Skip to content

Commit e64bbcf

Browse files
rhoerberhoerbe
committed
add sequence diagrams for SAML-to-SAML operation
1 parent b6ec83b commit e64bbcf

9 files changed

+159
-0
lines changed

‎doc/internals/authnrequ_flow.png

200 KB
Loading

‎doc/internals/authnrequ_flow.src

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# Render with https://www.websequencediagrams.com
2+
3+
title SATOSA SAML Authn Request
4+
# v3.4.8
5+
6+
7+
note right of Gunicorn: GET \n/saml2/sso/redirect
8+
Gunicorn->+WsgiApplication\n(SATOSABase): __call__
9+
WsgiApplication\n(SATOSABase)->*Context:
10+
WsgiApplication\n(SATOSABase)->WsgiApplication\n(SATOSABase): unpack_request()\n-> Context.request
11+
12+
WsgiApplication\n(SATOSABase)->+WsgiApplication\n(SATOSABase): run(Context)
13+
WsgiApplication\n(SATOSABase)->WsgiApplication\n(SATOSABase): _load_state(Context)
14+
WsgiApplication\n(SATOSABase)->+ModuleRouter: endpoint_routing(context)
15+
note right of ModuleRouter, SAMLFrontend\n(Frontendmodule): endpoint function=handle_authn_request
16+
ModuleRouter-->-WsgiApplication\n(SATOSABase): endpoint function
17+
18+
WsgiApplication\n(SATOSABase)-->+WsgiApplication\n(SATOSABase): _run_bound_endpoint(\nhandle_authn_request)
19+
WsgiApplication\n(SATOSABase)->+SAMLFrontend\n(Frontendmodule): handle_authn_request
20+
SAMLFrontend\n(Frontendmodule)->+SAMLFrontend\n(Frontendmodule): _handle_authn_request
21+
SAMLFrontend\n(Frontendmodule)->SAMLFrontend\n(Frontendmodule): _create_state_data
22+
SAMLFrontend\n(Frontendmodule)->*InternalData:
23+
SAMLFrontend\n(Frontendmodule)->SAMLFrontend\n(Frontendmodule): _get_approved_attributes
24+
SAMLFrontend\n(Frontendmodule)->+WsgiApplication\n(SATOSABase): auth_req_callback_func
25+
26+
note over ModuleRouter, SAMLBackend
27+
Incorrect notation: Looping over Request Micro Services is in fact a recursive design:
28+
Each microservice calls the next in the list, and the last one calls _auth_req_finish().
29+
end note
30+
loop for all Request Micro Services
31+
WsgiApplication\n(SATOSABase)->+Instances of \nRequestMicroService: process
32+
Instances of \nRequestMicroService->+WsgiApplication\n(SATOSABase): _auth_req_finish
33+
WsgiApplication\n(SATOSABase)->+ModuleRouter:backend_routing
34+
ModuleRouter-->-WsgiApplication\n(SATOSABase): Backend
35+
WsgiApplication\n(SATOSABase)->+SAMLBackend: start_auth
36+
SAMLBackend->+SAMLBackend: authn_request
37+
SAMLBackend->*SeeOther\n(Response):
38+
SAMLBackend-->-SAMLBackend:
39+
SAMLBackend-->-WsgiApplication\n(SATOSABase):
40+
WsgiApplication\n(SATOSABase)-->-Instances of \nRequestMicroService:
41+
Instances of \nRequestMicroService-->-WsgiApplication\n(SATOSABase):
42+
end
43+
WsgiApplication\n(SATOSABase)-->-SAMLFrontend\n(Frontendmodule):
44+
45+
SAMLFrontend\n(Frontendmodule)-->-SAMLFrontend\n(Frontendmodule):
46+
SAMLFrontend\n(Frontendmodule)-->-WsgiApplication\n(SATOSABase):
47+
WsgiApplication\n(SATOSABase)-->-WsgiApplication\n(SATOSABase):
48+
WsgiApplication\n(SATOSABase)->WsgiApplication\n(SATOSABase): _save_state(Context)
49+
WsgiApplication\n(SATOSABase)-->-WsgiApplication\n(SATOSABase):
50+
WsgiApplication\n(SATOSABase)-->-Gunicorn:

