From ba9520baa8bd0579b0fde04430411073357135f6 Mon Sep 17 00:00:00 2001 From: TommasoLencioni Date: Tue, 26 Mar 2024 12:11:35 +0100 Subject: [PATCH 1/5] Generate images with PlantUML JAR --- .github/workflows/plantUML.yaml | 50 +++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 .github/workflows/plantUML.yaml diff --git a/.github/workflows/plantUML.yaml b/.github/workflows/plantUML.yaml new file mode 100644 index 00000000..2dec4069 --- /dev/null +++ b/.github/workflows/plantUML.yaml @@ -0,0 +1,50 @@ +name: Generate PlantUML Diagrams + +on: + pull_request: + types: + - closed + branches: + - main + - v2 + +jobs: + generate_diagrams: + if: github.event.pull_request.merged == true + + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v2 + + - name: Set up Java + uses: actions/setup-java@v2 + with: + distribution: 'adopt' + java-version: '11' + + - name: Install Graphviz + run: | + apt-get update -q + apt-get install -y graphviz wget + + - name: Download PlantUML + run: | + wget https://sourceforge.net/projects/plantuml/files/plantuml.jar/download -O plantuml.jar + + - name: Generate Diagrams + run: | + for file in $(find ./src/site -type f -name "MAIN_*.puml"); do + java -jar plantuml.jar "$file" -tsvg + done + + - name: Commit and push changes + run: | + git config user.name "GitHub Workflow" + git config user.email "<>" + for file in $(find ./src/site -type f -name "*.svg"); do + git add "$file" + done + git commit -m "PlantUML images updated" + git push origin ${{ github.ref_name }} From 81faf94016bf405d1245162248b188db69e51b23 Mon Sep 17 00:00:00 2001 From: TommasoLencioni Date: Wed, 22 May 2024 14:57:02 +0200 Subject: [PATCH 2/5] test trigger --- .github/workflows/plantUML.yaml | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/.github/workflows/plantUML.yaml b/.github/workflows/plantUML.yaml index 2dec4069..f36276cb 100644 --- a/.github/workflows/plantUML.yaml +++ b/.github/workflows/plantUML.yaml @@ -1,12 +1,14 @@ name: Generate PlantUML Diagrams on: - pull_request: - types: - - closed - branches: - - main - - v2 +# pull_request: +# types: +# - closed +# branches: +# - main +# - v2 + push: + branches: [ MCIL-115-automate-diagrams-creation-with-plantuml ] jobs: generate_diagrams: From def15467a838574f688d0f73647d9a2196e26910 Mon Sep 17 00:00:00 2001 From: TommasoLencioni Date: Wed, 22 May 2024 14:58:28 +0200 Subject: [PATCH 3/5] test trigger condition --- .github/workflows/plantUML.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/plantUML.yaml b/.github/workflows/plantUML.yaml index f36276cb..5e40f76e 100644 --- a/.github/workflows/plantUML.yaml +++ b/.github/workflows/plantUML.yaml @@ -12,7 +12,7 @@ on: jobs: generate_diagrams: - if: github.event.pull_request.merged == true +# if: github.event.pull_request.merged == true runs-on: ubuntu-latest From 410751b2307f48ea6b6fec536f3fea73e01cc5ca Mon Sep 17 00:00:00 2001 From: TommasoLencioni Date: Wed, 22 May 2024 15:04:30 +0200 Subject: [PATCH 4/5] fix update and install command --- .github/workflows/plantUML.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/plantUML.yaml b/.github/workflows/plantUML.yaml index 5e40f76e..ed4bb91e 100644 --- a/.github/workflows/plantUML.yaml +++ b/.github/workflows/plantUML.yaml @@ -28,8 +28,7 @@ jobs: - name: Install Graphviz run: | - apt-get update -q - apt-get install -y graphviz wget + sudo apt-get update && sudo apt-get install -y graphviz wget - name: Download PlantUML run: | From 9dfd5aac7ca632f7ee2f1a4c10f0aaa512cdcaa4 Mon Sep 17 00:00:00 2001 From: GitHub Workflow <> Date: Wed, 22 May 2024 13:05:25 +0000 Subject: [PATCH 5/5] PlantUML images updated --- src/site/puml/atm/MAIN__atm__request_tokens.svg | 1 + src/site/puml/atm/MAIN__atm__request_tokens__SIMPLE.svg | 1 + src/site/puml/common/MAIN__retrieve_key_to_sign_tokens.svg | 1 + src/site/puml/introspect/MAIN__other__introspect.svg | 1 + src/site/puml/other/MAIN__other__request_tokens.svg | 1 + src/site/puml/pos/MAIN__pos_activation__device_authorization.svg | 1 + src/site/puml/pos/MAIN__pos_activation__refresh_tokens.svg | 1 + .../puml/pos/MAIN__pos_activation__refresh_tokens__SIMPLE.svg | 1 + src/site/puml/pos/MAIN__pos_activation__request_device_code.svg | 1 + .../pos/MAIN__pos_activation__request_device_code__SIMPLE.svg | 1 + src/site/puml/pos/MAIN__pos_activation__request_tokens.svg | 1 + .../puml/pos/MAIN__pos_activation__request_tokens__SIMPLE.svg | 1 + 12 files changed, 12 insertions(+) create mode 100644 src/site/puml/atm/MAIN__atm__request_tokens.svg create mode 100644 src/site/puml/atm/MAIN__atm__request_tokens__SIMPLE.svg create mode 100644 src/site/puml/common/MAIN__retrieve_key_to_sign_tokens.svg create mode 100644 src/site/puml/introspect/MAIN__other__introspect.svg create mode 100644 src/site/puml/other/MAIN__other__request_tokens.svg create mode 100644 src/site/puml/pos/MAIN__pos_activation__device_authorization.svg create mode 100644 src/site/puml/pos/MAIN__pos_activation__refresh_tokens.svg create mode 100644 src/site/puml/pos/MAIN__pos_activation__refresh_tokens__SIMPLE.svg create mode 100644 src/site/puml/pos/MAIN__pos_activation__request_device_code.svg create mode 100644 src/site/puml/pos/MAIN__pos_activation__request_device_code__SIMPLE.svg create mode 100644 src/site/puml/pos/MAIN__pos_activation__request_tokens.svg create mode 100644 src/site/puml/pos/MAIN__pos_activation__request_tokens__SIMPLE.svg diff --git a/src/site/puml/atm/MAIN__atm__request_tokens.svg b/src/site/puml/atm/MAIN__atm__request_tokens.svg new file mode 100644 index 00000000..34f9ab6b --- /dev/null +++ b/src/site/puml/atm/MAIN__atm__request_tokens.svg @@ -0,0 +1 @@ +ATM Layermil-authAzure ActiveDirectoryAzure StorageAccountAzure KeyVaultPersonal DataVault1POST /tokenRequestId:<request id>headergrant_type=client_credentials&client_id=<client id>&client_secret=<client secret>&bank_id=<bank id>&terminal_id=<terminal id>&user_code=<user code>bodyIt's optional.