maddy/matrix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
development
matrix/Cygnus_Architecture_Overview.svg

360 lines
26 KiB
XML
Raw Permalink Blame History

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="3720" viewBox="0 0 1920 3720" role="img" aria-labelledby="title description">
<title id="title">Cygnus on-premises to cloud authentication architecture overview</title>
<desc id="description">Complete architecture, request flow, sequence diagram, security layers, code navigation, data access, session mapping, and failure behavior for Cygnus cloud identity authentication.</desc>
<defs>
<linearGradient id="pageBg" x1="0" y1="0" x2="0" y2="1">
<stop offset="0" stop-color="#eaf2f8"/>
<stop offset="1" stop-color="#d9e7f1"/>
</linearGradient>
<linearGradient id="heroBg" x1="0" y1="0" x2="1" y2="1">
<stop offset="0" stop-color="#173b5f"/>
<stop offset="1" stop-color="#28679b"/>
</linearGradient>
<linearGradient id="cloudBg" x1="0" y1="0" x2="1" y2="1">
<stop offset="0" stop-color="#e7f2fb"/>
<stop offset="1" stop-color="#d2e7f7"/>
</linearGradient>
<linearGradient id="onpremBg" x1="0" y1="0" x2="1" y2="1">
<stop offset="0" stop-color="#eef8f2"/>
<stop offset="1" stop-color="#dcefe3"/>
</linearGradient>
<filter id="shadow" x="-20%" y="-20%" width="140%" height="150%">
<feDropShadow dx="0" dy="5" stdDeviation="8" flood-color="#1c3448" flood-opacity=".16"/>
</filter>
<marker id="arrowBlue" markerWidth="12" markerHeight="12" refX="10" refY="6" orient="auto" markerUnits="strokeWidth">
<path d="M0,0 L12,6 L0,12 z" fill="#28679b"/>
</marker>
<marker id="arrowGreen" markerWidth="12" markerHeight="12" refX="10" refY="6" orient="auto" markerUnits="strokeWidth">
<path d="M0,0 L12,6 L0,12 z" fill="#26845b"/>
</marker>
<marker id="arrowOrange" markerWidth="12" markerHeight="12" refX="10" refY="6" orient="auto" markerUnits="strokeWidth">
<path d="M0,0 L12,6 L0,12 z" fill="#d47b17"/>
</marker>
<style>
text { font-family: Inter, "Segoe UI", Arial, sans-serif; fill: #22303d; }
.hero-title { font-size: 46px; font-weight: 750; fill: #fff; letter-spacing: .2px; }
.hero-sub { font-size: 22px; fill: #d7eafb; }
.section-title { font-size: 30px; font-weight: 750; fill: #173b5f; }
.section-sub { font-size: 17px; fill: #536777; }
.box-title { font-size: 20px; font-weight: 750; }
.box-sub { font-size: 14px; fill: #5a6f7f; }
.body { font-size: 16px; }
.small { font-size: 14px; }
.tiny { font-size: 12px; }
.mono { font-family: "SFMono-Regular", Consolas, "Liberation Mono", monospace; font-size: 13px; }
.white { fill: #fff; }
.muted { fill: #64798a; }
.blue { fill: #28679b; }
.green { fill: #26845b; }
.orange { fill: #c76c0f; }
.red { fill: #b74646; }
.bold { font-weight: 700; }
.card { fill: #fff; stroke: #b8cad8; stroke-width: 1.4; rx: 12; filter: url(#shadow); }
.soft-card { fill: #f7fafc; stroke: #c5d5e1; stroke-width: 1.2; rx: 10; }
.onprem { fill: url(#onpremBg); stroke: #83b99b; stroke-width: 1.5; rx: 12; }
.cloud { fill: url(#cloudBg); stroke: #81b2d5; stroke-width: 1.5; rx: 12; }
.security { fill: #fff6e7; stroke: #e2ae62; stroke-width: 1.4; rx: 10; }
.database { fill: #f2ecfa; stroke: #a991c6; stroke-width: 1.4; rx: 10; }
.line-blue { stroke: #28679b; stroke-width: 3; fill: none; marker-end: url(#arrowBlue); }
.line-green { stroke: #26845b; stroke-width: 3; fill: none; marker-end: url(#arrowGreen); }
.line-orange { stroke: #d47b17; stroke-width: 3; fill: none; marker-end: url(#arrowOrange); }
.dash { stroke-dasharray: 8 7; }
.lane { stroke: #9bb0bf; stroke-width: 1.5; stroke-dasharray: 6 6; }
.step-circle { fill: #28679b; stroke: #fff; stroke-width: 3; }
