doc/client_registration.svg

<?xml version="1.0" encoding="UTF-8" standalone="no"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" contentScriptType="application/ecmascript" contentStyleType="text/css" height="1060px" preserveAspectRatio="none" style="width:2302px;height:1060px;" version="1.1" viewBox="0 0 2302 1060" width="2302px" zoomAndPan="magnify"><defs><filter height="300%" id="f8wllr2e4b06k" width="300%" x="-1" y="-1"><feGaussianBlur result="blurOut" stdDeviation="4.0"/><feColorMatrix in="blurOut" result="blurOut2" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .4 0"/><feOffset dx="8.0" dy="8.0" in="blurOut2" result="blurOut3"/><feBlend in="SourceGraphic" in2="blurOut3" mode="normal"/></filter></defs><g><line style="stroke: #A80036; stroke-width: 2.0; stroke-dasharray: 5.0,5.0;" x1="46" x2="46" y1="172.9766" y2="886.4297"/><line style="stroke: #A80036; stroke-width: 2.0; stroke-dasharray: 5.0,5.0;" x1="150" x2="150" y1="172.9766" y2="886.4297"/><line style="stroke: #A80036; stroke-width: 2.0; stroke-dasharray: 5.0,5.0;" x1="854" x2="854" y1="172.9766" y2="886.4297"/><line style="stroke: #A80036; stroke-width: 2.0; stroke-dasharray: 5.0,5.0;" x1="1008" x2="1008" y1="172.9766" y2="886.4297"/><line style="stroke: #A80036; stroke-width: 2.0; stroke-dasharray: 5.0,5.0;" x1="1200" x2="1200" y1="172.9766" y2="886.4297"/><line style="stroke: #A80036; stroke-width: 2.0; stroke-dasharray: 5.0,5.0;" x1="2139" x2="2139" y1="172.9766" y2="886.4297"/><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="22" x="29" y="167.0703">ci</text><ellipse cx="46" cy="26" fill="#FEFECE" filter="url(#f8wllr2e4b06k)" rx="16" ry="16" style="stroke: #A80036; stroke-width: 4.0;"/><path d="M46,42 L46,96 M20,58 L72,58 M46,96 L20,126 M46,96 L72,126 " fill="none" filter="url(#f8wllr2e4b06k)" style="stroke: #A80036; stroke-width: 4.0;"/><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="22" x="29" y="911.5">ci</text><ellipse cx="46" cy="937.4063" fill="#FEFECE" filter="url(#f8wllr2e4b06k)" rx="16" ry="16" style="stroke: #A80036; stroke-width: 4.0;"/><path d="M46,953.4063 L46,1007.4063 M20,969.4063 L72,969.4063 M46,1007.4063 L20,1037.4063 M46,1007.4063 L72,1037.4063 " fill="none" filter="url(#f8wllr2e4b06k)" style="stroke: #A80036; stroke-width: 4.0;"/><rect fill="#FEFECE" filter="url(#f8wllr2e4b06k)" height="60.9766" style="stroke: #A80036; stroke-width: 3.0;" width="102" x="96" y="102"/><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="74" x="110" y="143.0703">jwker</text><rect fill="#FEFECE" filter="url(#f8wllr2e4b06k)" height="60.9766" style="stroke: #A80036; stroke-width: 3.0;" width="102" x="96" y="884.4297"/><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="74" x="110" y="925.5">jwker</text><rect fill="#FEFECE" filter="url(#f8wllr2e4b06k)" height="60.9766" style="stroke: #A80036; stroke-width: 3.0;" width="94" x="808" y="94"/><rect fill="#FEFECE" filter="url(#f8wllr2e4b06k)" height="60.9766" style="stroke: #A80036; stroke-width: 3.0;" width="94" x="800" y="102"/><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="66" x="814" y="143.0703">apps</text><rect fill="#FEFECE" filter="url(#f8wllr2e4b06k)" height="60.9766" style="stroke: #A80036; stroke-width: 3.0;" width="94" x="808" y="884.4297"/><rect fill="#FEFECE" filter="url(#f8wllr2e4b06k)" height="60.9766" style="stroke: #A80036; stroke-width: 3.0;" width="94" x="800" y="892.4297"/><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="66" x="814" y="933.5">apps</text><rect fill="#FEFECE" filter="url(#f8wllr2e4b06k)" height="60.9766" style="stroke: #A80036; stroke-width: 3.0;" width="148" x="930" y="102"/><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="120" x="944" y="143.0703">azure ad</text><rect fill="#FEFECE" filter="url(#f8wllr2e4b06k)" height="60.9766" style="stroke: #A80036; stroke-width: 