<user code>verify client idget azure access token2GET${IDENTITY_ENDPOINT}?api-version=2019-08-01&resource=https://storage.azure.comx-identity-header:${IDENTITY_HEADER}header3HTTP 200 (ok){"token_type": "Bearer","expires_on":don't care,"client_id": "don't care","resource": "don't care""access_token": "<access token for storage account>"}bodyOn any failure, return HTTP 500 (server error) with specific error body.get client id file4GET <storage account baseurl>/clients/<client id>.jsonx-ms-version: 2019-07-07Authorization: Bearer<access token for storage account>header5HTTP 200 (ok){"id": "<client id>","channel": "ATM","grantTypes": ["client_credentials"],"salt": "<salt>","secretHash": "<secret hash>","secretExp":<secret expiration unix epoch>}bodyOn<client id>file not found, return HTTP 401 (unauthorized) with specific error body.On any other failure, return HTTP 500 (server error) with specific error body.6verify channel and grant typesOn channel or grant type mismatch, return HTTP 401 (unauthorized) with specific error body.verify client secret7verify secret is not expired<secret expiration unix epoch>><current unix epoch>On secret expired, return HTTP 401 (unauthorized) with specific error body.8verify secret matchingOn secret mismatch, return HTTP 401 (unauthorized) with specific error body.get rolesget azure access token9GET${IDENTITY_ENDPOINT}?api-version=2019-08-01&resource=https://storage.azure.comx-identity-header:${IDENTITY_HEADER}header10HTTP 200 (ok){"token_type": "Bearer","expires_on":don't care,"client_id": "don't care","resource": "don't care""access_token": "<access token for storage account>"}bodyOn any failure, return HTTP 500 (server error) with specific error body.11GET <storage account baseurl>/atms/<bankid>/<terminal id>/roles.jsonx-ms-version: 2019-07-07Authorization: Bearer<access token for storage account>header12HTTP 200 (ok){"roles": [<array of roles>]}bodyOn any other failure, return HTTP 500 (server error) with specific error body.opt[/atms/<bank id>/<terminal id>/roles.json not found]13GET <storage account baseurl>/atms/<bankid>/roles.jsonx-ms-version: 2019-07-07Authorization: Bearer<access token for storage account>header14HTTP 200 (ok){"roles": [<array of roles>]}bodyOn any other failure, return HTTP 500 (server error) with specific error body.opt[/atms/<bank id>//roles.json not found]15GET <storage account baseurl>/atms/roles.jsonx-ms-version: 2019-07-07Authorization: Bearer<access token for storage account>header16HTTP 200 (ok){"roles": [<array of roles>]}bodyOn file not found, return HTTP 401 (unauthorized) with specific error body.On any other failure, return HTTP 500 (server error) with specific error body.opt[<user code>!= null]protect user code17PUT /tokenizer/v1/tokensx-api-key:<pdv api-key>header{"pii": "<user code>"}body18 {"token": "<token of user code>"}On any failure, return HTTP 500 (server error) with specific error body.build access token payload19generate <access tokenpayload>{"sub": "<bank id>||<terminal id>","aud": "mil.pagopa.it","iss": "https://<host name>/mil-auth","iat":<issue unix epoch>,"exp":<expiration unix epoch>,"channel": "ATM","bankId": "<bank id>","terminalId": "<terminal id>","userCodeToken": "<token of user code>","groups": [<array of roles>]}<access token payload>retrieve key to sign tokensSee MAIN__retrieve_key_to_sign_tokens.pumlbuild tokens header20generate <token header>{"kid": "<key name>/<key version>","alg": "RS256"}<token header>sign access token21generate <string to sign foraccess token>base64url(sha256(utf8(base64url(<token header>) +"." +base64url(<access token payload>))))<string to sign for access token>22POST POST <key vault baseurl>/keys/<key name>/<keyversion>/sign?api-version=7.4Authorization: Bearer<access token for key vault>header{"alg": "RS256","value": "<string to sign for access token>"}body23HTTP 200 (ok){"kid": "<key vault base url>/keys/<key name>/<key version>","value": "<base64url of access token signature>"}bodyOn any failure, return HTTP 500 (server error) with specific error body.24<access token> =base64url(<token header>) +"." +  base64url(<access tokenpayload>) + "." + <base64urlof access token signature>25HTTP 200 (ok){"access_token": "<access token>","refresh_token": "<refresh token>","token_type": "Bearer","expires_in":<access token duration>} \ No newline at end of file diff --git a/src/site/puml/atm/MAIN__atm__request_tokens__SIMPLE.svg b/src/site/puml/atm/MAIN__atm__request_tokens__SIMPLE.svg new file mode 100644 index 00000000..0e53566e --- /dev/null +++ b/src/site/puml/atm/MAIN__atm__request_tokens__SIMPLE.svg @@ -0,0 +1 @@ +ATM Layermil-auth1POST /tokenRequestId:<request id>headergrant_type=client_credentials&client_id=<client id>&client_secret=<client secret>&bank_id=<bank id>&terminal_id=<terminal id>&user_code=<user code>bodyIt's optional.