.step-number { font-size: 14px; font-weight: 750; fill: #fff; text-anchor: middle; dominant-baseline: central; }
.chip { fill: #e5eff7; stroke: #aec4d5; stroke-width: 1; rx: 14; }
</style>
</defs>
<rect width="1920" height="3720" fill="url(#pageBg)"/>
<!-- Hero -->
<rect x="50" y="42" width="1820" height="190" rx="20" fill="url(#heroBg)" filter="url(#shadow)"/>
<text x="105" y="112" class="hero-title">Cygnus Architecture Overview</text>
<text x="105" y="157" class="hero-sub">Secure on-premises → cloud identity authentication while operational and applicant data remain on customer infrastructure</text>
<rect x="105" y="180" width="212" height="30" class="chip" opacity=".22"/>
<text x="123" y="201" class="small white bold">JDK 21 · Spring MVC</text>
<rect x="330" y="180" width="245" height="30" class="chip" opacity=".22"/>
<text x="348" y="201" class="small white bold">Spring WebFlux client</text>
<rect x="588" y="180" width="280" height="30" class="chip" opacity=".22"/>
<text x="606" y="201" class="small white bold">Spring Boot cloud service</text>
<rect x="881" y="180" width="260" height="30" class="chip" opacity=".22"/>
<text x="899" y="201" class="small white bold">PostgreSQL + Vert.x</text>
<rect x="1154" y="180" width="212" height="30" class="chip" opacity=".22"/>
<text x="1172" y="201" class="small white bold">Redis replay guard</text>
<!-- Architecture overview -->
<text x="70" y="292" class="section-title">1 · Architecture overview</text>
<text x="70" y="322" class="section-sub">The browser-facing application remains on-premises. Authentication and menu ownership are delegated to the cloud through a reusable client.</text>
<rect x="70" y="352" width="1780" height="490" class="card"/>
<rect x="95" y="377" width="1050" height="440" class="onprem"/>
<text x="125" y="414" class="box-title green">CUSTOMER PREMISES</text>
<text x="125" y="439" class="box-sub">Applicant PII, punching, operations, reporting/MIS, JSP UI and HTTP session</text>
<rect x="130" y="480" width="210" height="126" class="soft-card"/>
<text x="235" y="520" class="box-title" text-anchor="middle">Browser</text>
<text x="235" y="550" class="small" text-anchor="middle">Login form / JSP UI</text>
<text x="235" y="576" class="tiny muted" text-anchor="middle">POST /ver/authenticatelogin</text>
<rect x="430" y="455" width="300" height="178" class="soft-card"/>
<text x="580" y="495" class="box-title" text-anchor="middle">cygnus-onprem-app</text>
<text x="580" y="524" class="small" text-anchor="middle">Spring MVC + embedded Tomcat</text>
<text x="580" y="552" class="tiny muted" text-anchor="middle">SessionController</text>
<text x="580" y="575" class="tiny muted" text-anchor="middle">CloudAuthenticationGateway</text>
<text x="580" y="598" class="tiny muted" text-anchor="middle">CloudSessionMapper</text>
<rect x="820" y="455" width="290" height="178" class="security"/>
<text x="965" y="495" class="box-title" text-anchor="middle">cygnus-cloud-client</text>
<text x="965" y="524" class="small" text-anchor="middle">Reusable WebClient gateway</text>
<text x="965" y="552" class="tiny muted" text-anchor="middle">OAuthMachineTokenProvider</text>
<text x="965" y="575" class="tiny muted" text-anchor="middle">LoginEnvelopeEncryptor</text>
<text x="965" y="598" class="tiny muted" text-anchor="middle">CloudIdentityClient</text>
<path d="M340 543 H420" class="line-green"/>
<text x="380" y="528" class="tiny green" text-anchor="middle">credentials</text>
<path d="M730 543 H810" class="line-green"/>
<text x="770" y="528" class="tiny green" text-anchor="middle">delegate</text>
