From 27e9f08e863e9ca22c1244f3cb24150142571334 Mon Sep 17 00:00:00 2001 From: ertopogo Date: Sun, 22 Feb 2026 19:57:54 +0100 Subject: Application:correction de la visibilité des diagrames de séquence sous flux MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- micro/flux/vk_auth_seq.mmd | 85 +++++++++++++++++++--------------------------- 1 file changed, 34 insertions(+), 51 deletions(-) (limited to 'micro/flux/vk_auth_seq.mmd') diff --git a/micro/flux/vk_auth_seq.mmd b/micro/flux/vk_auth_seq.mmd index d16c485..2002124 100644 --- a/micro/flux/vk_auth_seq.mmd +++ b/micro/flux/vk_auth_seq.mmd @@ -1,95 +1,79 @@ %% Source projet : E:\Dev\Chiruca %% Auth : OIDC Keycloak natif Vikunja, realm chiruca %% Flux : Authorization Code Flow avec Google Identity Brokering + auto-creation compte -%%{init: {'theme': 'base', 'sequence': {'mirrorActors': false}}}%% sequenceDiagram autonumber - box rgb(30, 58, 95) Cote Utilisateur - actor User as Navigateur - end + actor User as Navigateur - box rgb(30, 58, 95) Caddy araucaria .50 - participant Caddy as Caddy
vk.arauco.online
TLS termination - end - - box rgb(30, 74, 46) huitral .22 - Docker Compose - participant VK as Vikunja
:3456 - participant VKDB as PostgreSQL 16
vikunja-db :5432 - end - - box rgb(74, 30, 58) npagnun .35 - participant KC as Keycloak
kc.arauco.online
Realm chiruca - end - - box rgb(42, 58, 74) Google - participant Google as Google OAuth 2.0
accounts.google.com - end + participant Caddy as Caddy araucaria .50 + participant VK as Vikunja :3456 + participant VKDB as PostgreSQL 16 vikunja-db + participant KC as Keycloak npagnun .35 + participant Google as Google OAuth 2.0 Note over User, Google: Flux AuthN - OIDC Authorization Code Flow User ->>+ Caddy: GET https://vk.arauco.online Caddy ->>+ VK: HTTP :3456 VK -->>- Caddy: Page login Vikunja - Caddy -->>- User: Login form + bouton "Se connecter avec Keycloak" + Caddy -->>- User: Login form + bouton Se connecter avec Keycloak - User ->> User: Clic "Se connecter avec Keycloak" + User ->> User: Clic Se connecter avec Keycloak User ->>+ Caddy: GET /auth/openid/keycloak Caddy ->>+ VK: HTTP :3456 - VK ->> VK: Generer state
VIKUNJA_AUTH_OPENID_PROVIDERS_KEYCLOAK_AUTHURL:
kc.arauco.online/realms/chiruca - VK -->>- Caddy: 302 Location: kc.arauco.online/realms/chiruca
/protocol/openid-connect/auth
?client_id=vikunja
&redirect_uri=vk.arauco.online/auth/openid/keycloak
&scope=openid+profile+email
&response_type=code + VK ->> VK: Generer state (authurl kc.arauco.online/realms/chiruca) + VK -->>- Caddy: 302 -> kc.arauco.online/realms/chiruca/.../auth?client_id=vikunja&scope=openid+profile+email Caddy -->>- User: Redirect vers Keycloak User ->>+ KC: GET /realms/chiruca/.../auth - KC -->>- User: Page login Keycloak
(formulaire + bouton Google) + KC -->>- User: Page login Keycloak (formulaire + bouton Google) - User ->> KC: Clic "Login with Google" + User ->> KC: Clic Login with Google - KC ->>+ Google: Redirect OAuth2
accounts.google.com/o/oauth2/auth - User ->> Google: Authentification Gmail
+ consentement scopes - Google -->>- KC: Code + ID Token
(sub, email, name, picture) + KC ->>+ Google: Redirect OAuth2 accounts.google.com + User ->> Google: Authentification Gmail + consentement + Google -->>- KC: Code + ID Token (sub, email, name, picture) - KC ->> KC: Identity Brokering
First Broker Login si nouveau
Creer/lier compte chiruca - KC ->> KC: Attacher roles:
Client vikunja: admin | editor | viewer
Realm: admin | user | gest-taches
