diff --git a/docs/diagrams/auth_flow.svg b/docs/diagrams/auth_flow.svg new file mode 100644 index 000000000..e045cb42e --- /dev/null +++ b/docs/diagrams/auth_flow.svg @@ -0,0 +1,878 @@ +Authentication flowuserIDPproductClientawsApiGWvpcdynamoDBparameterStoreKMSoneid-ecs-core 1. Login2. redirect to OneIdentity 3. /login3. /login4: /authorize4: /authorize4.1: retrive key pem file from parameter store4.2: redirect POST4.2: redirect POST5: init SAMLSession record6: perform authentication7: send and perform verification on SAML response7: send and perform verification on SAML response7.1: retrieve certificate data7.2: update SAMLSession and initialize OIDCSession records8: init authorization code flow8.1: send /token POST to init access token session9. init access session and validate state10. Sign JWT10. return JWT + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/docs/diagrams/client_registration.svg b/docs/diagrams/client_registration.svg new file mode 100644 index 000000000..661d0ac6d --- /dev/null +++ b/docs/diagrams/client_registration.svg @@ -0,0 +1,870 @@ +

Legend

+
■ test
+
■
Client Registration FlowproductClientawsApiGWvpcdynamoDBoneid-lambda-client-registration 1. authenticate client via API key2. if authenticated, get client info3. generate clientID and client secret and store it 4. return clientID, client secret and info to client4. return clientID, client secret and info to client1. GET /OIDC/register/{clientID}2. retrieve client data3. return data to Client3. return data to Client + + + + + + + + + + + + + + + + + + + diff --git a/docs/diagrams/icons/KMS.svg b/docs/diagrams/icons/KMS.svg new file mode 100644 index 000000000..94e0a9ecb --- /dev/null +++ b/docs/diagrams/icons/KMS.svg @@ -0,0 +1,18 @@ + + + + Icon-Architecture/48/Arch_AWS-Key-Management-Services_48 + Created with Sketch. + + + + + + + + + + + + + \ No newline at end of file diff --git a/docs/diagrams/icons/apigw.svg b/docs/diagrams/icons/apigw.svg new file mode 100644 index 000000000..196a49756 --- /dev/null +++ b/docs/diagrams/icons/apigw.svg @@ -0,0 +1,18 @@ + + + Icon-Architecture/32/Arch_ Amazon-API-Gateway_32 + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/docs/diagrams/icons/cloudfront.svg b/docs/diagrams/icons/cloudfront.svg new file mode 100644 index 000000000..65d1f7dc6 --- /dev/null +++ b/docs/diagrams/icons/cloudfront.svg @@ -0,0 +1,18 @@ + + + + Icon-Architecture/32/Arch_Amazon-CloudFront_32 + Created with Sketch. + + + + + + + + + + + + + \ No newline at end of file diff --git a/docs/diagrams/icons/dynamo.svg b/docs/diagrams/icons/dynamo.svg new file mode 100644 index 000000000..5a67a3789 --- /dev/null +++ b/docs/diagrams/icons/dynamo.svg @@ -0,0 +1,18 @@ + + + + Icon-Architecture/32/Arch_Amazon-DynamoDB_32 + Created with Sketch. + + + + + + + + + + + + + \ No newline at end of file diff --git a/docs/diagrams/icons/ecs.svg b/docs/diagrams/icons/ecs.svg new file mode 100644 index 000000000..2f2564dd8 --- /dev/null +++ b/docs/diagrams/icons/ecs.svg @@ -0,0 +1,20 @@ + + + + Icon-Architecture/32/Arch_Amazon-Elastic-Container-Service_32 + Created with Sketch. + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/docs/diagrams/icons/github.png b/docs/diagrams/icons/github.png new file mode 100644 index 000000000..d4cfe72b3 Binary files /dev/null and b/docs/diagrams/icons/github.png differ diff --git a/docs/diagrams/icons/lambda.svg b/docs/diagrams/icons/lambda.svg new file mode 100644 index 000000000..77c67f47d --- /dev/null +++ b/docs/diagrams/icons/lambda.svg @@ -0,0 +1,18 @@ + + + + Icon-Architecture/32/Arch_AWS-Lambda_32 + Created with Sketch. + + + + + + + + + + + + + \ No newline at end of file diff --git a/docs/diagrams/icons/pagopa.jpeg b/docs/diagrams/icons/pagopa.jpeg new file mode 100644 index 000000000..cb11ace9c Binary files /dev/null and b/docs/diagrams/icons/pagopa.jpeg differ diff --git a/docs/diagrams/icons/paramstore.svg b/docs/diagrams/icons/paramstore.svg new file mode 100644 index 000000000..cf5597200 --- /dev/null +++ b/docs/diagrams/icons/paramstore.svg @@ -0,0 +1,7 @@ + + + Icon-Resource/Managment-Governance/Res_AWS-System-Manager_Parameter-Store_48_Light + + + + \ No newline at end of file diff --git a/docs/diagrams/icons/s3.svg b/docs/diagrams/icons/s3.svg new file mode 100644 index 000000000..b178e8654 --- /dev/null +++ b/docs/diagrams/icons/s3.svg @@ -0,0 +1,18 @@ + + + Icon-Architecture/32/Arch_Amazon-S3-On-Outposts_Storage_32 + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/docs/diagrams/icons/spid-logo.svg b/docs/diagrams/icons/spid-logo.svg new file mode 100644 index 000000000..c8d1dbdf1 --- /dev/null +++ b/docs/diagrams/icons/spid-logo.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/docs/diagrams/infra.svg b/docs/diagrams/infra.svg new file mode 100644 index 000000000..fc599989a --- /dev/null +++ b/docs/diagrams/infra.svg @@ -0,0 +1,885 @@ +InfrastructureproductClientuseridentityServicesGitHubIDPawsApiGWparameterStoredynamoDBIDPMetadataAssertionsKMSvpconeid-ecs-coreoneid-lambda-client-registrationoneid-service-metadataoneid-lambda-is-gh-integrationoneid-lambda-idp-metadataoneid-lambda-assertion send API Key to request clientID and clientSecret (POST)send API Key to request clientID and clientSecret (POST)generate and store client secretrequest metadata (GET)request metadata (GET) retrieve metadataget SAML assertionsstore SAML assertionsget new IDP metadataopen PR with new IDP metadataupon PR merge, store IDP metadataget IDP metadata from bucket and store it on dbget IDP metadata from bucket and store it on dbclient authenticationclient authenticationget IDP metadatahandle client sessionget privateKey to sign JWT token + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/docs/diagrams/metadata_flow.svg b/docs/diagrams/metadata_flow.svg new file mode 100644 index 000000000..e2c064d5e --- /dev/null +++ b/docs/diagrams/metadata_flow.svg @@ -0,0 +1,860 @@ +service metadata flowuserawsvpcbucketS3cloudfrontdynamoDBoneid-service-metadata 1. send db Event 2. retrieve client metadata3. upate fileretrieve fileretrieve file + + + + + + + + + + + + + + + diff --git a/docs/diagrams/src/auth_flow.d2 b/docs/diagrams/src/auth_flow.d2 new file mode 100644 index 000000000..267943c7a --- /dev/null +++ b/docs/diagrams/src/auth_flow.d2 @@ -0,0 +1,77 @@ +...@classes +vars: { + d2-config: @config.config +} +direction: right + +title: { + class: title + label: Authentication flow +} + +user: { + class: user +} + +IDP: { + class: idpSPID +} + +productClient: { + class: externalCloudService +} + +aws: { + class: aws + ApiGW: { + class: apigw + } + + vpc: { + class: vpc + oneid-ecs-core: { + class: ECS + } + } + + dynamoDB :{ + class: dynamo + } + + parameterStore { + class: parameterStore + } + + KMS: { + class: KMS + } + +} + +user -> productClient: 1. Login + +productClient -> user: 2. redirect to OneIdentity + +user <-> aws.ApiGW <-> aws.vpc.oneid-ecs-core: 3. /login + +user -> aws.ApiGW -> aws.vpc.oneid-ecs-core: 4: /authorize +aws.vpc.oneid-ecs-core -> aws.parameterStore: 4.1: retrive key pem file from parameter