mirror of
https://github.com/opencloud-eu/opencloud.git
synced 2026-01-03 19:00:05 -06:00
97 lines
4.2 KiB
Markdown
97 lines
4.2 KiB
Markdown
---
|
|
title: "Request Flow"
|
|
date: 2020-04-27T16:07:00+01:00
|
|
weight: 45
|
|
geekdocRepo: https://github.com/owncloud/ocis
|
|
geekdocEditPath: edit/master/docs/ocis
|
|
geekdocFilePath: request-flow.md
|
|
---
|
|
|
|
|
|
## Request Flow
|
|
|
|
The following sequence diagram describes the general request flow. It shows where account provisioning and token minting are happening:
|
|
|
|
{{< mermaid class="text-center">}}
|
|
sequenceDiagram
|
|
%% we have comments!! \o/
|
|
participant user as User
|
|
participant client as Client
|
|
participant proxy as ocis-proxy
|
|
participant idp as IdP
|
|
participant accounts as ocis-accounts
|
|
participant ldap as corporate LDAP server
|
|
|
|
user->>+client: What is the content of my home?
|
|
|
|
client->>+proxy: PROPFIND <br> Bearer auth using oidc auth token
|
|
Note over client,proxy: What is in a bearer token? <br> The spec recommends opaque tokens. <br> Treat it as random byte noise.
|
|
Note over client,proxy: the proxy MUST authenticate users <br> using ocis-accounts because it needs <br> to decide where to send the request
|
|
%% Mention introspection endpoint for opaque tokens
|
|
%% konnectd uses jwt, so we can save a request
|
|
%% either way the token can be used to look up the sub and iss of the user
|
|
|
|
%% or is token check enough?
|
|
proxy->>+idp: GET /userinfo
|
|
alt userinfo succeeds
|
|
|
|
idp-->>proxy: 200 OK
|
|
Note over proxy,accounts: Content-Type: application/json<br>{<br>"sub": "248289761001",<br>"name": "Jane Doe",<br>"given_name": "Jane",<br>"family_name": "Doe",<br>"preferred_username": "j.doe",<br>"email": "janedoe@example.com",<br>"picture": "http://example.com/janedoe/me.jpg"<br>}
|
|
%% see: https://openid.net/specs/openid-connect-core-1_0.html#UserInfoResponse
|
|
|
|
else userinfo fails
|
|
|
|
idp-->>-proxy: 401 Unauthorized
|
|
Note over proxy,accounts: WWW-Authenticate: error="invalid_token",<br>error_description="The Access Token expired"
|
|
|
|
proxy-->>client: 401 Unauthorized or <br>302 Found with redirect to idp
|
|
Note over client: start at login flow<br> or refresh the token
|
|
|
|
end
|
|
|
|
proxy->>+accounts: TODO API call to exchange sub@iss with account UUID
|
|
Note over proxy,accounts: does not autoprovision users. They are explicitly provsioned later.
|
|
|
|
alt account exists or has been migrated
|
|
|
|
accounts-->>proxy: existing account UUID
|
|
else account does not exist
|
|
|
|
opt oc10 endpoint is configured
|
|
Note over proxy,oc10: Check if user exists in oc10
|
|
proxy->>+oc10: GET /apps/graphapi/v1.0/users/<uuid>
|
|
opt user exists in oc10
|
|
oc10-->>-proxy: 200
|
|
%% TODO auth using internal token
|
|
proxy->>+oc10: PROPFIND
|
|
Note over proxy,oc10: forward existing bearer auth
|
|
oc10-->>-proxy: Multistatus response
|
|
proxy-->>client: Multistatus response
|
|
client-->>user: List of Files X, Y, Z ...
|
|
end
|
|
end
|
|
|
|
Note over proxy,accounts: provision a new account including displayname, email and sub@iss <br> TODO only if the user is allowed to login, based on group <br> membership in the ldap server
|
|
proxy->>proxy: generate new uuid
|
|
proxy->>+accounts: TODO create account with new generated uuid
|
|
accounts-->>-proxy: OK / error
|
|
|
|
else account has been disabled
|
|
|
|
accounts-->>-proxy: account is disabled
|
|
proxy-->>client: 401 Unauthorized or <br>302 Found with redirect to idp
|
|
Note over client: start at login flow<br> or refresh the token
|
|
|
|
end
|
|
proxy->>proxy: store uuid in context
|
|
|
|
%% what if oc10 does not support a certain request / API
|
|
|
|
proxy->>proxy: mint an internal jwt that includes the UUID and username using revas `x-access-token` header
|
|
proxy->>+reva: PROPFIND <br>Token auth using internal JWT
|
|
reva-->>-proxy: Multistatus response
|
|
proxy-->>-client: Multistatus response
|
|
|
|
client-->>-user: List of Files X, Y, Z ...
|
|
{{< /mermaid >}}
|