Heritage depuis groupe + KC ->> KC: Identity Brokering - First Broker Login si nouveau + KC ->> KC: Creer/lier compte chiruca + KC ->> KC: Attacher roles: vikunja admin|editor|viewer + realm roles + KC ->> KC: Heritage groupes: /admins /equipe-terrain /consultants - KC -->> User: 302 + code authorization
-> vk.arauco.online/auth/openid/keycloak + KC -->> User: 302 + code -> vk.arauco.online/auth/openid/keycloak User ->>+ Caddy: GET /auth/openid/keycloak?code=xxx&state=yyy Caddy ->>+ VK: HTTP :3456 VK ->> VK: Verifier state - VK ->>+ KC: POST /realms/chiruca/protocol/openid-connect/token
{grant_type: authorization_code,
code: xxx, client_id: vikunja,
client_secret: ****} + VK ->>+ KC: POST /realms/chiruca/.../token {code, client_id=vikunja, client_secret} KC -->>- VK: JWT access_token + ID token + refresh_token VK ->> VK: Valider ID token (signature, iss, aud, exp) VK ->> VK: Extraire claims: sub, email, preferred_username alt Premier login OIDC - VK ->> VKDB: INSERT user (auto-creation)
email, username depuis claims + VK ->> VKDB: INSERT user (auto-creation depuis claims) VKDB -->> VK: User cree - Note over VK: Auto-creation compte Vikunja
au premier login OIDC else Utilisateur existant VK ->> VKDB: SELECT user WHERE issuer_id = sub VKDB -->> VK: User existant end - VK ->> VK: Generer JWT interne
(VIKUNJA_SERVICE_JWTSECRET) + VK ->> VK: Generer JWT interne (VIKUNJA_SERVICE_JWTSECRET) VK -->>- Caddy: 200 + Set-Cookie / JWT token Caddy -->>- User: Session Vikunja active - Note over User, Google: AuthZ - Roles Keycloak dans JWT claims + Note over User, KC: AuthZ - Roles Keycloak -> Permissions Vikunja - rect rgb(74, 58, 30) - Note over User, KC: Mapping groupes Keycloak -> permissions Vikunja - Note over KC: /admins -> vk: admin (gestion complete) - Note over KC: /equipe-terrain -> vk: editor (creer/editer taches) - Note over KC: /consultants -> vk: viewer (lecture seule) - end + Note over KC: /admins -> vk: admin (gestion complete) + Note over KC: /equipe-terrain -> vk: editor (creer/editer taches) + Note over KC: /consultants -> vk: viewer (lecture seule) Note over User, VK: Acces API authentifie - User ->>+ Caddy: GET /api/v1/projects
Authorization: Bearer JWT_INTERNE + User ->>+ Caddy: GET /api/v1/projects - Authorization: Bearer JWT Caddy ->>+ VK: HTTP :3456 VK ->> VK: Verify JWT (VIKUNJA_SERVICE_JWTSECRET) VK ->> VKDB: SELECT projects WHERE user has access @@ -97,22 +81,21 @@ sequenceDiagram VK -->>- Caddy: 200 JSON Caddy -->>- User: Liste projets - Note over User, VK: Synchronisation CalDAV / ICS + Note over User, VK: Synchronisation CalDAV - User ->>+ Caddy: PROPFIND /dav/principals/USERNAME/
Authorization: Bearer JWT + User ->>+ Caddy: PROPFIND /dav/principals/USERNAME/ - Authorization: Bearer JWT Caddy ->>+ VK: HTTP :3456 VK ->> VK: Auth CalDAV via JWT - VK ->> VKDB: Calendriers de l'utilisateur + VK ->> VKDB: Calendriers de l utilisateur VKDB -->> VK: Listes + taches VK -->>- Caddy: 207 Multi-Status XML - Caddy -->>- User: Donnees CalDAV + Caddy -->>- User: Donnees CalDAV (sync DAVx5 mobile) Note over User, VK: Integration Home Assistant - participant HA as Home Assistant
ha.arauco.online + participant HA as Home Assistant :8123 - HA ->>+ VK: GET /api/v1/projects/ID/tasks
Authorization: Bearer JWT_HA_SERVICE - VK ->> VK: Auth API token + HA ->>+ VK: GET /api/v1/projects/ID/tasks - Bearer JWT_SERVICE VK ->> VKDB: Taches du projet VKDB -->> VK: Resultats VK -->>- HA: JSON taches -> todo entities HA -- cgit v1.2.3