85 lines
2.2 KiB
Plaintext
85 lines
2.2 KiB
Plaintext
```plaintext
|
||
%% Authentik SSO Strategy (ADR-0028)
|
||
%% Flowchart showing authentication flow stages
|
||
|
||
flowchart TB
|
||
subgraph user["👤 User"]
|
||
browser["Browser"]
|
||
end
|
||
|
||
subgraph ingress["🌐 Ingress"]
|
||
traefik["Envoy Gateway"]
|
||
end
|
||
|
||
subgraph apps["📦 Applications"]
|
||
direction LR
|
||
oidc_app["OIDC Apps<br/>Gitea, Grafana,<br/>ArgoCD, Affine"]
|
||
proxy_app["Proxy Apps<br/>MLflow, Kubeflow"]
|
||
end
|
||
|
||
subgraph authentik["🔐 Authentik"]
|
||
direction TB
|
||
|
||
subgraph components["Components"]
|
||
server["Server<br/>(API)"]
|
||
worker["Worker<br/>(Tasks)"]
|
||
outpost["Outpost<br/>(Proxy Auth)"]
|
||
end
|
||
|
||
subgraph flow["Authentication Flow"]
|
||
direction LR
|
||
f1["1️⃣ Login<br/>Stage"]
|
||
f2["2️⃣ Username<br/>Identification"]
|
||
f3["3️⃣ Password<br/>Validation"]
|
||
f4["4️⃣ MFA<br/>Challenge"]
|
||
f5["5️⃣ Session<br/>Created"]
|
||
end
|
||
|
||
subgraph providers["Providers"]
|
||
oidc_prov["OIDC Provider"]
|
||
proxy_prov["Proxy Provider"]
|
||
end
|
||
end
|
||
|
||
subgraph storage["💾 Storage"]
|
||
redis["Redis<br/>(Cache)"]
|
||
postgres["PostgreSQL<br/>(CNPG)"]
|
||
end
|
||
|
||
%% User flow
|
||
browser --> traefik
|
||
traefik --> apps
|
||
|
||
%% OIDC flow
|
||
oidc_app -->|"Redirect to auth"| server
|
||
server --> flow
|
||
f1 --> f2 --> f3 --> f4 --> f5
|
||
flow --> oidc_prov
|
||
oidc_prov -->|"JWT token"| oidc_app
|
||
|
||
%% Proxy flow
|
||
proxy_app -->|"Forward auth"| outpost
|
||
outpost --> server
|
||
server --> flow
|
||
proxy_prov --> outpost
|
||
|
||
%% Storage
|
||
server --> redis
|
||
server --> postgres
|
||
|
||
classDef user fill:#3498db,color:white
|
||
classDef ingress fill:#f39c12,color:black
|
||
classDef app fill:#27ae60,color:white
|
||
classDef authentik fill:#9b59b6,color:white
|
||
classDef storage fill:#e74c3c,color:white
|
||
classDef flow fill:#1abc9c,color:white
|
||
|
||
class browser user
|
||
class traefik ingress
|
||
class oidc_app,proxy_app app
|
||
class server,worker,outpost,oidc_prov,proxy_prov authentik
|
||
class redis,postgres storage
|
||
class f1,f2,f3,f4,f5 flow
|
||
|
||
```
|