<user code>2HTTP 200 (ok){"access_token": "<access token>","refresh_token": "<refresh token>","token_type": "Bearer","expires_in":<access token duration>} \ No newline at end of file diff --git a/src/site/puml/common/MAIN__retrieve_key_to_sign_tokens.svg b/src/site/puml/common/MAIN__retrieve_key_to_sign_tokens.svg new file mode 100644 index 00000000..ba72f8f8 --- /dev/null +++ b/src/site/puml/common/MAIN__retrieve_key_to_sign_tokens.svg @@ -0,0 +1 @@ +mil-authAzure ActiveDirectoryAzure KeyVaultretrieve key to sign tokensget valid keysget azure access token1GET${IDENTITY_ENDPOINT}?api-version=2019-08-01&resource=https://vault.azure.netx-identity-header:${IDENTITY_HEADER}header2HTTP 200 (ok){"token_type": "Bearer","expires_on":don't care,"client_id": "don't care","resource": "don't care""access_token": "<access token for key vault>"}bodyOn any failure, return HTTP 500 (server error) with specific error body.get keys3GET <key vault baseurl>/keys?api-version=7.4Authorization: Bearer<access token for key vault>header4HTTP 200 (ok){"value": [{"kid": "<key vault base url>/keys/<key name>","attributes": {"enabled":<enabled>,"nbf":<not before>,"exp":<expiration>,"created":<issued at>}},...]}bodyOn any failure, return HTTP 500 (server error) with specific error body.loop[for each key]get key versions5GET <key vault baseurl>/keys/<keyname>/versions?api-version=7.4Authorization: Bearer<access token for key vault>header6HTTP 200 (ok){"value": [{"kid": "<key vault base url>/keys/<key name>/<key version>","attributes": {"enabled":<enabled>,"nbf":<not before>,"exp":<expiration>,"created":<issued at>}},...]}bodyOn any failure, return HTTP 500 (server error) with specific error body.loop[for each key version]7verify key version validity<enabled>== true &&<not before><<current unix epoch>&&<expiration>><current unix epoch>&&<issued at><=<current unix epoch>alt[valid key version][not valid key verion]get key version details8GET <key vault baseurl>/keys/<key name>/<keyversion>?api-version=7.4Authorization: Bearer<access token for key vault>header9HTTP 200 (ok){"key": {"kid": "<key vault base url>/keys/<key name>/<key version>","kty": "<key type>","key_ops": [<key ops array>],"n": "<modulus>","e": "<public exponent>"},"attributes": {"enabled":<enabled>,"nbf":<not before>,"exp":<expiration>,"created":<issued at>}}bodyOn any failure, return HTTP 500 (server error) with specific error body.10verify key version validity<enabled>== true &&<not before><<current unix epoch>&&<expiration>><current unix epoch>&&<issued at><=<current unix epoch>&&<key type>== "RSA" &&<key ops array>contains "sign" and "verify"alt[valid key version][not valid key version]11add key version to valid key list12discard key version13discard key versionHere the list of valid keys.alt[there are no valid key][there are valid keys]create new key14generate <key name>15POST <key vault baseurl>/keys/<keyname>/create?api-version=7.4Authorization: Bearer<access token for key vault>header{"kty": "RSA","key_size": 4096, This must be a conf. par."key_ops": ["sign","verify"],"attributes": {"created":<current unix epoch>,"exp":<current unix epoch>+ 86400, This must be a conf. par."nbf":<current unix epoch>,"updated":<current unix epoch>,"enabled": true,"recoveryLevel": "Purgeable","exportable": false}}body16HTTP 200 (ok){"key": {"kid": "<key vault base url>/keys/<key name>/<key version>","kty": "<key type>","key_ops": [<key ops array>],"n": "<modulus>","e": "<public exponent>"},"attributes": {"enabled":<enabled>,"nbf":<not before>,"exp":<expiration>,"created":<issued at>}}bodyOn any failure, return HTTP 500 (server error) with specific error body.17verify key version validity<enabled>== true &&<not before><<current unix epoch>&&<expiration>><current unix epoch>&&<issued at><=<current unix epoch>&&<key type>== "RSA" &&<key ops array>contains "sign" and "verify"On verification failure, return HTTP 500 (server error) with specific error body.18search the key with greatestexpirationHere thekeyto use to sign the tokens.{"kid": "<key name>/<key version>","iat":<issued at>,"exp":<expiration>,"use": "sig","kty": "RSA","n": "<modulus>","e": "<public exponent>"}key \ No newline at end of file diff --git a/src/site/puml/introspect/MAIN__other__introspect.svg b/src/site/puml/introspect/MAIN__other__introspect.svg new file mode 100644 index 00000000..d51b6955 --- /dev/null +++ b/src/site/puml/introspect/MAIN__other__introspect.svg @@ -0,0 +1 @@ +Other ServerAppmil-authAzure ActiveDirectoryAzure KeyVaultPersonal DataVault1POST /token_infoRequestId:<request id>Authorization: Bearer<access token>headertoken=<token to introspect>bodybase64url(<access token header>) + "." +base64url(<access token payload>) + "." +<base64url of access token signature><access token>{"sub": "<subject id>","aud": "mil.pagopa.it","iss": "https://<host name>/mil-auth","iat":<issue unix epoch>,"exp":<expiration unix epoch>,"channel": "<channel>","groups": ["atm_access_token_introspector"]}<access token payload>base64url(<header of token to introspect>) + "." +base64url(<payload of token to introspect>) + "." +<base64url of signature of token to introspect><token to introspect>{"kid": "<key name>/<key version>","alg": "RS256"}<header of token to introspect>{"sub": "<bank id>||<terminal id>","aud": "mil.pagopa.it","iss": "https://<host name>/mil-auth","iat":<issue unix epoch>,"exp":<expiration unix epoch>,"channel": "ATM","bankId": "<bank id>","terminalId": "<terminal id>","userCodeToken": "<token of user code>","groups": [<array of roles>]}<payload of token to