<rect x="130" y="676" width="980" height="102" class="soft-card"/>
<text x="155" y="711" class="box-title">Existing on-premises application behavior retained</text>
<text x="155" y="741" class="small">Cloud response → legacy SessionValues + menu HTML → existing authorization, controllers, JSP pages and operational database access.</text>
<rect x="1190" y="377" width="635" height="440" class="cloud"/>
<text x="1220" y="414" class="box-title blue">CYGNUS CLOUD</text>
<text x="1220" y="439" class="box-sub">Vendor-controlled machine authorization, identity, permissions and menu data</text>
<rect x="1225" y="470" width="260" height="140" class="security"/>
<text x="1355" y="507" class="box-title" text-anchor="middle">OAuth endpoint</text>
<text x="1355" y="536" class="small" text-anchor="middle">POST /oauth2/token</text>
<text x="1355" y="564" class="tiny muted" text-anchor="middle">Validate nested machine assertion</text>
<text x="1355" y="586" class="tiny muted" text-anchor="middle">Issue short-lived RS256 JWT</text>
<rect x="1525" y="470" width="265" height="140" class="cloud"/>
<text x="1657" y="507" class="box-title" text-anchor="middle">Identity API</text>
<text x="1657" y="536" class="small" text-anchor="middle">POST /api/v1/identity/login</text>
<text x="1657" y="564" class="tiny muted" text-anchor="middle">Decrypt login envelope</text>
<text x="1657" y="586" class="tiny muted" text-anchor="middle">Authenticate and load menu</text>
<rect x="1225" y="660" width="260" height="110" class="database"/>
<text x="1355" y="699" class="box-title" text-anchor="middle">Redis</text>
<text x="1355" y="728" class="small" text-anchor="middle">Nonce replay protection</text>
<text x="1355" y="751" class="tiny muted" text-anchor="middle">Atomic claim + short TTL</text>
<rect x="1525" y="660" width="265" height="110" class="database"/>
<text x="1657" y="699" class="box-title" text-anchor="middle">PostgreSQL</text>
<text x="1657" y="728" class="small" text-anchor="middle">matrix.identity schema</text>
<text x="1657" y="751" class="tiny muted" text-anchor="middle">Vert.x prepared queries</text>
<path d="M1110 520 C1160 520 1160 520 1215 520" class="line-blue"/>
<text x="1162" y="504" class="tiny blue" text-anchor="middle">machine assertion</text>
<path d="M1110 585 C1320 625 1420 570 1515 540" class="line-blue"/>
<text x="1320" y="605" class="tiny blue" text-anchor="middle">Bearer JWT + encrypted login</text>
<path d="M1657 610 V650" class="line-blue"/>
<path d="M1600 610 C1515 640 1450 670 1490 710" class="line-blue"/>
<!-- Responsibility split -->
<text x="70" y="912" class="section-title">2 · Responsibility and data boundary</text>
<text x="70" y="942" class="section-sub">The split is deliberate: identity and non-PI control data can be cloud-managed without transferring loan-applicant PII.</text>
<rect x="70" y="972" width="855" height="265" class="card"/>
<text x="105" y="1014" class="box-title green">Remains on customer premises</text>
<text x="115" y="1054" class="body">• Punching and applicant intake</text>
<text x="115" y="1086" class="body">• Operational allocation, scanning, telecalling and reports</text>
<text x="115" y="1118" class="body">• Applicant PII, addresses, documents, photos and verification content</text>
<text x="115" y="1150" class="body">• MIS generation and existing JSP/HTTP-session application behavior</text>
<text x="115" y="1182" class="body">• Existing operational SQL, functions and views unrelated to cloud identity</text>
<rect x="945" y="972" width="905" height="265" class="card"/>
<text x="980" y="1014" class="box-title blue">Managed by Cygnus cloud</text>