3.0;" width="148" x="930" y="884.4297"/><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="120" x="944" y="925.5">azure ad</text><rect fill="#FEFECE" filter="url(#f8wllr2e4b06k)" height="60.9766" style="stroke: #A80036; stroke-width: 3.0;" width="182" x="1106" y="102"/><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="154" x="1120" y="143.0703">tokendings</text><rect fill="#FEFECE" filter="url(#f8wllr2e4b06k)" height="60.9766" style="stroke: #A80036; stroke-width: 3.0;" width="182" x="1106" y="884.4297"/><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="154" x="1120" y="925.5">tokendings</text><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="144" x="2061" y="167.0703">clientstore</text><path d="M2103,68 C2103,48 2139,48 2139,48 C2139,48 2175,48 2175,68 L2175,120 C2175,140 2139,140 2139,140 C2139,140 2103,140 2103,120 L2103,68 " fill="#FEFECE" filter="url(#f8wllr2e4b06k)" style="stroke: #000000; stroke-width: 3.0;"/><path d="M2103,68 C2103,88 2139,88 2139,88 C2139,88 2175,88 2175,68 " fill="none" style="stroke: #000000; stroke-width: 3.0;"/><text fill="#000000" font-family="sans-serif" font-size="28" lengthAdjust="spacingAndGlyphs" textLength="144" x="2061" y="911.5">clientstore</text><path d="M2103,937.4063 C2103,917.4063 2139,917.4063 2139,917.4063 C2139,917.4063 2175,917.4063 2175,937.4063 L2175,989.4063 C2175,1009.4063 2139,1009.4063 2139,1009.4063 C2139,1009.4063 2103,1009.4063 2103,989.4063 L2103,937.4063 " fill="#FEFECE" filter="url(#f8wllr2e4b06k)" style="stroke: #000000; stroke-width: 3.0;"/><path d="M2103,937.4063 C2103,957.4063 2139,957.4063 2139,957.4063 C2139,957.4063 2175,957.4063 2175,937.4063 " fill="none" style="stroke: #000000; stroke-width: 3.0;"/><rect fill="#EEEEEE" filter="url(#f8wllr2e4b06k)" height="6" style="stroke: #EEEEEE; stroke-width: 2.0;" width="2273" x="6" y="234.2871"/><line style="stroke: #000000; stroke-width: 2.0;" x1="6" x2="2279" y1="234.2871" y2="234.2871"/><line style="stroke: #000000; stroke-width: 2.0;" x1="6" x2="2279" y1="240.2871" y2="240.2871"/><rect fill="#EEEEEE" filter="url(#f8wllr2e4b06k)" height="46.6211" style="stroke: #000000; stroke-width: 4.0;" width="278" x="1003.5" y="212.9766"/><text fill="#000000" font-family="sans-serif" font-size="26" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="250" x="1015.5" y="246.1133">Client Registration</text><polygon fill="#A80036" points="831,314.2188,851,322.2188,831,330.2188,839,322.2188" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="46" x2="843" y1="322.2188" y2="322.2188"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="492" x="60" y="312.7344">apply ´application´ resource to cluster</text><polygon fill="#A80036" points="831,372.8398,851,380.8398,831,388.8398,839,380.8398" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="151" x2="843" y1="380.8398" y2="380.8398"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="656" x="165" y="371.3555">Create jwks and k8s secret for application in cluster</text><polygon fill="#A80036" points="984,462.082,1004,470.082,984,478.082,992,470.082" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="151" x2="996" y1="470.082" y2="470.082"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="158" x="165" y="429.9766">POST /token</text><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="438" x="165" y="460.5977">with grant_type=client_credentials</text><path d="M1018,412.1504 L1018,462.1504 L1892,462.1504 L1892,432.1504 L1872,412.1504 L1018,412.1504 " fill="#FBFB77" filter="url(#f8wllr2e4b06k)" style="stroke: #A80036; stroke-width: 2.0;"/><path d="M1872,412.1504 L1872,432.1504 L1892,432.1504 L1872,412.1504 " fill="#FBFB77" style="stroke: #A80036; stroke-width: 2.0;"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="832" x="1030" y="447.2871">retrieve bearer token for scope=api://aad-tokendings-id/.default</text><polygon