‎doc/internals/authnrequ_state.png

50.5 KB
Loading

‎doc/internals/authnresp_flow.png

103 KB
Loading

‎doc/internals/authnresp_flow.src

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# Render with https://www.websequencediagrams.com
2+
3+
title SATOSA SAML Authn Response
4+
# v3.4.8
5+
6+
note right of Gunicorn: GET \nsaml2/acs/post
7+
Gunicorn->*SATOSA_STATE: preceding\nAuthnRequest
8+
Gunicorn->+WsgiApplication\n(SATOSABase): __call__
9+
WsgiApplication\n(SATOSABase)->*Context:
10+
WsgiApplication\n(SATOSABase)->WsgiApplication\n(SATOSABase): unpack_request()
11+
WsgiApplication\n(SATOSABase)->+WsgiApplication\n(SATOSABase): run(Context)
12+
WsgiApplication\n(SATOSABase)->+WsgiApplication\n(SATOSABase): _load_state(Context)
13+
SATOSA_STATE-->WsgiApplication\n(SATOSABase):
14+
WsgiApplication\n(SATOSABase)-->-WsgiApplication\n(SATOSABase):
15+
WsgiApplication\n(SATOSABase)->+ModuleRouter: endpoint_routing(context) -> endpoint
16+
ModuleRouter-->-WsgiApplication\n(SATOSABase): authn_response
17+
18+
WsgiApplication\n(SATOSABase)-->+WsgiApplication\n(SATOSABase): _run_bound_endpoint\n(\authn_response)
19+
WsgiApplication\n(SATOSABase)->+SAMLBackend\n(Backendmodule): authn_response
20+
SAMLBackend\n(Backendmodule)->+SAMLBackend\n(Backendmodule): _translate_response
21+
SAMLBackend\n(Backendmodule)->SAMLBackend\n(Backendmodule): saml2.sigver.\n_check_signature
22+
SAMLBackend\n(Backendmodule)->*InternalData:
23+
SAMLBackend\n(Backendmodule)-->-SAMLBackend\n(Backendmodule):
24+
SAMLBackend\n(Backendmodule)->+WsgiApplication\n(SATOSABase): _auth_resp_callback_func
25+
26+
note over Context, SAMLFrontend
27+
Incorrect notation: Looping over Response Micro Services is in fact a recursive design:
28+
Each microservice calls the next in the list, and the last one calls _handle_authn_response().
29+
end note
30+
loop for all Response Micro Services
31+
WsgiApplication\n(SATOSABase)->+Instances of \nRequestMicroService: process
32+
Instances of \nRequestMicroService->+WsgiApplication\n(SATOSABase): _auth_resp_finish
33+
WsgiApplication\n(SATOSABase)->+ModuleRouter:frontend_routing
34+
ModuleRouter-->-WsgiApplication\n(SATOSABase): Frontend
35+
WsgiApplication\n(SATOSABase)->+SAMLFrontend: handle_authn_response
36+
SAMLFrontend->+SAMLFrontend: _handle_authn_response
37+
SAMLFrontend->SAMLFrontend: load_state
38+
SAMLFrontend->+SAMLFrontend: _get_approved_attributes
39+
SAMLFrontend->+SAMLFrontend: _filter_attributes
40+
SAMLFrontend->*Response:
41+
SAMLFrontend-->-SAMLFrontend:
42+
SAMLFrontend-->-SAMLFrontend: Response
43+
SAMLFrontend-->-WsgiApplication\n(SATOSABase): Response
44+
WsgiApplication\n(SATOSABase)-->-SAMLFrontend: Response
45+
SAMLFrontend-->-WsgiApplication\n(SATOSABase): Response
46+
WsgiApplication\n(SATOSABase)-->-Instances of \nRequestMicroService: Response
47+
Instances of \nRequestMicroService-->-WsgiApplication\n(SATOSABase): Response
48+
end
49+
50+
WsgiApplication\n(SATOSABase)-->-SAMLBackend\n(Backendmodule):
51+
SAMLBackend\n(Backendmodule)-->-WsgiApplication\n(SATOSABase):
52+
WsgiApplication\n(SATOSABase)-->-WsgiApplication\n(SATOSABase):
53+
WsgiApplication\n(SATOSABase)->+WsgiApplication\n(SATOSABase): _save_state(Context)
54+
destroy SATOSA_STATE
55+
WsgiApplication\n(SATOSABase)-->WsgiApplication\n(SATOSABase):
56+
WsgiApplication\n(SATOSABase)-->-Gunicorn:
57+