<text x="990" y="1054" class="body">• Customer installation identity and machine authorization</text>
<text x="990" y="1086" class="body">• Application users, groups, companies and branches required at login</text>
<text x="990" y="1118" class="body">• Page permissions, denied pages and menu structure</text>
<text x="990" y="1150" class="body">• Authentication audit entry and cloud access-token issuance</text>
<text x="990" y="1182" class="body">• Redis nonce state used to reject replayed login envelopes</text>
<!-- Full runtime sequence -->
<text x="70" y="1307" class="section-title">3 · Full authentication sequence</text>
<text x="70" y="1337" class="section-sub">Every arrow below is part of one browser login. The access token is cached and reused until shortly before expiry.</text>
<rect x="70" y="1367" width="1780" height="1040" class="card"/>
<!-- Lane headers -->
<rect x="90" y="1390" width="220" height="62" class="soft-card"/>
<rect x="385" y="1390" width="245" height="62" class="onprem"/>
<rect x="705" y="1390" width="245" height="62" class="security"/>
<rect x="1025" y="1390" width="230" height="62" class="security"/>
<rect x="1330" y="1390" width="240" height="62" class="cloud"/>
<rect x="1640" y="1390" width="185" height="62" class="database"/>
<text x="200" y="1428" class="box-title" text-anchor="middle">Browser</text>
<text x="507" y="1428" class="box-title" text-anchor="middle">On-prem MVC</text>
<text x="827" y="1428" class="box-title" text-anchor="middle">Cloud client</text>
<text x="1140" y="1428" class="box-title" text-anchor="middle">OAuth service</text>
<text x="1450" y="1428" class="box-title" text-anchor="middle">Identity service</text>
<text x="1732" y="1428" class="box-title" text-anchor="middle">Redis / DB</text>
<line x1="200" y1="1452" x2="200" y2="2365" class="lane"/>
<line x1="507" y1="1452" x2="507" y2="2365" class="lane"/>
<line x1="827" y1="1452" x2="827" y2="2365" class="lane"/>
<line x1="1140" y1="1452" x2="1140" y2="2365" class="lane"/>
<line x1="1450" y1="1452" x2="1450" y2="2365" class="lane"/>
<line x1="1732" y1="1452" x2="1732" y2="2365" class="lane"/>
<!-- Sequence messages -->
<circle cx="95" cy="1500" r="15" class="step-circle"/><text x="95" y="1500" class="step-number">1</text>
<path d="M200 1500 H497" class="line-green"/>
<text x="348" y="1483" class="small bold" text-anchor="middle">POST login ID + password</text>
<text x="348" y="1523" class="tiny muted" text-anchor="middle">/ver/authenticatelogin</text>
<circle cx="95" cy="1575" r="15" class="step-circle"/><text x="95" y="1575" class="step-number">2</text>
<path d="M507 1575 H817" class="line-green"/>
<text x="662" y="1558" class="small bold" text-anchor="middle">CloudAuthenticationGateway.authenticate()</text>
<text x="662" y="1598" class="tiny muted" text-anchor="middle">Synchronous MVC → reactive client boundary</text>
<circle cx="95" cy="1650" r="15" class="step-circle"/><text x="95" y="1650" class="step-number">3</text>
<path d="M827 1650 H1130" class="line-orange"/>
<text x="978" y="1633" class="small bold" text-anchor="middle">POST machine assertion</text>
<text x="978" y="1673" class="tiny muted" text-anchor="middle">Only when cached access token is absent/expiring</text>
<circle cx="95" cy="1725" r="15" class="step-circle"/><text x="95" y="1725" class="step-number">4</text>
<path d="M1140 1725 H1440" class="line-orange"/>
<text x="1290" y="1708" class="small bold" text-anchor="middle">Decrypt JWE + verify signed inner JWT</text>
<text x="1290" y="1748" class="tiny muted" text-anchor="middle">Validate client ID, installation, audience and expiry</text>
