Authentication Server

sequenceDiagram box User device participant PEP Client participant Browser end participant Authserver participant Keyserver PEP Client->>PEP Client:Generate random Code Verifier <br />and Code Challenge = sha256(code verifier) PEP Client->>Browser:Open https://auth.example.com/auth?<br />client_id=123&redirect_uri=http://127.0.0.1:16515/&<br />code_challenge=<<code_challenge>>&code_challenge_method=S256<br />&response_type=code Browser->>Authserver:GET https://auth.example.com/auth?<br />client_id=123&redirect_uri=http://127.0.0.1:16515/&<br />code_challenge=<<code_challenge>>&code_challenge_method=S256&<br />&response_type=code Note over Browser, Authserver: Authorize the user, e.g. via SURFconext Authserver-->>Browser:Redirect to http://127.0.0.1:16515/?code=<<Authorization code>> Browser->>PEP Client:GET http://127.0.0.1:16515/?code=<<Authorization code>> PEP Client->>Authserver:<<Authorization code>><<Code Verifier>> Authserver->>Authserver:verify:<br />Code Challenge == sha256(Code Verifier) Authserver->>PEP Client:OAuth token containing:<br /><<subject>><<group>><<issued at>><<expires at>><<hmac>> Note over PEP Client, Keyserver: End of OAuth2 Authorization Code flow PEP Client->>PEP Client: Generate CSR containing<br /><<subject>><<group>>User PEP Client->>Keyserver: <<CSR>><<OAuth token>> Keyserver->>Keyserver: verify OAuth token hmac<br />sign certificate Keyserver->>PEP Client: <<certificate>>