Solution architecture: Authentication and organisational relationship

[janhalen]

The goal is to define a to-be solution architecture that is robust, reusable and reproducable for identity and access management.

International Cloud Native best-practices has been applied, and it is designed to harvest the benefits of delpying with GitOps.

It aims to deliver on these highlevel issues:

• Adgangsstyring via FKA - og andre login behov?
• Rettighedsstyring (organisation) #2

A good strategic fit, looking at the OS2 portfolio as a whole, would be to participate and adopt the OS2adgang project.

This will deliver a loosely coupled and reusable architecture based on open standards.

[janhalen]

Here is a work in progress starting point for an architectural discussion:

@hypesystem

C4Context
  title System Context diagram - Fælleskommunal Adgangsstyring og Organisations data
  
  %% --- The Entire Enterprise Context ---
  Enterprise_Boundary(OrgBoundary, "Os2AI") {

    %% APPLICATION DOMAIN
    System_Boundary(Application, "Application Domain") {
      System(appA, "UI-app", "")
      System(appC, "Integration-app", "")
    }
          
    %% PLATFORM DOMAIN
    System_Boundary(platform, "Platform Service Domain") {
      Container_Boundary(Keycloak, "Identity & Acess Management") {
        Container(keycloak_core, Identity & Access Management, "Keycloak", "Manages authentication, authorization, and security")
        %% Component definition inside the Container for visual grouping
        Component(spi, "Metadata Adapter", "Keycloak SPI - fk_org.jar", "Fetches attributes via SOAP and maps to OIDC claims")
      }
      System_Boundary(configmaps, "ConfigMaps") {
        Component(config, "FKA IDP config", "ConfigMap - realm.json", "Realm & broker configuration")
      }
    }
  }


Enterprise_Boundary(KOMBITBoundary, "KOMBIT") {
    System_Ext(fkadg, "Fælleskommunal Adgangsstyring (FKA)", "SAML Idp")
    System_Ext(fkorg, "Fælleskommunal Organisation (FKO)", "SOAP/XML Metadata attributes/roles.")
}
  
  
  %% --- Relationships (The Flow) ---

  %% Identity Brokering
  Rel(keycloak_core, config, "Read config")
  Rel(keycloak_core, fkadg, "SAML Identity Lookup")
  Rel(keycloak_core, spi,"Provide user context")
  Rel(spi, fkorg, "Metadata Lookup", "SOAP/XML over HTTPS")
  Rel(keycloak_core, appA, "Authentication", "OpenID Connect")
  Rel(keycloak_core, appC, "Authenticated User", "OpenID Connect")
  
  UpdateLayoutConfig($c4ShapeInRow="2")

Loading

[janhalen]

To be compliant with the national danish architectural recommendatations and furthermore to make sure that the investment made in this can deliver value to more OS2 projects and products in the future, I strongly advice the "spor-2" OS2ai development track to participate in the development of and adopt and integrate OS2adgang.

See the projects issue tracker here: https://github.com/OS2sandbox/os2adgang-planning.