introspect>2verify header validity"alg" == "RS256"On verification failure, return HTTP 403 (forbidden) with specific error body.3verify payload validity<issue unix epoch><<current unix epoch>&&<expiration unix epoch>><current unix epoch>&&"channel" == "ATM"On verification failure, return HTTP 403 (forbidden) with specific error body.get azure access token4GET${IDENTITY_ENDPOINT}?api-version=2019-08-01&resource=https://vault.azure.netx-identity-header:${IDENTITY_HEADER}header5HTTP 200 (ok){"token_type": "Bearer","expires_on":don't care,"client_id": "don't care","resource": "don't care""access_token": "<access token for key vault>"}bodyOn any failure, return HTTP 500 (server error) with specific error body.6generate <string to verifytoken>base64url(sha256(utf8(base64url(<header of token to introspect>) +"." +base64url(<payload of token to introspect>))))<string to verify token>7POST <key vault baseurl>/keys/<key name>/<keyversion>/verify?api-version=7.4Authorization: Bearer<access token for key vault>header{"alg": "RS256","value": "<string to verify token>","digest": "<base64url of signature of token to introspect>"}body8HTTP 200 (ok){"value": true}bodyOn "value" == false in the response body, return HTTP 403 (forbidden) with specific error body.On any other failure, return HTTP 500 (server error) with specific error body.alt[<token of user code>!= null][<token of user code>== null]9GET/tokenizer/v1/tokens/<token ofuser code>/piix-api-key:<pdv api-key>header10HTTP 200 (ok){"pii": "<user code>"}On any failure, return HTTP 500 (server error) with specific error body.11HTTP 200 (ok){"userCode": "<user code>"}body12HTTP 204 (no content) \ No newline at end of file diff --git a/src/site/puml/other/MAIN__other__request_tokens.svg b/src/site/puml/other/MAIN__other__request_tokens.svg new file mode 100644 index 00000000..5e8b39c6 --- /dev/null +++ b/src/site/puml/other/MAIN__other__request_tokens.svg @@ -0,0 +1 @@ +Other ServerAppmil-authAzure ActiveDirectoryAzure StorageAccountAzure KeyVault1POST /tokenRequestId:<request id>headergrant_type=client_credentials&client_id=<client id>&client_secret=<client secret>bodyverify client idget azure access token2GET${IDENTITY_ENDPOINT}?api-version=2019-08-01&resource=https://storage.azure.comx-identity-header:${IDENTITY_HEADER}header3HTTP 200 (ok){"token_type": "Bearer","expires_on":don't care,"client_id": "don't care","resource": "don't care""access_token": "<access token for storage account>"}bodyOn any failure, return HTTP 500 (server error) with specific error body.get client id file4GET <storage account baseurl>/clients/<client id>.jsonx-ms-version: 2019-07-07Authorization: Bearer<access token for storage account>header5HTTP 200 (ok){"id": "<client id>","channel": "<channel>","grantTypes": ["client_credentials"],"sub": "<subject id>","salt": "<salt>","secretHash": "<secret hash>","secretExp":<secret expiration unix epoch>}bodyOn<client id>file not found, return HTTP 401 (unauthorized) with specific error body.On any other failure, return HTTP 500 (server error) with specific error body.verify client secret6verify secret is not expired<secret expiration unix epoch>><current unix epoch>On secret expired, return HTTP 401 (unauthorized) with specific error body.7verify secret matchingOn secret mismatch, return HTTP 401 (unauthorized) with specific error body.get rolesget azure access token8GET${IDENTITY_ENDPOINT}?api-version=2019-08-01&resource=https://storage.azure.comx-identity-header:${IDENTITY_HEADER}header9HTTP 200 (ok){"token_type": "Bearer","expires_on":don't care,"client_id": "don't care","resource": "don't care""access_token": "<access token for storage account>"}bodyOn any failure, return HTTP 500 (server error) with specific error body.x-ms-version: 2019-07-07Authorization: Bearer<access token for storage account>headeralt[<channel>== POS_SERVICE_PROVIDER][<channel>== PUBLIC_ADMINISTRATION][<channel>== MIL][<channel>== SERVER]10GET <storage account baseurl>/pos_service_providers/<serviceprovider id>.json11GET <storage account baseurl>/public_administrations/<payeecode>.json12GET <storage account baseurl>/mil_services/<microservice>.json13GET <storage account baseurl>/servers/<client id>.json14HTTP 200 (ok){"roles": [<array of roles>]}bodyOn file not found, return HTTP 401 (unauthorized) with specific error body.On any other failure, return HTTP 500 (server error) with specific error body.build access token payload15generate <access tokenpayload>{"sub": "<subject id>","aud": "mil.pagopa.it","iss": "https://<host name>/mil-auth","iat":<issue unix epoch>,"exp":<expiration unix epoch>,"channel": "<channel>","groups": [<array of roles>]}<access token payload>retrieve key to sign tokensSee MAIN__retrieve_key_to_sign_tokens.pumlbuild tokens header16generate <token header>{"kid": "<key name>/<key version>","alg": "RS256"}<token header>sign access token17generate <string to sign foraccess token>base64url(sha256(utf8(base64url(<token header>) +"." +base64url(<access token payload>))))<string to sign for access token>18POST POST <key vault baseurl>/keys/<key name>/<keyversion>/sign?api-version=7.4Authorization: Bearer<access token for key vault>header{"alg": "RS256","value": "<string to sign for access token>"}body19HTTP 200 (ok){"kid": "<key vault base url>/keys/<key name>/<key version>","value": "<base64url of access token signature>"}bodyOn any failure, return HTTP 500 (server error) with specific error