store +user <- aws.ApiGW <- aws.vpc.oneid-ecs-core: 4.2: redirect POST + +aws.vpc.oneid-ecs-core -> aws.dynamoDB: 5: init SAMLSession record + + +user <-> IDP: 6: perform authentication + +user -> aws.ApiGW -> aws.vpc.oneid-ecs-core: 7: send and perform verification on SAML response +aws.vpc.oneid-ecs-core -> aws.dynamoDB: 7.1: retrieve certificate data +aws.vpc.oneid-ecs-core -> aws.dynamoDB: 7.2: update SAMLSession and initialize OIDCSession records + +productClient <- aws.vpc.oneid-ecs-core: 8: init authorization code flow +productClient -> aws.vpc.oneid-ecs-core: 8.1: send /token POST to init access token session + +aws.vpc.oneid-ecs-core <-> aws.dynamoDB: 9. init access session and validate state + +aws.vpc.oneid-ecs-core <-> aws.KMS: 10. Sign JWT + +aws.vpc.oneid-ecs-core -> productClient: 10. return JWT diff --git a/docs/diagrams/src/classes.d2 b/docs/diagrams/src/classes.d2 new file mode 100644 index 000000000..34b6bfd47 --- /dev/null +++ b/docs/diagrams/src/classes.d2 @@ -0,0 +1,77 @@ +classes: { + *.label.near: bottom-center + *.style.border-radius: 5 + *.style.fill: transparent + + title: { + near: bottom-center + shape: text + style.font-size: 40 + style.underline: true + } + + externalCloudService: { + icon: https://icons.terrastruct.com/infra%2F022-hosting.svg + } + + user: { + icon: https://raw.githubusercontent.com/FortAwesome/Font-Awesome/6.x/svgs/regular/user.svg + } + + aws: { + label.near: bottom-left + style: { + stroke-dash: 10 + stroke: "#f4a261" + } + } + + vpc: { + label.near: bottom-left + style: { + stroke-dash: 4 + } + } + + apiGW: { + icon: ../icons/apigw.svg} + + lambda: { + icon: ../icons/lambda.svg + } + + ECS: { + icon: ../icons/ecs.svg } + + dynamo: { + icon: ../icons/dynamo.svg + } + + s3: { + icon: ../icons/s3.svg + } + + cloudfront: { + icon: ../icons/cloudfront.svg + } + + KMS: { + icon: ../icons/KMS.svg + } + + idpSPID: { + shape: image + icon: ../icons/spid-logo.svg + } + + parameterStore { + icon: ../icons/paramstore.svg } + + github { + icon: ../icons/github.png + } + + identityServices { + icon: ../icons/pagopa.jpeg + } +} \ No newline at end of file diff --git a/docs/diagrams/src/client_registration.d2 b/docs/diagrams/src/client_registration.d2 new file mode 100644 index 000000000..85628ce1a --- /dev/null +++ b/docs/diagrams/src/client_registration.d2 @@ -0,0 +1,60 @@ +...@classes +vars: { + d2-config: @config.config +} +direction: right +explanation: |md + # Legend +
■ test
+
■
+| { + near: top-left +} + +title: { + class: title + label: Client Registration Flow +} + +productClient: { + class: externalCloudService +} + +aws: { + class: aws + ApiGW: { + class: apigw + } + vpc: { + class: vpc + oneid-lambda-client-registration: { + class: lambda + } + } + dynamoDB :{ + class: dynamo + } +} + +productClient -> aws.ApiGW: 1. authenticate client via API key +aws.ApiGW -> aws.vpc.oneid-lambda-client-registration: 2. if authenticated, get client info +aws.vpc.oneid-lambda-client-registration -> aws.dynamoDB: 3. generate clientID and client secret and store it +productClient <- aws.ApiGW <- aws.vpc.oneid-lambda-client-registration: 4. return clientID, client secret and info to client + +productClient -> aws.ApiGW: 1. GET /OIDC/register/\{clientID\} { + style: { + font-color: green + } +} +aws.vpc.oneid-lambda-client-registration <-> aws.dynamoDB: 2. retrieve client data { + style: { + font-color: green + } +} + +productClient <- aws.ApiGW <- aws.vpc.oneid-lambda-client-registration: 3. return data to Client { + style: { + font-color: green + } +} + diff --git a/docs/diagrams/src/config.d2 b/docs/diagrams/src/config.d2 new file mode 100644 index 000000000..321526591 --- /dev/null +++ b/docs/diagrams/src/config.d2 @@ -0,0 +1,13 @@ +config: { + layout-engine: elk + theme-overrides:{ + N1: "#4C566A" + N2: "#4C566A" + B1: "#5E81AC" + B2: "#81A1C1" + B3: "#81A1C1" + B4: "#81A1C1" + B5: "#81A1C1" + B6: "#88C0D0" + } +} \ No newline at end of file diff --git a/docs/diagrams/src/infra.d2 b/docs/diagrams/src/infra.d2 new file mode 100644 index 000000000..854193206 --- /dev/null +++ b/docs/diagrams/src/infra.d2 @@ -0,0 +1,116 @@ +...@classes +vars: { + d2-config: @config.config +} +direction: right + +title: { + class: title + label: Infrastructure +} + +productClient: { + class: externalCloudService +} + +user: { + class: user +} + +identityServices: { + class: identityServices +} + +GitHub: { + class: github +} + +IDP: { + class: idpSPID +} + +aws: { + class: aws + ApiGW: { + class: apigw + } + + parameterStore: { + class: parameterStore + } + + dynamoDB :{ + class: dynamo + } + + IDPMetadata: { + class: s3 + } + + Assertions: { + class: s3 + } + + KMS: { + class: KMS + } + + vpc: { + class: vpc + + oneid-ecs-core: { + class: ECS + } + + oneid-lambda-client-registration: { + class: lambda + } + oneid-service-metadata: { + class: lambda + } + + oneid-lambda-is-gh-integration: { + class: lambda + } + + oneid-lambda-idp-metadata: { + class: lambda + } + + oneid-lambda-assertion: { + class: lambda + } + } +} + + + +productClient -> aws.ApiGW -> aws.vpc.oneid-lambda-client-registration: send API Key to request clientID and clientSecret (POST) +aws.vpc.oneid-lambda-client-registration -> aws.dynamoDB: generate and store client secret + +user -> aws.ApiGW -> aws.vpc.oneid-service-metadata: request metadata (GET) +aws.vpc.oneid-service-metadata <-> aws.dynamoDB: retrieve metadata + +aws.vpc.oneid-lambda-assertion <-> aws.dynamoDB: get SAML assertions +aws.Assertions <- aws.vpc.oneid-lambda-assertion: store SAML assertions + + +IdentityServices <-> aws.vpc.oneid-lambda-is-gh-integration: get new IDP metadata +github <- aws.vpc.oneid-lambda-is-gh-integration : open PR with new IDP metadata +github -> aws.IDPMetadata: upon PR merge, store IDP metadata +aws.IDPMetadata -> aws.vpc.oneid-lambda-idp-metadata -> aws.dynamoDB : get IDP metadata from bucket and store it on db + +productClient <-> aws.ApiGW <-> aws.vpc.oneid-ecs-core: client authentication +aws.vpc.oneid-ecs-core <-> aws.dynamoDB: get IDP and clients metadata +aws.vpc.oneid-ecs-core <-> aws.dynamoDB: handle client session +aws.vpc.oneid-ecs-core <-> aws.parameterStore: get privateKey to sign JWT token + + + + + + + + + + diff --git a/docs/diagrams/src/metadata_flow.d2 b/docs/diagrams/src/metadata_flow.d2 new file mode 100644 index 000000000..9a0e0f8f5 --- /dev/null +++ b/docs/diagrams/src/metadata_flow.d2 @@ -0,0 +1,44 @@ +...@classes +vars: { + d2-config: @config.config +} + +direction: right + +title: { + label: service metadata flow + class: title +} + +user: { + class: user +} + + +aws: { + class: aws + vpc: { + class: vpc + oneid-service-metadata: { + class: lambda + } + } + + bucketS3: { + class: s3 + } + + cloudfront: { + class: cloudfront + } + + dynamoDB :{ + class: dynamo + } +} + +aws.dynamoDB -> aws.vpc.oneid-service-metadata: 1. send db Event +aws.dynamoDB <-> aws.vpc.oneid-service-metadata: 2. retrieve client metadata +aws.vpc.oneid-service-metadata -> aws.bucketS3: 3. upate file + +user -> aws.Cloudfront -> aws.bucketS3: retrieve file