<circle cx="95" cy="1800" r="15" class="step-circle"/><text x="95" y="1800" class="step-number">5</text>
<path d="M1140 1800 H837" class="line-orange"/>
<text x="988" y="1783" class="small bold" text-anchor="middle">Return short-lived RS256 access JWT</text>
<text x="988" y="1823" class="tiny muted" text-anchor="middle">Claims: client_id, installation_id, scope, issuer, audience, expiry</text>
<circle cx="95" cy="1885" r="15" class="step-circle"/><text x="95" y="1885" class="step-number">6</text>
<path d="M827 1885 H1440" class="line-blue"/>
<text x="1133" y="1868" class="small bold" text-anchor="middle">Bearer JWT + encrypted login envelope</text>
<text x="1133" y="1908" class="tiny muted" text-anchor="middle">AES-256-GCM payload; AES key wrapped by RSA-OAEP-256</text>
<circle cx="95" cy="1970" r="15" class="step-circle"/><text x="95" y="1970" class="step-number">7</text>
<path d="M1450 1970 H1722" class="line-blue"/>
<text x="1586" y="1953" class="small bold" text-anchor="middle">Atomically claim nonce in Redis</text>
<text x="1586" y="1993" class="tiny muted" text-anchor="middle">Reject duplicate; apply short TTL</text>
<circle cx="95" cy="2045" r="15" class="step-circle"/><text x="95" y="2045" class="step-number">8</text>
<path d="M1450 2045 H1722" class="line-blue"/>
<text x="1586" y="2028" class="small bold" text-anchor="middle">Vert.x prepared SQL queries</text>
<text x="1586" y="2068" class="tiny muted" text-anchor="middle">User → password check → menu → login audit</text>
<circle cx="95" cy="2120" r="15" class="step-circle"/><text x="95" y="2120" class="step-number">9</text>
<path d="M1450 2120 H837" class="line-blue"/>
<text x="1143" y="2103" class="small bold" text-anchor="middle">Authenticated identity + structured menu</text>
<text x="1143" y="2143" class="tiny muted" text-anchor="middle">User, group, company, branch, permissions and login time</text>
<circle cx="95" cy="2195" r="15" class="step-circle"/><text x="95" y="2195" class="step-number">10</text>
<path d="M827 2195 H517" class="line-green"/>
<text x="672" y="2178" class="small bold" text-anchor="middle">Map cloud response to legacy SessionValues</text>
<text x="672" y="2218" class="tiny muted" text-anchor="middle">Render menu HTML and preserve existing JSP expectations</text>
<circle cx="95" cy="2270" r="15" class="step-circle"/><text x="95" y="2270" class="step-number">11</text>
<path d="M507 2270 H210" class="line-green"/>
<text x="358" y="2253" class="small bold" text-anchor="middle">Store HTTP session and return home</text>
<text x="358" y="2293" class="tiny muted" text-anchor="middle">Existing authorization and UI flow continues</text>
<rect x="118" y="2330" width="1684" height="52" class="security"/>
<text x="960" y="2362" class="small bold" text-anchor="middle">Cloud identity is mandatory: there is no local password fallback. A cloud outage returns a controlled temporary-unavailable login message.</text>
<!-- Security model -->
<text x="70" y="2477" class="section-title">4 · Security model</text>
<text x="70" y="2507" class="section-sub">Machine identity, transport security, application-layer encryption and replay protection are separate layers.</text>
<rect x="70" y="2537" width="1780" height="410" class="card"/>
<rect x="95" y="2570" width="405" height="330" class="security"/>
<text x="125" y="2610" class="box-title orange">A · Machine assertion</text>
<text x="125" y="2645" class="small">1. Inner JWT signed by installation private key</text>
<text x="125" y="2674" class="small">2. Identifies client + installation</text>