body.20<access token> =base64url(<token header>) +"." +  base64url(<access tokenpayload>) + "." + <base64urlof access token signature>21HTTP 200 (ok){"access_token": "<access token>","refresh_token": "<refresh token>","token_type": "Bearer","expires_in":<access token duration>} \ No newline at end of file diff --git a/src/site/puml/pos/MAIN__pos_activation__device_authorization.svg b/src/site/puml/pos/MAIN__pos_activation__device_authorization.svg new file mode 100644 index 00000000..928ce57f --- /dev/null +++ b/src/site/puml/pos/MAIN__pos_activation__device_authorization.svg @@ -0,0 +1 @@ +POS InstallerManagementPortalmil-authmil-terminal-registrycache(Redis)1authorize device (in: <usercode>)2POST /activateRequestId:<request id>Authorization: Bearer<access token>headeruser_code=<user code>bodyalt[the installer is part of pos service provider][the installer is part of public administration]base64url(<token header>) + "." +base64url(<access token payload>) + "." +<base64url of access token signature><access token>{"sub": "<service provider id>","aud": "mil.pagopa.it","iss": "https://<host name>/mil-auth","iat":<issue unix epoch>,"exp":<expiration unix epoch>,"channel": "POS_SERVICE_PROVIDER","groups": ["pos_service_provider"]}<access token payload>base64url(<token header>) + "." +base64url(<access token payload>) + "." +<base64url of access token signature><access token>{"sub": "<payee code>","aud": "mil.pagopa.it","iss": "https://<host name>/mil-auth","iat":<issue unix epoch>,"exp":<expiration unix epoch>,"channel": "PUBLIC_ADMINISTRATION","groups": ["public_administration"]}<access token payload>get user code3get(<user code>)4<terminal uuid>On<user code>not found, return HTTP 401 (unauthorized) with specific error body.On any other failure, return HTTP 500 (server error) with specific error body.get terminal data5POST /tokenclient_id=<mil-auth client id>&grant_type=client_credentials&client_secret=<secret>request body{"access_token": "<mil-auth access token>","token_type": "Bearer","expires_in":<access token duration>}response bodybase64url(<token header>) + "." +base64url(<access token payload>) + "." +<base64url of access token signature><mil-auth access token>{"sub": "mil-auth","aud": "mil.pagopa.it","iss": "https://<host name>/mil-auth","iat":<issue unix epoch>,"exp":<expiration unix epoch>,"groups": ["pos_finder",]}<access token payload>6GET /terminals/<terminaluuid>RequestId:<request id>Authorization: Bearer<mil-auth access token>header7HTTP 200 (ok){"terminalUuid": "<terminal uuid>","serviceProviderId": "<service provider id>","terminalHandlerId": "<terminal handler id>","terminalId": "<terminal id>","enabled":<enabled>,"payeeCode": "<payee code>","slave": "<slave>","workstations": [<array of workstations>],"pagoPa": "<pagopa>","pagoPaConf": {"pspId": "<psp id>","brokerId": "<broker id>","channelId": "<channel id>"},"idpay": "<idpay>"}bodyOn terminal not found, return HTTP 401 (unauthorized) with specific error body.On<enabled>= false, return HTTP 401 (unauthorized) with specific error body.On any other failure, return HTTP 500 (server error) with specific error body.alt[the installer is part of pos service provider][the installer is part of public administration]8verify that the value of<service provider id>contained in the claim sub ofaccess token is equal to thevalue retrieved fromterminal-registryOn<service provider id>mismatch, return HTTP 403 (forbidden) with specific error body.9verify that the value of <payeecode> contained in the claimsub of access token is equal tothe value retrieved fromterminal-registryOn<payee code>mismatch, return HTTP 403 (forbidden) with specific error body.set auth state10put(<terminal uuid>, true) withexpiration time equals to<expires is>11okOn any failure, return HTTP 500 (server error) with specific error body.12ok13ok \ No newline at end of file diff --git a/src/site/puml/pos/MAIN__pos_activation__refresh_tokens.svg b/src/site/puml/pos/MAIN__pos_activation__refresh_tokens.svg new file mode 100644 index 00000000..6cfdd068 --- /dev/null +++ b/src/site/puml/pos/MAIN__pos_activation__refresh_tokens.svg @@ -0,0 +1 @@ +POSmil-authmil-terminal-registryAzure ActiveDirectoryAzure StorageAccountAzure KeyVault1POST /tokenRequestId:<request id>headergrant_type=refresh_token&client_id=<client id>&refresh_token=<refresh token>bodyverify refresh tokenbase64url(<token header>) + "." +base64url(<refresh token payload>) + "." +<base64url of refresh token signature><refresh token>{"kid": "<key name>/<key version>","alg": "RS256"}<token header>{"jti": "<refresh token id>","sub": "<terminal uuid>","iat":<issue unix epoch>,"exp":<expiration unix epoch>,"channel": "POS","scope": "offline_access"}<refresh token payload>2verify header validity"alg" == "RS256"On verification failure, return HTTP 401 (unauthorized) with specific error body.3verify payload validity<issue unix epoch><<current unix epoch>&&<expiration unix epoch>><current unix epoch>&&"scope" == "offline_access"On verification failure, return HTTP 401 (unauthorized) with specific error body.get azure access token4GET${IDENTITY_ENDPOINT}?api-version=2019-08-01&resource=https://vault.azure.netx-identity-header:${IDENTITY_HEADER}header5HTTP 200 (ok){"token_type": "Bearer","expires_on":don't care,"client_id": "don't care","resource": "don't care""access_token": "<access token for key vault>"}bodyOn any failure, return HTTP 500 (server error) with specific error