From b578961ab7ce39898f5d5063d8d3e70f37d5b5fc Mon Sep 17 00:00:00 2001 From: arekkas Date: Mon, 4 Dec 2017 11:11:06 +0100 Subject: [PATCH] docs: Adds consent state machine --- docs/images/consent-state.svg | 360 ++++++++++++++++++++++++++++++++++ docs/oauth2.md | 26 ++- 2 files changed, 383 insertions(+), 3 deletions(-) create mode 100644 docs/images/consent-state.svg diff --git a/docs/images/consent-state.svg b/docs/images/consent-state.svg new file mode 100644 index 0000000000..6cb49f0786 --- /dev/null +++ b/docs/images/consent-state.svg @@ -0,0 +1,360 @@ +
Redirects to consent app with consent request ID
Initiates Consent Flow
yes
no
Sign in failed
Sign in successful
User denies authorization
User accepts authorization
Redirect to redirectUrl value
Hydra
Consent App
Is the user signed in already?
Ask user to authorize requested scopes
Sign user in using login form
Tell Hydra to deny the consent request
Tell Hydra to accept the consent request with the granted scopes
Read redirectUrl value from consent request payload
Hydra
 \ No newline at end of file diff --git a/docs/oauth2.md b/docs/oauth2.md index a943a49849..2d847797b6 100644 --- a/docs/oauth2.md +++ b/docs/oauth2.md @@ -65,10 +65,29 @@ login service ("user management") and implement the consent flow with it. ### Flow Overview -Let's start with an overview of the consent flow: +Let us look at the sequence of requests being made to successfully perform an OAuth 2.0 authorize code flow using ORY Hydra: ![Consent flow](./images/consent-flow.svg) +The state machine of the consent app itself typically looks as followed. + +|Redirects to consent app with consent request ID| C{Consent App} +C -->|Initiates Consent Flow| CA(Is the user signed in already?) +CA -->|yes| CC(Ask user to authorize requested scopes) +CA -->|no| CL(Sign user in using login form) +CL -->|Sign in failed| CL +CL -->|Sign in successful| CC +CC -->|User denies authorization| CHD(Tell Hydra to deny the consent request) +CC -->|User accepts authorization| CHA(Tell Hydra to accept the consent request with the granted scopes) +CHD-->CHR(Read redirectUrl value from consent request payload) +CHA-->CHR +CHR-->|Redirect to redirectUrl value|H2{Hydra} +--> + +![](./images/consent-state.svg) + **Legend:** * User Agent: The "user agent" the user is using to access an app @@ -89,8 +108,9 @@ consent request. Here is how Google chose to design the login and consent UI (what we call the "consent app"): -![./images/google.png] -![./images/google2.png] +!()[./images/google.png] + +!()[./images/google2.png] ### Consent REST API