<text x="125" y="2703" class="small">3. Nested inside RSA-OAEP-256 JWE</text>
<text x="125" y="2732" class="small">4. Cloud decrypts with assertion private key</text>
<text x="125" y="2761" class="small">5. Signature checked using registered client key</text>
<text x="125" y="2790" class="small">6. Assertion may be long-lived and is used only</text>
<text x="143" y="2816" class="small">to obtain short-lived access tokens</text>
<rect x="125" y="2845" width="335" height="34" class="chip"/>
<text x="292" y="2868" class="tiny bold" text-anchor="middle">Customer-specific asymmetric identity</text>
<rect x="530" y="2570" width="405" height="330" class="security"/>
<text x="560" y="2610" class="box-title orange">B · Access token</text>
<text x="560" y="2645" class="small">• RS256 signed by the cloud</text>
<text x="560" y="2674" class="small">• Short expiry; cached until refresh skew</text>
<text x="560" y="2703" class="small">• Bound to client ID and installation ID</text>
<text x="560" y="2732" class="small">• Carries identity.login scope</text>
<text x="560" y="2761" class="small">• Issuer and audience validated</text>
<text x="560" y="2790" class="small">• Required by Spring Security before the</text>
<text x="578" y="2816" class="small">cloud identity controller executes</text>
<rect x="560" y="2845" width="335" height="34" class="chip"/>
<text x="727" y="2868" class="tiny bold" text-anchor="middle">Machine authorization, not user session</text>
<rect x="965" y="2570" width="405" height="330" class="security"/>
<text x="995" y="2610" class="box-title orange">C · Login envelope</text>
<text x="995" y="2645" class="small">• Fresh random AES-256 key per request</text>
<text x="995" y="2674" class="small">• Credentials encrypted with AES-GCM</text>
<text x="995" y="2703" class="small">• AES key encrypted by cloud RSA key</text>
<text x="995" y="2732" class="small">• GCM detects ciphertext tampering</text>
<text x="995" y="2761" class="small">• Payload contains nonce and timestamp</text>
<text x="995" y="2790" class="small">• Client/installation values must match</text>
<text x="1013" y="2816" class="small">the authenticated access-token claims</text>
<rect x="995" y="2845" width="335" height="34" class="chip"/>
<text x="1162" y="2868" class="tiny bold" text-anchor="middle">Application encryption in addition to TLS</text>
<rect x="1400" y="2570" width="405" height="330" class="security"/>
<text x="1430" y="2610" class="box-title orange">D · Replay and transport</text>
<text x="1430" y="2645" class="small">• Redis SET-if-absent claims each nonce</text>
<text x="1430" y="2674" class="small">• Duplicate nonce is rejected</text>
<text x="1430" y="2703" class="small">• Timestamp freshness window enforced</text>
<text x="1430" y="2732" class="small">• HTTPS is mandatory outside local dev</text>
<text x="1430" y="2761" class="small">• Credentials and tokens are not logged</text>
<text x="1430" y="2790" class="small">• Private keys and assertions require</text>
<text x="1448" y="2816" class="small">owner-only storage and rotation controls</text>
<rect x="1430" y="2845" width="335" height="34" class="chip"/>
<text x="1597" y="2868" class="tiny bold" text-anchor="middle">Captured requests cannot be reused</text>
<!-- Cloud login internals -->
<text x="70" y="3017" class="section-title">5 · Cloud login internals and session compatibility</text>
<text x="70" y="3047" class="section-sub">Prepared SQL retrieves only the identity data needed to preserve the existing SessionValues contract.</text>
<rect x="70" y="3077" width="1095" height="500" class="card"/>