body.verify refresh token signature6generate <string to verifyrefresh token>base64url(sha256(utf8(base64url(<token header>) +"." +base64url(<refresh token payload>))))<string to verify refresh token>7POST <key vault baseurl>/keys/<key name>/<keyversion>/verify?api-version=7.4Authorization: Bearer<access token for key vault>header{"alg": "RS256","value": "<string to verify for refresh token>","digest": "<base64url of refresh token signature>"}body8HTTP 200 (ok){"value": true}bodyOn "value" == false in the response body, return HTTP 401 (unauthorized) with specific error body.On any other failure, return HTTP 500 (server error) with specific error body.common processingverify client idget azure access token9GET${IDENTITY_ENDPOINT}?api-version=2019-08-01&resource=https://storage.azure.comx-identity-header:${IDENTITY_HEADER}header10HTTP 200 (ok){"token_type": "Bearer","expires_on":don't care,"client_id": "don't care","resource": "don't care""access_token": "<access token for storage account>"}bodyOn any failure, return HTTP 500 (server error) with specific error body.get client id file11GET <storage account baseurl>/clients/<client id>.jsonx-ms-version: 2019-07-07Authorization: Bearer<access token for storage account>header12HTTP 200 (ok){"id": "<client id>","channel": "POS","grantTypes": ["device_code","refresh_token"]}bodyOn<client id>file not found, return HTTP 401 (unauthorized) with specific error body.On any other failure, return HTTP 500 (server error) with specific error body.13verify channel and grant typesOn channel or grant type mismatch, return HTTP 401 (unauthorized) with specific error body.get terminal data14POST /tokenclient_id=<mil-auth client id>&grant_type=client_credentials&client_secret=<secret>request body{"access_token": "<mil-auth access token>","token_type": "Bearer","expires_in":<access token duration>}response bodybase64url(<token header>) + "." +base64url(<access token payload>) + "." +<base64url of access token signature><mil-auth access token>{"sub": "mil-auth","aud": "mil.pagopa.it","iss": "https://<host name>/mil-auth","iat":<issue unix epoch>,"exp":<expiration unix epoch>,"groups": ["pos_finder",]}<access token payload>15GET /terminals/<terminaluuid>RequestId:<request id>Authorization: Bearer<mil-auth access token>header16HTTP 200 (ok){"terminalUuid": "<terminal uuid>","serviceProviderId": "<service provider id>","terminalHandlerId": "<terminal handler id>","terminalId": "<terminal id>","enabled":<enabled>,"payeeCode": "<payee code>","slave": "<slave>","workstations": [<array of workstations>],"pagoPa": "<pagopa>","pagoPaConf": {"pspId": "<psp id>","brokerId": "<broker id>","channelId": "<channel id>"},"idpay": "<idpay>"}bodyOn terminal not found, return HTTP 401 (unauthorized) with specific error body.On<enabled>= false, return HTTP 401 (unauthorized) with specific error body.On any other failure, return HTTP 500 (server error) with specific error body.build tokens payload17generate <access tokenpayload>{"sub": "<terminal uuid>","aud": "mil.pagopa.it","iss": "https://<host name>/mil-auth","iat":<current unix epoch>,"exp":<current unix epoch>+<access token duration>,"payeeCode": "<payeeCode>","channel": "POS","serviceProviderId": "<service provider id>","terminalHandlerId": "<terminal handler id>","terminalId": "<terminal id>","groups": ["SlavePos", Present if <slave> istrue."NoticePayer", Present if <pagopa> istrue."PayWithIDPay" Present if <idpay> istrue.],"pagoPaConf": { Present if <pagopa> istrue."pspId": "<psp id>","brokerId": "<broker id>","channelId": "<channel id>"}}<access token payload>18generate <refresh tokenpayload>{"jti": "<refresh token id>","sub": "<terminal uuid>","iat":<current unix epoch>,"exp":<current unix epoch>+<refresh token duration>"channel": "POS","scope": "offline_access"}<refresh token payload>retrieve key to sign tokensSee MAIN__retrieve_key_to_sign_tokens.pumlbuild tokens header19generate <token header>{"kid": "<key name>/<key version>","alg": "RS256"}<token header>sign access token20generate <string to sign foraccess token>base64url(sha256(utf8(base64url(<token header>) +"." +base64url(<access token payload>))))<string to sign for access token>21POST POST <key vault baseurl>/keys/<key name>/<keyversion>/sign?api-version=7.4Authorization: Bearer<access token for key vault>header{"alg": "RS256","value": "<string to sign for access token>"}body22HTTP 200 (ok){"kid": "<key vault base url>/keys/<key name>/<key version>","value": "<base64url of access token signature>"}bodyOn any failure, return HTTP 500 (server error) with specific error body.23<access token> =base64url(<token header>) +"." +  base64url(<access tokenpayload>) + "." + <base64urlof access token signature>sign refresh token24generate <string to sign forrefresh token>base64url(sha256(utf8(base64url(<token header>) +"." +base64url(<refresh token payload>))))<string to sign for refresh token>25POST POST <key vault baseurl>/keys/<key name>/<keyversion>/sign?api-version=7.4Authorization: Bearer<access token for key vault>header{"alg": "RS256","value": "<string to sign for refresh token>"}body26HTTP 200 (ok){"kid": "<key vault base url>/keys/<key name>/<key version>","value": "<base64url of refresh token signature>"}bodyOn any failure, return HTTP 500 (server error) with specific error body.27<refresh token> =base64url(<token header>) +"." +  base64url(<refreshtoken payload>) + "." +<base64url of refresh tokensignature>28HTTP 