From a5491c4d41360127c719093d8b6d55f7182e2d22 Mon Sep 17 00:00:00 2001 From: khalidabuhakmeh Date: Mon, 21 Apr 2025 14:48:41 -0400 Subject: [PATCH 1/5] Switch some png images to svg versions These are much smaller in size and scale on all devices better. --- .../docs/identityserver/fundamentals/users.md | 2 +- .../identityserver/overview/big-picture.md | 6 +- .../images/application-architecture.svg | 97 +++++++++++ .../overview/images/middleware.svg | 69 ++++++++ .../overview/images/protocols.svg | 164 ++++++++++++++++++ .../overview/images/terminology.svg | 67 +++++++ .../identityserver/overview/terminology.md | 2 +- 7 files changed, 402 insertions(+), 5 deletions(-) create mode 100644 src/content/docs/identityserver/overview/images/application-architecture.svg create mode 100644 src/content/docs/identityserver/overview/images/middleware.svg create mode 100644 src/content/docs/identityserver/overview/images/protocols.svg create mode 100644 src/content/docs/identityserver/overview/images/terminology.svg diff --git a/src/content/docs/identityserver/fundamentals/users.md b/src/content/docs/identityserver/fundamentals/users.md index 46c23b4fc..2698685c3 100644 --- a/src/content/docs/identityserver/fundamentals/users.md +++ b/src/content/docs/identityserver/fundamentals/users.md @@ -48,7 +48,7 @@ It is very important that you understand how it works when building the login pa Recall the diagram showing the relationship of your custom UI pages and the IdentityServer middleware in your IdentityServer host application: -![middleware diagram](../overview/images/middleware.png) +![middleware diagram](../overview/images/middleware.svg) When your IdentityServer receives an authorize request, it will inspect it for a current authentication session for a user. This authentication session is based on ASP.NET Core's authentication system and is ultimately determined by a diff --git a/src/content/docs/identityserver/overview/big-picture.md b/src/content/docs/identityserver/overview/big-picture.md index 9dd772cd1..6deafcc9f 100644 --- a/src/content/docs/identityserver/overview/big-picture.md +++ b/src/content/docs/identityserver/overview/big-picture.md @@ -12,7 +12,7 @@ redirect_from: Most modern applications look more or less like this: -![an architecture diagram for modern applications with clients and services](./images/appArch.png) +![an architecture diagram for modern applications with clients and services](./images/application-architecture.svg) The most common interactions are: @@ -31,7 +31,7 @@ across those applications and endpoints. Restructuring the application to support a security token service leads to the following architecture and protocols: -![an architecture diagram showing where OAuth 2.0 is used](./images/protocols.png) +![an architecture diagram showing where OAuth 2.0 is used](./images/protocols.svg) Such a design divides security concerns into two parts: @@ -78,7 +78,7 @@ depending on your needs) and add the IdentityServer middleware to that application. The middleware adds the necessary protocol heads to the application so that clients can talk to it using those standard protocols. -![IdentityServer middleware diagram and its relatinship in the ASP.NET Core pipeline](./images/middleware.png) +![IdentityServer middleware diagram and its relatinship in the ASP.NET Core pipeline](./images/middleware.svg) The hosting application can be as complex as you want, but we typically recommend to keep the attack surface as small as possible by including diff --git a/src/content/docs/identityserver/overview/images/application-architecture.svg b/src/content/docs/identityserver/overview/images/application-architecture.svg new file mode 100644 index 000000000..b2f6090ef --- /dev/null +++ b/src/content/docs/identityserver/overview/images/application-architecture.svg @@ -0,0 +1,97 @@ + + + + + + + + + + + + + + + + + + + + + + API + + + + + Service + + + + + Service + + + + + Service + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Server / IoT + + + + + + + + + + + + + Browser + + + + + Native Apps + + + + + + + diff --git a/src/content/docs/identityserver/overview/images/middleware.svg b/src/content/docs/identityserver/overview/images/middleware.svg new file mode 100644 index 000000000..21b0e8b81 --- /dev/null +++ b/src/content/docs/identityserver/overview/images/middleware.svg @@ -0,0 +1,69 @@ + + + + + ASP.NET Core Application + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Your Code + + IdentityServerMiddleware + + + + + + + + + + + + + + + + + + + + + + + login + logout + ... + authorize + token + discovery + + diff --git a/src/content/docs/identityserver/overview/images/protocols.svg b/src/content/docs/identityserver/overview/images/protocols.svg new file mode 100644 index 000000000..2bed6787f --- /dev/null +++ b/src/content/docs/identityserver/overview/images/protocols.svg @@ -0,0 +1,164 @@ + + + + + + + + + + + + + + + + + + + + + + Security TokenService + + + + + API + + + + + Service + + + + + Service + + + + + Service + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Server / IoT + + + + + + + + + + + + + Browser + + + + + Native Apps + + + + + + + + + + + + + + + OpenID Connect + + + + + + OpenID Connect + + + + + + OAUTH 2.0 + + + + + + OAUTH 2.0 + + + + + + OAUTH 2.0 + + + + + + OAUTH 2.0 + + + + + + OAUTH 2.0 + + + + + + OAUTH 2.0 + + + + + + + + + + OpenID Connect + + diff --git a/src/content/docs/identityserver/overview/images/terminology.svg b/src/content/docs/identityserver/overview/images/terminology.svg new file mode 100644 index 000000000..6165743db --- /dev/null +++ b/src/content/docs/identityserver/overview/images/terminology.svg @@ -0,0 +1,67 @@ + + + + + + Users + + + + + + + + + + + + + + APIs + + + IdentityData + + + Resources + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Clients + + + + + + + + IdentityServer + authenticateusers + requestresource access + diff --git a/src/content/docs/identityserver/overview/terminology.md b/src/content/docs/identityserver/overview/terminology.md index b19889178..60771c0d2 100644 --- a/src/content/docs/identityserver/overview/terminology.md +++ b/src/content/docs/identityserver/overview/terminology.md @@ -12,7 +12,7 @@ redirect_from: The specs, documentation and object model use a certain terminology that you should be aware of. -![a basic diagrams showing the relationship between users, clients, identityserver, and resources](./images/terminology.png) +![a basic diagrams showing the relationship between users, clients, identityserver, and resources](./images/terminology.svg) ## Duende IdentityServer From fa1afeb072b7d7b7430a7aed92026c43c54f0472 Mon Sep 17 00:00:00 2001 From: khalidabuhakmeh Date: Mon, 21 Apr 2025 15:39:20 -0400 Subject: [PATCH 2/5] Add CIBA SVG diagram to documentation Introduced a new SVG file illustrating the CIBA flow, placed under the documentation assets. This addition enhances the visual clarity and understanding of the CIBA process for readers. --- .../docs/identityserver/fundamentals/users.md | 2 +- src/content/docs/identityserver/ui/ciba.md | 2 +- .../docs/identityserver/ui/federation.md | 2 +- .../docs/identityserver/ui/images/ciba.svg | 129 ++++++++++++++++++ .../identityserver/ui/images/federation.svg | 69 ++++++++++ .../docs/identityserver/ui/images/host.svg | 69 ++++++++++ .../identityserver/ui/images/signin_flow.svg | 85 ++++++++++++ src/content/docs/identityserver/ui/index.md | 2 +- 8 files changed, 356 insertions(+), 4 deletions(-) create mode 100644 src/content/docs/identityserver/ui/images/ciba.svg create mode 100644 src/content/docs/identityserver/ui/images/federation.svg create mode 100644 src/content/docs/identityserver/ui/images/host.svg create mode 100644 src/content/docs/identityserver/ui/images/signin_flow.svg diff --git a/src/content/docs/identityserver/fundamentals/users.md b/src/content/docs/identityserver/fundamentals/users.md index 2698685c3..a6a8eb631 100644 --- a/src/content/docs/identityserver/fundamentals/users.md +++ b/src/content/docs/identityserver/fundamentals/users.md @@ -58,7 +58,7 @@ If the user has never logged in there will be no cookie, and then the