Page History

hide footbox
autonumber

participant "Browser" as cli
participant "WebUI\n(eg NN UI)" as ui #chartreuse
participant "Knox\nTS/SSO" as sso #chartreuse
participant "SAML\nIdP" as idp
  
activate cli
note right: User/browser makes request to UI without valid token
cli -> ui: /view.GET()
  activate ui
  note right: AuthFilter in UI detectes no/invalid token redirects to KnoxTS/SSO preserving ui-origin-url
  cli <-- ui: redirect302(SSO:/login,ui-origin-url)
  deactivate ui

note right: Browser follows redirect. Knox findfinds no/invalid token,\nredirects to IdP preserving ui-origin-url and ts-origin-url 
cli -> sso: /login.GET()
  activate sso
  note right: Knox forwards request to SAML IdP preserving origin URLs
  cli <-- ui: redirect302(IdP:/login,ui-origin-url,ts-origin-url)
  note right: Knox forwards request to SAML IdP preserving origin URLs
  deactivate sso

note right: "Browser follows redirect"
cli -> idp: /login.GET()
  activate idp
  note right: "SAML IdP presents login form to user"
  cli <-- idp: ok200(form)
  deactivate idp

note right: User provides credentials to IdP via login form
cli -> idp: /login.POST(username,password)
  activate idp
  note right: IdP redirects back to Knox with SAML Bearer token in headers
  cli <-- idp: redirect302(SSO:/login,saml-bearer-token,ts-origin-url)
  deactivate idp

note right: Knox converts SAML Bearer Token to a normalized JWT Bearer Token
cli -> sso: /login.GET(saml-bearer-token,ui-origin-url)
  activate sso
  note right: Knox redirects client back to ui-origin-url with JWT Bearer token in cookie
  cli <-- sso: redirect302(ui-origin-url):jwt-bearer-token-cookie
  deactivate sso

note right: Browser follows redirect to ui-origin-url with JWT Bearer Token in cookie.\nJWT Bearer Token validated by AuthFilter
cli -> ui: /view.GET(jwt-bearer-token-cookie)
  activate ui
  note right: Response returned to client.
  cli <- ui: ok200(response)
  deactivate ui

deactivate cli