fill="#A80036" points="173,520.7031,153,528.7031,173,536.7031,165,528.7031" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="161" x2="1006" y1="528.7031" y2="528.7031"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="682" x="185" y="519.2188">return bearer token (jwt) with aud=aad-tokendings-id</text><polygon fill="#A80036" points="1177,609.9453,1197,617.9453,1177,625.9453,1185,617.9453" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="151" x2="1189" y1="617.9453" y2="617.9453"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="316" x="165" y="577.8398">POST /registration/client</text><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="220" x="165" y="608.4609">with bearer token</text><path d="M1210,560.0137 L1210,610.0137 L2250,610.0137 L2250,580.0137 L2230,560.0137 L1210,560.0137 " fill="#FBFB77" filter="url(#f8wllr2e4b06k)" style="stroke: #A80036; stroke-width: 2.0;"/><path d="M2230,560.0137 L2230,580.0137 L2250,580.0137 L2230,560.0137 " fill="#FBFB77" style="stroke: #A80036; stroke-width: 2.0;"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="998" x="1222" y="595.1504">application jwks and signed softwarestatement (client_id, accessPolicy) as json</text><line style="stroke: #A80036; stroke-width: 2.0;" x1="1201" x2="1285" y1="707.1875" y2="707.1875"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1285" x2="1285" y1="707.1875" y2="733.1875"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1203" x2="1285" y1="733.1875" y2="733.1875"/><polygon fill="#A80036" points="1223,725.1875,1203,733.1875,1223,741.1875,1215,733.1875" style="stroke: #A80036; stroke-width: 2.0;"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="608" x="1215" y="667.082">authenticate jwker (access_token from azure ad)</text><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="910" x="1215" y="697.7031">verify signature on softwarestatement (keys loaded as secret on startup)</text><polygon fill="#A80036" points="2115,783.8086,2135,791.8086,2115,799.8086,2123,791.8086" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="1201" x2="2127" y1="791.8086" y2="791.8086"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="838" x="1215" y="782.3242">store as oauth2 client with allowed grant_types and accessPolicies</text><polygon fill="#A80036" points="173,842.4297,153,850.4297,173,858.4297,165,850.4297" style="stroke: #A80036; stroke-width: 2.0;"/><line style="stroke: #A80036; stroke-width: 2.0;" x1="161" x2="1199" y1="850.4297" y2="850.4297"/><text fill="#000000" font-family="sans-serif" font-size="26" lengthAdjust="spacingAndGlyphs" textLength="384" x="185" y="840.9453">return json of registered client</text><!--MD5=[fa7e3be29a59d76cb9fe99c35a3db167]
@startuml component
actor ci as ci
participant jwker as "jwker"
collections apps as "apps"
participant azure as "azure ad"
participant tokendings as "tokendings"
database clientstore

==Client Registration==
ci -> apps : apply ´application´ resource to cluster
jwker -> apps: Create jwks and k8s secret for application in cluster
jwker -> azure: POST /token\nwith grant_type=client_credentials
note right: retrieve bearer token for scope=api://aad-tokendings-id/.default
azure -> jwker: return bearer token (jwt) with aud=aad-tokendings-id
jwker -> tokendings: POST /registration/client\nwith bearer token
note right: application jwks and signed softwarestatement (client_id, accessPolicy) as json
tokendings -> tokendings: authenticate jwker (access_token from azure ad)\nverify signature on softwarestatement (keys loaded as secret on startup)
tokendings -> clientstore: store as oauth2 client with allowed grant_types and accessPolicies
tokendings -> jwker: return json of registered client
@enduml

PlantUML version 1.2020.03beta6(Unknown compile time)
(GPL source distribution)
Java Runtime: OpenJDK Runtime Environment
JVM: OpenJDK 64-Bit Server VM
Java Version: 11.0.6+8-b765.25
Operating System: Mac OS X
Default Encoding: UTF-8
Language: nb
Country: NO
--></g></svg>