request to redirect to your login page. This is the entry point into your custom workflow that can take over to get the user logged in. -![sign in flow](../ui/images/signin_flow.png) +![sign in flow](../ui/images/signin_flow.svg) Once the login page has finished logging in the user with the ASP.NET Core authentication system, it will redirect the user back to the authorize endpoint. diff --git a/src/content/docs/identityserver/ui/ciba.md b/src/content/docs/identityserver/ui/ciba.md index 7392ee89f..0d8df5b15 100644 --- a/src/content/docs/identityserver/ui/ciba.md +++ b/src/content/docs/identityserver/ui/ciba.md @@ -30,7 +30,7 @@ A nice feature of this workflow is that the user does not enter their credential Below is a diagram that shows the high level steps involved with the CIBA workflow and the supporting services involved. -![Showing how CIBA works in diagram form](./images/ciba.png) +![Showing how CIBA works in diagram form](./images/ciba.svg) * **Step 1**: IdentityServer exposes a [backchannel authentication request endpoint](/identityserver/reference/endpoints/ciba) that the client uses to initiate the CIBA workflow. diff --git a/src/content/docs/identityserver/ui/federation.md b/src/content/docs/identityserver/ui/federation.md index c03e5f4b9..0a00e1bc7 100644 --- a/src/content/docs/identityserver/ui/federation.md +++ b/src/content/docs/identityserver/ui/federation.md @@ -15,7 +15,7 @@ Federation means that your IdentityServer offers authentication methods that use If you offer a number of these external authentication methods, often the term *Federation Gateway* is used to describe this architectural approach. -![Diagram showing the benefits of using a federation gateway](./images/federation.png) +![Diagram showing the benefits of using a federation gateway](./images/federation.svg) Generally, this architecture allows shielding your client applications from the complexities of your authentication workflows and business requirements that go along with them. diff --git a/src/content/docs/identityserver/ui/images/ciba.svg b/src/content/docs/identityserver/ui/images/ciba.svg new file mode 100644 index 000000000..6c571790b --- /dev/null +++ b/src/content/docs/identityserver/ui/images/ciba.svg @@ -0,0 +1,129 @@ + + + + + + + + + + + + Client + IdentityServerMiddleware + + + + + + + + + + + + + + + + CIBA requeststore + CIBA userinteraction service + CIBA usernotification service* + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 1 + 2 + 3 + 4 + 5 + 6 + CIBA uservalidation* + + *interfaces you must implement + diff --git a/src/content/docs/identityserver/ui/images/federation.svg b/src/content/docs/identityserver/ui/images/federation.svg new file mode 100644 index 000000000..3ec357bd7 --- /dev/null +++ b/src/content/docs/identityserver/ui/images/federation.svg @@ -0,0 +1,69 @@ + + + + + + + + + + + + + + + + + + + + + + + + + FederationGateway + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + • Active Directory• Azure AD / B2C• Business Partners• Social Identities + + Clients + + + + + + + + + diff --git a/src/content/docs/identityserver/ui/images/host.svg b/src/content/docs/identityserver/ui/images/host.svg new file mode 100644 index 000000000..21b0e8b81 --- /dev/null +++ b/src/content/docs/identityserver/ui/images/host.svg @@ -0,0 +1,69 @@ + + + + + ASP.NET Core Application + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Your Code + + IdentityServerMiddleware + + + + + + + + + + + + + + + + + + + + + + + login + logout + ... + authorize + token + discovery + + diff --git a/src/content/docs/identityserver/ui/images/signin_flow.svg b/src/content/docs/identityserver/ui/images/signin_flow.svg new file mode 100644 index 000000000..032b8f4f4 --- /dev/null +++ b/src/content/docs/identityserver/ui/images/signin_flow.svg @@ -0,0 +1,85 @@ + + + + + + ASP.NET Core Application + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Your Code + + IdentityServerMiddleware + + + + + + + + + + + + + + + + + + + + + + + login + logout + ... + authorize + token + discovery + + + + + + Client + + + + + + + + + 1. https://server/authorize?... + 2. /login?returnUrl=/authorize?... + diff --git a/src/content/docs/identityserver/ui/index.md b/src/content/docs/identityserver/ui/index.md index 48df4dbbf..b4866b707 100644 --- a/src/content/docs/identityserver/ui/index.md +++ b/src/content/docs/identityserver/ui/index.md @@ -21,7 +21,7 @@ The design goal of Duende IdentityServer is to provide a full implementation of To allow full flexibility of the UI, including business rules and user flow, the UI is separated from the core IdentityServer engine. The engine implements the endpoints specified in the protocols and hands off control to your code in the UI as necessary. -![diagram showing how IdentityServer middleware is hosted in an ASP.NET Core application](./images/host.png) +![diagram showing how IdentityServer middleware is hosted in an ASP.NET Core application](./images/host.svg) Our templates include a [quick start UI](/identityserver/quickstarts/2-interactive/#add-the-ui) and a [quick start UI adapted to ASP.NET Identity](/identityserver/quickstarts/5-aspnetid/) which provide a starting point for all the necessary pages, ready to be customized. From bb16664594a6ce3685dbbc9b65085a6793a182dd Mon Sep 17 00:00:00 2001 From: khalidabuhakmeh Date: Mon, 21 Apr 2025 16:19:32 -0400 Subject: [PATCH 3/5] Update image reference and add new SVG for session timeout Replaced the PNG image with an optimized SVG in the documentation for session expiration. Added the corresponding SVG file to improve clarity and scalability of visuals. --- .../images/extending_session.svg | 86 +++++++++++++++ .../images/session_expired.svg | 102 ++++++++++++++++++ .../inactivity-timeout.md | 2 +- 3 files changed, 189 insertions(+), 1 deletion(-) create mode 100644 src/content/docs/identityserver/ui/server-side-sessions/images/extending_session.svg create mode 100644 src/content/docs/identityserver/ui/server-side-sessions/images/session_expired.svg diff --git a/src/content/docs/identityserver/ui/server-side-sessions/images/extending_session.svg b/src/content/docs/identityserver/ui/server-side-sessions/images/extending_session.svg new file mode 100644 index 000000000..9a97e6857 --- /dev/null +++ b/src/content/docs/identityserver/ui/server-side-sessions/images/extending_session.svg @@ -0,0 +1,86 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + introspection + token + + + + + + + + + accesssub: 123sid: 456 + + accesssub: 123sid: 456 + + + + refreshsub: 123sid: 456 + + + key: 111 + key: 111sub: 123sid: 456expires: 10 + API + Browser + CoordiationService + CookieHandler + Client + IdentityServer + + + + + + + + + + + + + + + + + + + diff --git a/src/content/docs/identityserver/ui/server-side-sessions/images/session_expired.svg b/src/content/docs/identityserver/ui/server-side-sessions/images/session_expired.svg new file mode 100644 index 000000000..dee5fa9c4 --- /dev/null +++ b/src/content/docs/identityserver/ui/server-side-sessions/images/session_expired.svg @@ -0,0 +1,102 @@ + + + + + key: 222sub: 123sid: 456access tokenrefresh token + key: 111sub: 123sid: 456expires: *expired* + + refreshsub: 123sid: 456 + + + + + + + + + + + Client 2 + Browser + SessionMonitor + + CoordinationService + IdentityServer + + + + + + + + + + + Client 1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + token + invalid_grant + back-channellogout + key: 111 + key: 222 + diff --git a/src/content/docs/identityserver/ui/server-side-sessions/inactivity-timeout.md b/src/content/docs/identityserver/ui/server-side-sessions/inactivity-timeout.md index af9425412..778bb3589 100644 --- a/src/content/docs/identityserver/ui/server-side-sessions/inactivity-timeout.md +++ b/src/content/docs/identityserver/ui/server-side-sessions/inactivity-timeout.md @@ -54,7 +54,7 @@ Clients that receive back-channel logout would know the user's session has ended But if back-channel is not used, then the client would need some other signal to consider the user's session has ended. The obvious signal would be if the refresh token request failed, then that would be an appropriate