200 (ok){"access_token": "<access token>","refresh_token": "<refresh token>","token_type": "Bearer","expires_in":<access token duration>} \ No newline at end of file diff --git a/src/site/puml/pos/MAIN__pos_activation__refresh_tokens__SIMPLE.svg b/src/site/puml/pos/MAIN__pos_activation__refresh_tokens__SIMPLE.svg new file mode 100644 index 00000000..d054a3f7 --- /dev/null +++ b/src/site/puml/pos/MAIN__pos_activation__refresh_tokens__SIMPLE.svg @@ -0,0 +1 @@ +POSmil-auth1POST /tokenRequestId:<request id>headergrant_type=refresh_token&client_id=<client id>&refresh_token=<refresh token>body2HTTP 200 (ok){"access_token": "<access token>","refresh_token": "<refresh token>","token_type": "Bearer","expires_in":<access token duration>} \ No newline at end of file diff --git a/src/site/puml/pos/MAIN__pos_activation__request_device_code.svg b/src/site/puml/pos/MAIN__pos_activation__request_device_code.svg new file mode 100644 index 00000000..f695464e --- /dev/null +++ b/src/site/puml/pos/MAIN__pos_activation__request_device_code.svg @@ -0,0 +1 @@ +POS InstallerPOSmil-authmil-terminal-registryAzure ActiveDirectoryAzure StorageAccountcache(Redis)1start app2POST /device/codeRequestId:<request id>headerclient_id=<client id>&terminal_handler_id=<terminal handler id>&terminal_id=<terminal id>bodyverify client idget azure access token3GET${IDENTITY_ENDPOINT}?api-version=2019-08-01&resource=https://storage.azure.comx-identity-header:${IDENTITY_HEADER}header4HTTP 200 (ok){"token_type": "Bearer","expires_on":don't care,"client_id": "don't care","resource": "don't care""access_token": "<access token for storage account>"}bodyOn any failure, return HTTP 500 (server error) with specific error body.get client id file5GET <storage account baseurl>/clients/<client id>.jsonx-ms-version: 2019-07-07Authorization: Bearer<access token for storage account>header6HTTP 200 (ok){"id": "<client id>","channel": "POS","grantTypes": ["device_code","refresh_token"]}bodyOn<client id>file not found, return HTTP 401 (unauthorized) with specific error body.On any other failure, return HTTP 500 (server error) with specific error body.7verify channel and grant typesOn channel or grant type mismatch, return HTTP 401 (unauthorized) with specific error body.get terminal data8POST /tokenclient_id=<mil-auth client id>&grant_type=client_credentials&client_secret=<secret>request body{"access_token": "<mil-auth ccess token>","token_type": "Bearer","expires_in":<access token duration>}response bodybase64url(<token header>) + "." +base64url(<access token payload>) + "." +<base64url of access token signature><mil-auth access token>{"sub": "mil-auth","aud": "mil.pagopa.it","iss": "https://<host name>/mil-auth","iat":<issue unix epoch>,"exp":<expiration unix epoch>,"groups": ["pos_finder",]}<access token payload>9GET/terminals/findByThIds?terminalHandlerId=<terminalhandlerid>&terminalId=<terminal id>RequestId:<request id>Authorization: Bearer<mil-auth access token>header10HTTP 200 (ok){"terminalUuid": "<terminal uuid>","serviceProviderId": "<service provider id>","terminalHandlerId": "<terminal handler id>","terminalId": "<terminal id>","enabled":<enabled>,"payeeCode": "<payee code>","slave": "<slave>","workstations": [<array of workstations>],"pagoPa": "<pagopa>","pagoPaConf": {"pspId": "<psp id>","brokerId": "<broker id>","channelId": "<channel id>"},"idpay": "<idpay>"}bodyOn terminal not found, return HTTP 401 (unauthorized) with specific error body.On<enabled>= false, return HTTP 401 (unauthorized) with specific error body.On any other failure, return HTTP 500 (server error) with specific error body.11generate 8ch length base20string as <user code>store user code12put(<user code>, <terminaluuid>) with expiration timeequals to <expires in>13okOn any failure, return HTTP 500 (server error) with specific error body.14HTTP 201 (ok){"device_code": "<terminal uuid>","user_code": "<user code>","expires_in":<expires in>,"interval":<interval>}body15<user code> \ No newline at end of file diff --git a/src/site/puml/pos/MAIN__pos_activation__request_device_code__SIMPLE.svg b/src/site/puml/pos/MAIN__pos_activation__request_device_code__SIMPLE.svg new file mode 100644 index 00000000..9f0e6911 --- /dev/null +++ b/src/site/puml/pos/MAIN__pos_activation__request_device_code__SIMPLE.svg @@ -0,0 +1 @@ +POS InstallerPOSmil-auth1start app2POST /device/codeRequestId:<request id>headerclient_id=<client id>&terminal_handler_id=<terminal handler id>&terminal_id=<terminal id>body3HTTP 200 (ok){"device_code": "<terminal uuid>","user_code": "<user code>","expires_in":<expires in>,"interval":<interval>}body4<user code> \ No newline at end of file diff --git a/src/site/puml/pos/MAIN__pos_activation__request_tokens.svg b/src/site/puml/pos/MAIN__pos_activation__request_tokens.svg new file mode 100644 index 00000000..604c9905 --- /dev/null +++ b/src/site/puml/pos/MAIN__pos_activation__request_tokens.svg @@ -0,0 +1 @@ +POSmil-authmil-terminal-registryAzure ActiveDirectoryAzure StorageAccountAzure KeyVaultcache(Redis)1POST /tokenRequestId:<request id>headergrant_type=device_code&client_id=<client id>&device_code=<terminal uuid>bodyget auth state2get(<terminal uuid>)3trueOn<terminal uuid>not found, return HTTP 403 (forbidden) with specific error body.On any other failure, return HTTP 500 (server error) with specific error body.common processingverify client idget azure access