@@ -69,6 +69,56 @@ You can follow interaction schema below.
6969 @enduml
7070```
7171
72+ ``` mermaid
73+ sequenceDiagram
74+ participant "Client (User from Browser)" as Client
75+ participant "Syncmaster"
76+ participant "Keycloak"
77+
78+ Client ->> Syncmaster : Request endpoint that requires authentication (/v1/users)
79+
80+ Syncmaster --x Client: Redirect to Keycloak login URL (if no access token)
81+
82+ Client ->> Keycloak : Callback redirect to Keycloak login page
83+
84+ alt Successful login
85+ Client ->> Keycloak : Log in with login and password
86+ else Login failed
87+ Keycloak --x Client: Display error (401 Unauthorized)
88+ end
89+
90+ Keycloak ->> Client : Redirect to Syncmaster to callback endpoint with code
91+ Client ->> Syncmaster : Callback request to /v1/auth/callback with code
92+ Syncmaster->> Keycloak : Exchange code for access token
93+ Keycloak ->> Syncmaster : Return JWT token
94+ Syncmaster ->> Client : Set JWT token in user's browser in cookies and redirect /v1/users
95+
96+ Client ->> Syncmaster : Redirect to /v1/users
97+ Syncmaster ->> Syncmaster : Get user info from JWT token and check user in internal server database
98+ Syncmaster ->> Syncmaster : Create user in internal server database if not exist
99+ Syncmaster ->> Client: Return requested data
100+
101+
102+ alt Successful case
103+ Client ->> Syncmaster : Request data with JWT token
104+ Syncmaster ->> Syncmaster : Get user info from JWT token and check user in internal server database
105+ Syncmaster ->> Syncmaster : Create user in internal server database if not exist
106+ Syncmaster ->> Client: Return requested data
107+
108+ else Access token is expired
109+ Syncmaster ->> Keycloak : Get new JWT token via refresh token
110+ Keycloak ->> Syncmaster : Return new JWT token
111+ Syncmaster ->> Syncmaster : Get user info from JWT token and check user in internal server database
112+ Syncmaster ->> Syncmaster : Create user in internal server database if not exist
113+ Syncmaster ->> Client: Return requested data and set new JWT token in user's browser in cookies
114+
115+ else Refresh token is expired
116+ Syncmaster --x Client: Redirect to Keycloak login URL
117+ end
118+
119+ deactivate Client
120+ ```
121+
72122## Basic configuration { #keycloak-auth-provider-basic-configuration }
73123
74124::: syncmaster.server.settings.auth.keycloak.KeycloakAuthProviderSettings
0 commit comments