<text x="105" y="3120" class="box-title blue">Cloud identity processing</text>
<circle cx="125" cy="3170" r="14" class="step-circle"/><text x="125" y="3170" class="step-number">1</text>
<text x="155" y="3176" class="body">Decrypt payload and validate machine binding, timestamp and nonce.</text>
<circle cx="125" cy="3225" r="14" class="step-circle"/><text x="125" y="3225" class="step-number">2</text>
<text x="155" y="3231" class="body">Load active user by case-insensitive login ID from identity.app_user.</text>
<circle cx="125" cy="3280" r="14" class="step-circle"/><text x="125" y="3280" class="step-number">3</text>
<text x="155" y="3286" class="body">Verify password using the compatible legacy password verifier.</text>
<circle cx="125" cy="3335" r="14" class="step-circle"/><text x="125" y="3335" class="step-number">4</text>
<text x="155" y="3341" class="body">Load group, company and branch details.</text>
<circle cx="125" cy="3390" r="14" class="step-circle"/><text x="125" y="3390" class="step-number">5</text>
<text x="155" y="3396" class="body">Load visible permitted pages and exclude explicitly denied pages.</text>
<circle cx="125" cy="3445" r="14" class="step-circle"/><text x="125" y="3445" class="step-number">6</text>
<text x="155" y="3451" class="body">Insert cloud login audit row and return structured identity/menu response.</text>
<rect x="105" y="3490" width="1025" height="58" class="database"/>
<text x="617" y="3514" class="small bold" text-anchor="middle">Vert.x prepared queries keep values separate from SQL text</text>
<text x="617" y="3538" class="tiny muted" text-anchor="middle">Tables: identity.app_user · user_group · company · company_branch · permission · pages · denied_pages · user_loginhistory</text>
<rect x="1195" y="3077" width="655" height="500" class="card"/>
<text x="1230" y="3120" class="box-title green">Legacy compatibility mapping</text>
<text x="1230" y="3158" class="small bold">CloudSessionMapper populates:</text>
<text x="1250" y="3192" class="small">• User ID, login ID and display name</text>
<text x="1250" y="3222" class="small">• Group ID and group name</text>
<text x="1250" y="3252" class="small">• Company ID, name and code</text>
<text x="1250" y="3282" class="small">• Branch ID, name, code and location</text>
<text x="1250" y="3312" class="small">• Login timestamp in the legacy format</text>
<text x="1250" y="3342" class="small">• Menu HTML rendered from cloud menu records</text>
<rect x="1230" y="3380" width="585" height="116" class="onprem"/>
<text x="1522" y="3414" class="small bold" text-anchor="middle">No local password query or fallback remains</text>
<text x="1522" y="3443" class="small" text-anchor="middle">Existing JSP controllers keep reading SessionValues</text>
<text x="1522" y="3472" class="small" text-anchor="middle">Operational authorization continues without UI rewrites</text>
<text x="1230" y="3535" class="tiny muted">Logout currently invalidates the local HTTP session. A cloud logout/audit API is the future option if logout timestamps are required.</text>
<!-- Code navigation and failures -->
<text x="70" y="3647" class="section-title">6 · Code navigation</text>
<text x="70" y="3677" class="section-sub">Primary implementation points: SessionController → CloudAuthenticationGateway → OAuthMachineTokenProvider / LoginEnvelopeEncryptor → CloudLoginController → IdentityAuthenticationService → IdentityRepository → CloudSessionMapper.</text>
<!-- Footer strip overlays final area intentionally within document bounds -->
<rect x="50" y="3695" width="1820" height="1" fill="#9eb5c5"/>
</svg>
Reference in New Issue View Git Blame Copy Permalink