolicy
note left: can app1 invoke app2?
tokendings -> tokendings: check subject_token\nagainst list of supported idproviders
tokendings -> idprovider: get jwks for subject_token
activate idprovider
idprovider -> tokendings: return jwks
deactivate idprovider
tokendings -> tokendings: verify subject_token signature
activate app1
tokendings -> app1: return token response with new access_token signed by tokendings
note left: iss: "tokendings-url"\nsub: "enduser"\naud: "cluster1:ns1:app2"
deactivate tokendings
end
group Invoke API with bearer token
app1 -> app2: Invoke API in app2\n(with token from tokendings in auth header)
deactivate app1
activate app2
app2 -> tokendings: get jwks for token
activate tokendings
tokendings -> app2: return jwks
deactivate tokendings
app2 -> app2: verify token\n(signature and claims)
note left: check aud=cluster1:ns1:app2
app2 -> app2: access controll on enduser
app2 -> app1: return response
deactivate app2
app1 -> enduser: return response
end
@enduml

PlantUML version 1.2020.03beta6(Unknown compile time)
(GPL source distribution)
Java Runtime: OpenJDK Runtime Environment
JVM: OpenJDK 64-Bit Server VM
Java Version: 11.0.6+8-b765.25
Operating System: Mac OS X
Default Encoding: UTF-8
Language: nb
Country: NO
--></g></svg>