signal that the user's session has also ended. -![A diagram showing what happens when a session expires](./images/session_expired.png) +![A diagram showing what happens when a session expires](./images/session_expired.svg) Given this understanding, client applications can participate in this convention and IdentityServer can coordinate to achieve this system-wide "inactivity timeout" requirement. From 6b21a25d7c1b256791fbb10b33d299147ed0b1ef Mon Sep 17 00:00:00 2001 From: khalidabuhakmeh Date: Mon, 21 Apr 2025 16:23:39 -0400 Subject: [PATCH 4/5] Update `extending_session.svg` to include design improvements The updated SVG includes modifications to shape paths and text elements for a cleaner and more precise representation. Adjustments improve visual consistency and align better with the overall design guidelines. --- .../images/extending_session.svg | 162 +++++++++--------- .../inactivity-timeout.md | 2 +- 2 files changed, 84 insertions(+), 80 deletions(-) diff --git a/src/content/docs/identityserver/ui/server-side-sessions/images/extending_session.svg b/src/content/docs/identityserver/ui/server-side-sessions/images/extending_session.svg index 9a97e6857..121dfba6c 100644 --- a/src/content/docs/identityserver/ui/server-side-sessions/images/extending_session.svg +++ b/src/content/docs/identityserver/ui/server-side-sessions/images/extending_session.svg @@ -1,86 +1,90 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - introspection - token - - - - - - - - - accesssub: 123sid: 456 + + - accesssub: 123sid: 456 - - - - refreshsub: 123sid: 456 - - - key: 111 - key: 111sub: 123sid: 456expires: 10 - API - Browser - CoordiationService - CookieHandler - Client - IdentityServer - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + introspection + token + + + + + + + + + + accesssub: 123sid: 456 + + - - - - - - + refreshsub: 123sid: 456 + + + key: 111 + key: 111sub: 123sid: 456expires: 10 + API + Browser + CoordiationService + CookieHandler + Client + IdentityServer + + + + + + + + + + + + + + + + + accesssub: 123sid: 456 + - - + + - - - diff --git a/src/content/docs/identityserver/ui/server-side-sessions/inactivity-timeout.md b/src/content/docs/identityserver/ui/server-side-sessions/inactivity-timeout.md index 778bb3589..fb86ebf83 100644 --- a/src/content/docs/identityserver/ui/server-side-sessions/inactivity-timeout.md +++ b/src/content/docs/identityserver/ui/server-side-sessions/inactivity-timeout.md @@ -41,7 +41,7 @@ Internally IdentityServer provides a `ISessionCoordinationService` which is invo Its purpose is to then extend the lifetime of the server-side session. Below is a picture of the various types of requests to do this: -![diagram demonstrating how to extend a session using IdentityServer](./images/extending_session.png) +![diagram demonstrating how to extend a session using IdentityServer](./images/extending_session.svg) ### User Inactivity Detection and Session Termination From 5afdc4351fd31a68b58dedf871fcc81d24dd0ccb Mon Sep 17 00:00:00 2001 From: khalidabuhakmeh Date: Tue, 22 Apr 2025 09:17:23 -0400 Subject: [PATCH 5/5] Update terminology.svg in identity server docs Revised the SVG file for updated terminology representation. --- .../images/application-architecture.svg | 14 ++++---- .../overview/images/middleware.svg | 18 +++++----- .../overview/images/protocols.svg | 34 +++++++++---------- .../overview/images/terminology.svg | 16 ++++----- .../images/extending_session.svg | 26 +++++++------- .../images/session_expired.svg | 28 +++++++-------- 6 files changed, 68 insertions(+), 68 deletions(-) diff --git a/src/content/docs/identityserver/overview/images/application-architecture.svg b/src/content/docs/identityserver/overview/images/application-architecture.svg index b2f6090ef..763e4a112 100644 --- a/src/content/docs/identityserver/overview/images/application-architecture.svg +++ b/src/content/docs/identityserver/overview/images/application-architecture.svg @@ -19,22 +19,22 @@ - API + Backend - Service + API - Service + API - Service + API @@ -69,7 +69,7 @@ - Server / IoT + Server / IoT @@ -82,12 +82,12 @@ - Browser + Browser - Native Apps + Native Apps diff --git a/src/content/docs/identityserver/overview/images/middleware.svg b/src/content/docs/identityserver/overview/images/middleware.svg index 21b0e8b81..4d6db78bb 100644 --- a/src/content/docs/identityserver/overview/images/middleware.svg +++ b/src/content/docs/identityserver/overview/images/middleware.svg @@ -2,7 +2,7 @@ - ASP.NET Core Application + ASP.NET Core Application @@ -34,9 +34,9 @@ - Your Code + Your Code - IdentityServerMiddleware + IdentityServerMiddleware @@ -59,11 +59,11 @@ - login - logout - ... - authorize - token - discovery + login + logout + ... + authorize + token + discovery diff --git a/src/content/docs/identityserver/overview/images/protocols.svg b/src/content/docs/identityserver/overview/images/protocols.svg index 2bed6787f..1881e424a 100644 --- a/src/content/docs/identityserver/overview/images/protocols.svg +++ b/src/content/docs/identityserver/overview/images/protocols.svg @@ -19,27 +19,27 @@ - Security TokenService + Security TokenService - API + Backend - Service + API - Service + API - Service + API @@ -74,7 +74,7 @@ - Server / IoT + Server / IoT @@ -87,12 +87,12 @@ - Browser + Browser - Native Apps + Native Apps @@ -107,49 +107,49 @@ - OpenID Connect + OpenID Connect - OpenID Connect + OpenID Connect - OAUTH 2.0 + OAUTH 2.0 - OAUTH 2.0 + OAUTH 2.0 - OAUTH 2.0 + OAUTH 2.0 - OAUTH 2.0 + OAUTH 2.0 - OAUTH 2.0 + OAUTH 2.0 - OAUTH 2.0 + OAUTH 2.0 @@ -159,6 +159,6 @@ - OpenID Connect + OpenID Connect diff --git a/src/content/docs/identityserver/overview/images/terminology.svg b/src/content/docs/identityserver/overview/images/terminology.svg index 6165743db..a5965fbe1 100644 --- a/src/content/docs/identityserver/overview/images/terminology.svg +++ b/src/content/docs/identityserver/overview/images/terminology.svg @@ -3,7 +3,7 @@ - Users + Users @@ -17,13 +17,13 @@ - APIs + APIs - IdentityData + IdentityData - Resources + Resources @@ -53,7 +53,7 @@ - Clients + Clients @@ -61,7 +61,7 @@ - IdentityServer - authenticateusers - requestresource access + IdentityServer + authenticateusers + requestresource access diff --git a/src/content/docs/identityserver/ui/server-side-sessions/images/extending_session.svg b/src/content/docs/identityserver/ui/server-side-sessions/images/extending_session.svg index 121dfba6c..a19c7d854 100644 --- a/src/content/docs/identityserver/ui/server-side-sessions/images/extending_session.svg +++ b/src/content/docs/identityserver/ui/server-side-sessions/images/extending_session.svg @@ -39,8 +39,8 @@ - introspection - token + introspection + token @@ -50,21 +50,21 @@ - accesssub: 123sid: 456 + accesssub: 123sid: 456 - refreshsub: 123sid: 456 + refreshsub: 123sid: 456 - key: 111 - key: 111sub: 123sid: 456expires: 10 - API - Browser - CoordiationService - CookieHandler - Client - IdentityServer + key: 111 + key: 111sub: 123sid: 456expires: 10 + API + Browser + CoordiationService + CookieHandler + Client + IdentityServer @@ -81,7 +81,7 @@ - accesssub: 123sid: 456 + accesssub: 123sid: 456 diff --git a/src/content/docs/identityserver/ui/server-side-sessions/images/session_expired.svg b/src/content/docs/identityserver/ui/server-side-sessions/images/session_expired.svg index dee5fa9c4..268fb53af 100644 --- a/src/content/docs/identityserver/ui/server-side-sessions/images/session_expired.svg +++ b/src/content/docs/identityserver/ui/server-side-sessions/images/session_expired.svg @@ -2,10 +2,10 @@ - key: 222sub: 123sid: 456access tokenrefresh token - key: 111sub: 123sid: 456expires: *expired* + key: 222sub: 123sid: 456access tokenrefresh token + key: 111sub: 123sid: 456expires: *expired* - refreshsub: 123sid: 456 + refreshsub: 123sid: 456 @@ -16,12 +16,12 @@ - Client 2 - Browser - SessionMonitor + Client 2 + Browser + SessionMonitor - CoordinationService - IdentityServer + CoordinationService + IdentityServer @@ -32,7 +32,7 @@ - Client 1 + Client 1 @@ -94,9 +94,9 @@ - token - invalid_grant - back-channellogout - key: 111 - key: 222 + token + invalid_grant + back-channellogout + key: 111 + key: 222