diff --git a/images/SM-B_Auth_with_DPoP.png b/images/SM-B_Auth_with_DPoP.png index c3bfa13..6f7f19c 100644 Binary files a/images/SM-B_Auth_with_DPoP.png and b/images/SM-B_Auth_with_DPoP.png differ diff --git a/images/SM-B_Auth_with_DPoP.svg b/images/SM-B_Auth_with_DPoP.svg index d1e5c7f..6a6b315 100644 --- a/images/SM-B_Auth_with_DPoP.svg +++ b/images/SM-B_Auth_with_DPoP.svg @@ -1 +1 @@ -LEIBetreiberZT ClusterTI 2.0 DienstClientKonnektorSM-BPEPAuthorization Serverhttp ProxyPDPResource ServerClientKonnektorSM-BPEPAuthorization Serverhttp ProxyPDPResource Serveralt[01]GET /resource[02]401 Unauthorized; json body with Well-Known json Document[03]GET /.well-known/oauth-authorization-server [04]200 OK; json body with Well-Known json Document[05]generate DPoP keypair[06]GET /nonce[07]return 200 OK new-nonce: nonce[08]create JWT withnonceClient and OS InformationDPoP Thumbprint[09]externalAuthenticate JWT-hash[10]sign JWT-hash[11]JWT-Signature[12]JWT-signature[13]create SM-B signed JWT[14]create DPoP Proof[15]POST /token{SM-B signed JWT}  DPoP: eyJh...  grant_type=authorization_code  code=...  client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer  client_assertion=eyJh....RFC7523 (JWT Client Assertion), RFC9449 (DPoP)[16]verify Client Assertion, DPoP[17]POST /v1/data/authz, json body { "input": {...}}[18]200 OK, json body {"result": {"allow": true, ...}}[19]issue tokens[20]200 OK, access token, refresh token, bound to DPoP[21]Create DPoP Proof for RS[22]GET /resource (access token, DPoP)[23]verify access token andDPoP Binding[24]forward GET /resource(access token, DPoP)[25]provide resource access[26]200 OK, resource[27]200 OK, resource \ No newline at end of file +LEIBetreiberZT ClusterTI 2.0 DienstClientKonnektor orTI-GatewaySM-BPEPAuthorization Serverhttp ProxyPDPResource ServerClientKonnektor orTI-GatewaySM-BPEPAuthorization Serverhttp ProxyPDPResource Serveralt[01]GET /resource[02]401 Unauthorized; json body with Well-Known json Document (RFC8414)[03]GET /.well-known/oauth-authorization-server [04]200 OK; json body with Well-Known json Document (RFC8414)[05]generate DPoP keypair[06]GET /nonce[07]return 200 OK new-nonce: nonce[08]create JWT withnonceClient and OS InformationDPoP Thumbprint[09]externalAuthenticate JWT-hash[10]sign JWT-hash[11]JWT-Signature[12]JWT-signature[13]create SM-B signed JWT[14]create DPoP Proof[15]POST /token{SM-B signed JWT}  DPoP: eyJh...  grant_type=authorization_code  code=...  client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer  client_assertion=eyJh....RFC7523 (JWT Client Assertion), RFC9449 (DPoP)[16]verify Client Assertion, DPoP[17]POST /v1/data/authz, json body { "input": {...}}[18]200 OK, json body {"result": {"allow": true, ...}}[19]issue tokens[20]200 OK, access token, refresh token, bound to DPoP[21]Create DPoP Proof for RS[22]GET /resource (access token, DPoP)[23]verify access token andDPoP Binding[24]forward GET /resource(access token, DPoP)[25]provideresourceaccess[26]200 OK, resource[27]200 OK, resource \ No newline at end of file