‎doc/internals/authnresp_state.png

46.3 KB
Loading

‎doc/internals/authnresp_state.src

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Render with https://www.websequencediagrams.com
2+
3+
title SATOSA SAML Authn Response (focus on SATOSA_STATE)
4+
# v3.4.8
5+
6+
note right of Gunicorn: GET \nsaml2/acs/post
7+
Gunicorn->*SATOSA_STATE: preceding\nAuthnRequest
8+
Gunicorn->+WsgiApplication\n(SATOSABase): __call__
9+
WsgiApplication\n(SATOSABase)->*Context:
10+
WsgiApplication\n(SATOSABase)->WsgiApplication\n(SATOSABase): unpack_request()
11+
WsgiApplication\n(SATOSABase)->+WsgiApplication\n(SATOSABase): run(Context)
12+
WsgiApplication\n(SATOSABase)->+WsgiApplication\n(SATOSABase): _load_state(Context)
13+
SATOSA_STATE-->WsgiApplication\n(SATOSABase):
14+
WsgiApplication\n(SATOSABase)-->-WsgiApplication\n(SATOSABase):
15+
16+
WsgiApplication\n(SATOSABase)->+SAMLBackend\n(Backendmodule): authn_response
17+
SAMLBackend\n(Backendmodule)-->-WsgiApplication\n(SATOSABase):
18+
WsgiApplication\n(SATOSABase)->+WsgiApplication\n(SATOSABase): _save_state(Context)
19+
note over WsgiApplication\n(SATOSABase), WsgiApplication\n(SATOSABase)
20+
PR #234 proposes to keep STATOS_STATE \nif CONTEXT_STATE_DELETE
21+
end note
22+
destroy SATOSA_STATE
23+
WsgiApplication\n(SATOSABase)-->WsgiApplication\n(SATOSABase):
24+
WsgiApplication\n(SATOSABase)-->-Gunicorn:
25+
26+
27+
note over A,B: text1
28+
note left of A: text2
29+
note right of A
30+
multiline
31+
text
32+
end note

‎doc/internals/init_sequence.png

51.2 KB
Loading

‎doc/internals/init_sequence.src

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Render with https://www.websequencediagrams.com
2+
3+
title SATOSA Initialization Sequence
4+
# v3.4.8
5+
6+
wsgi.py->*SATOSAConfig:
7+
wsgi.py->*WsgiApplication\n(SATOSABase): proxy_server.\nmake_app(SATOSAConfig)
8+
WsgiApplication\n(SATOSABase)->+plugin_loader: load_backends(SATOSAConfig, \n_auth_resp_callback_func, internal_attributes)
9+
plugin_loader->*SAMLBackend:
10+
plugin_loader-->-WsgiApplication\n(SATOSABase):
11+
WsgiApplication\n(SATOSABase)->+plugin_loader: load_frontends()
12+
plugin_loader->*SAMLFrontend:
13+
plugin_loader-->-WsgiApplication\n(SATOSABase):
14+
WsgiApplication\n(SATOSABase)->+plugin_loader: load_request_microservices()
15+
plugin_loader->*RequestMicroservice:
16+
plugin_loader-->-WsgiApplication\n(SATOSABase):
17+
WsgiApplication\n(SATOSABase)->+plugin_loader: load_response_microservices()
18+
plugin_loader->*ResponseMicroservice:
19+
plugin_loader-->-WsgiApplication\n(SATOSABase):
20+
WsgiApplication\n(SATOSABase)->*ModuleRouter:

0 commit comments

Comments
 (0)