token4GET${IDENTITY_ENDPOINT}?api-version=2019-08-01&resource=https://storage.azure.comx-identity-header:${IDENTITY_HEADER}header5HTTP 200 (ok){"token_type": "Bearer","expires_on":don't care,"client_id": "don't care","resource": "don't care""access_token": "<access token for storage account>"}bodyOn any failure, return HTTP 500 (server error) with specific error body.get client id file6GET <storage account baseurl>/clients/<client id>.jsonx-ms-version: 2019-07-07Authorization: Bearer<access token for storage account>header7HTTP 200 (ok){"id": "<client id>","channel": "POS","grantTypes": ["device_code","refresh_token"]}bodyOn<client id>file not found, return HTTP 401 (unauthorized) with specific error body.On any other failure, return HTTP 500 (server error) with specific error body.8verify channel and grant typesOn channel or grant type mismatch, return HTTP 401 (unauthorized) with specific error body.get terminal data9POST /tokenclient_id=<mil-auth client id>&grant_type=client_credentials&client_secret=<secret>request body{"access_token": "<mil-auth access token>","token_type": "Bearer","expires_in":<access token duration>}response bodybase64url(<token header>) + "." +base64url(<access token payload>) + "." +<base64url of access token signature><mil-auth access token>{"sub": "mil-auth","aud": "mil.pagopa.it","iss": "https://<host name>/mil-auth","iat":<issue unix epoch>,"exp":<expiration unix epoch>,"groups": ["pos_finder",]}<access token payload>10GET /terminals/<terminaluuid>RequestId:<request id>Authorization: Bearer<mil-auth access token>header11HTTP 200 (ok){"terminalUuid": "<terminal uuid>","serviceProviderId": "<service provider id>","terminalHandlerId": "<terminal handler id>","terminalId": "<terminal id>","enabled":<enabled>,"payeeCode": "<payee code>","slave": "<slave>","workstations": [<array of workstations>],"pagoPa": "<pagopa>","pagoPaConf": {"pspId": "<psp id>","brokerId": "<broker id>","channelId": "<channel id>"},"idpay": "<idpay>"}bodyOn terminal not found, return HTTP 401 (unauthorized) with specific error body.On<enabled>= false, return HTTP 401 (unauthorized) with specific error body.On any other failure, return HTTP 500 (server error) with specific error body.build tokens payload12generate <access tokenpayload>{"sub": "<terminal uuid>","aud": "mil.pagopa.it","iss": "https://<host name>/mil-auth","iat":<current unix epoch>,"exp":<current unix epoch>+<access token duration>,"payeeCode": "<payeeCode>","channel": "POS","serviceProviderId": "<service provider id>","terminalHandlerId": "<terminal handler id>","terminalId": "<terminal id>","groups": ["SlavePos", Present if <slave> istrue."NoticePayer", Present if <pagopa> istrue."PayWithIDPay" Present if <idpay> istrue.],"pagoPaConf": { Present if <pagopa> istrue."pspId": "<psp id>","brokerId": "<broker id>","channelId": "<channel id>"}}<access token payload>13generate <refresh tokenpayload>{"jti": "<refresh token id>","sub": "<terminal uuid>","iat":<current unix epoch>,"exp":<current unix epoch>+<refresh token duration>"channel": "POS","scope": "offline_access"}<refresh token payload>retrieve key to sign tokensSee MAIN__retrieve_key_to_sign_tokens.pumlbuild tokens header14generate <token header>{"kid": "<key name>/<key version>","alg": "RS256"}<token header>sign access token15generate <string to sign foraccess token>base64url(sha256(utf8(base64url(<token header>) +"." +base64url(<access token payload>))))<string to sign for access token>16POST POST <key vault baseurl>/keys/<key name>/<keyversion>/sign?api-version=7.4Authorization: Bearer<access token for key vault>header{"alg": "RS256","value": "<string to sign for access token>"}body17HTTP 200 (ok){"kid": "<key vault base url>/keys/<key name>/<key version>","value": "<base64url of access token signature>"}bodyOn any failure, return HTTP 500 (server error) with specific error body.18<access token> =base64url(<token header>) +"." +  base64url(<access tokenpayload>) + "." + <base64urlof access token signature>sign refresh token19generate <string to sign forrefresh token>base64url(sha256(utf8(base64url(<token header>) +"." +base64url(<refresh token payload>))))<string to sign for refresh token>20POST POST <key vault baseurl>/keys/<key name>/<keyversion>/sign?api-version=7.4Authorization: Bearer<access token for key vault>header{"alg": "RS256","value": "<string to sign for refresh token>"}body21HTTP 200 (ok){"kid": "<key vault base url>/keys/<key name>/<key version>","value": "<base64url of refresh token signature>"}bodyOn any failure, return HTTP 500 (server error) with specific error body.22<refresh token> =base64url(<token header>) +"." +  base64url(<refreshtoken payload>) + "." +<base64url of refresh tokensignature>23HTTP 200 (ok){"access_token": "<access token>","refresh_token": "<refresh token>","token_type": "Bearer","expires_in":<access token duration>} \ No newline at end of file diff --git a/src/site/puml/pos/MAIN__pos_activation__request_tokens__SIMPLE.svg b/src/site/puml/pos/MAIN__pos_activation__request_tokens__SIMPLE.svg new file mode 100644 index 00000000..eba5da4c --- /dev/null +++ b/src/site/puml/pos/MAIN__pos_activation__request_tokens__SIMPLE.svg @@ -0,0 +1 @@ +POSmil-auth1POST /tokenRequestId:<request id>headergrant_type=device_code&client_id=<client id>&device_code=<terminal uuid>body2HTTP 200 (ok){"access_token": "<access token>","refresh_token": "<refresh token>","token_type": "Bearer","expires_in":<access token duration>} \ No newline at end of file