donghyeon.kang/document-haness
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

feat: 가상화 문서들 추가

Browse Source
This commit is contained in:
DongHyeonka
2026-09-10 08:54:05 +09:00
parent e9f6a93327
commit 43e1aadef0
695 changed files with 153404 additions and 12754 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/keycloak/final/assets/ap4-edge-trust-architecture/ap4-edge-trust-architecture.alt.md
+9 -9
View File
@@ -10,15 +10,15 @@
## Elements and evidence
- **Boundary: External browser** (system): AP4_SESSION을 애플리케이션의 공개 entry point로 보내는 외부 client 경계. Evidence: L914–L919, L980–L999.
- **Boundary: AP4 deployment path** (system): Host-published Nginx와 host 비공개 oauth2-proxy 및 Spring app이 연결되는 deployment 경계. Evidence: L914–L914, L1093–L1093.
- **Browser** (actor): Opaque AP4_SESSION을 자동 첨부해 공개 edge endpoint를 호출한다. Evidence: L980–L999.
- **Nginx edge** (service): Internal auth subrequest를 만들고 검증 결과를 allowlisted upstream header로 다시 조립하는 공개 gateway. Evidence: L914–L928, L1009–L1028.
- **Spring upstream** (service): 정제된 user header와 Nginx-owned internal token을 함께 검증하는 /edge/me upstream. Evidence: L1017–L1037, L1065–L1078.
- **oauth2-proxy** (service): Confidential edge-proxy client이자 AP4_SESSION의 유효성을 판단하는 host 비공개 auth service. Evidence: L940–L990, L1009–L1014.
- **Boundary: External browser** (system): AP4_SESSION을 애플리케이션의 공개 entry point로 보내는 외부 client 경계. Evidence: L952–L957, L1018–L1039.
- **Boundary: AP4 deployment path** (system): Host-published Nginx와 host 비공개 oauth2-proxy 및 Spring app이 연결되는 deployment 경계. Evidence: L952–L952, L1133–L1133.
- **Browser** (actor): Opaque AP4_SESSION을 자동 첨부해 공개 edge endpoint를 호출한다. Evidence: L1018–L1039.
- **Nginx edge** (service): Internal auth subrequest를 만들고 검증 결과를 allowlisted upstream header로 다시 조립하는 공개 gateway. Evidence: L952–L966, L1049–L1068.
- **Spring upstream** (service): 정제된 user header와 Nginx-owned internal token을 함께 검증하는 /edge/me upstream. Evidence: L1057–L1077, L1105–L1118.
- **oauth2-proxy** (service): Confidential edge-proxy client이자 AP4_SESSION의 유효성을 판단하는 host 비공개 auth service. Evidence: L978–L1028, L1049–L1054.
## Relationships
- **Browser → Nginx edge:** GET /api/edge · AP4_SESSION. Evidence: L994–L999.
- **Nginx edge → oauth2-proxy:** internal /oauth2/auth subrequest. Evidence: L922–L928, L1009–L1009.
- **Nginx edge → Spring upstream:** allowlisted identity + internal token. Evidence: L1017–L1026, L1065–L1078.
- **Browser → Nginx edge:** AP4_SESSION. Evidence: L1034–L1039.
- **Nginx edge → oauth2-proxy:** auth subrequest. Evidence: L960–L966, L1049–L1049.
- **Nginx edge → Spring upstream:** identity. Evidence: L1057–L1066, L1105–L1118.
docs/keycloak/final/assets/ap4-edge-trust-architecture/ap4-edge-trust-architecture.d2
+3 -3
View File
@@ -17,6 +17,6 @@ g1: "AP4 deployment path" {
shape: rectangle
}
}
g0.n0 -> g1.n1: "GET /api/edge · AP4_SESSION"
g1.n1 -> g1.n3: "internal /oauth2/auth subrequest"
g1.n1 -> g1.n2: "allowlisted identity + internal token"
g0.n0 -> g1.n1: "AP4_SESSION"
g1.n1 -> g1.n3: "auth subrequest"
g1.n1 -> g1.n2: "identity"
docs/keycloak/final/assets/ap4-edge-trust-architecture/ap4-edge-trust-architecture.dot
+3 -3
View File
@@ -16,7 +16,7 @@ digraph techviz {
n2 [label="Spring upstream", shape=box, style="rounded,filled"];
n3 [label="oauth2-proxy", shape=box, style="rounded,filled"];
}
n0 -> n1 [label="GET /api/edge · AP4_SESSION", style=solid];
n1 -> n3 [label="internal /oauth2/auth subrequest", style=solid];
n1 -> n2 [label="allowlisted identity + internal token", style=solid];
n0 -> n1 [label="AP4_SESSION", style=solid];
n1 -> n3 [label="auth subrequest", style=solid];
n1 -> n2 [label="identity", style=solid];
}
docs/keycloak/final/assets/ap4-edge-trust-architecture/ap4-edge-trust-architecture.drawio
+17 -17
View File
@@ -1,41 +1,41 @@
<?xml version="1.0" encoding="UTF-8"?>
<mxfile host="app.diagrams.net" modified="2026-07-23T00:00:00.000Z" agent="techviz-harness" version="24.7.17" type="device">
<diagram id="ap4-edge-trust-architecture" name="AP4는 공개 edge에서 session을 정제된 upstream identity로 바꾼다">
<mxGraphModel dx="1080" dy="416" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1080" pageHeight="1169" math="0" shadow="0">
<mxGraphModel dx="1039" dy="451" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1039" pageHeight="1169" math="0" shadow="0">
<root>
<mxCell id="0"/>
<mxCell id="1" parent="0"/>
<mxCell id="g_external-client-zone" value="External browser" style="swimlane;html=1;rounded=1;startSize=30;horizontal=1;dashed=1;strokeWidth=1.5;fillColor=#f7f9fb;strokeColor=#66788a;fontStyle=1;fontSize=13;" vertex="1" parent="1">
<mxGeometry x="45.0" y="49.0" width="250.0" height="156.0" as="geometry"/>
<mxGeometry x="40.0" y="142.5" width="230.0" height="156.0" as="geometry"/>
</mxCell>
<mxCell id="g_ap4-deployment-zone" value="AP4 deployment path" style="swimlane;html=1;rounded=1;startSize=30;horizontal=1;dashed=1;strokeWidth=1.5;fillColor=#f7f9fb;strokeColor=#66788a;fontStyle=1;fontSize=13;" vertex="1" parent="1">
<mxGeometry x="565.0" y="49.0" width="470.0" height="322.0" as="geometry"/>
<mxGeometry x="370.0" y="35.0" width="624.0" height="371.0" as="geometry"/>
</mxCell>
<mxCell id="n_browser" value="Browser&lt;br/&gt;HttpOnly AP4_SESSION" tooltip="Opaque AP4_SESSION을 자동 첨부해 공개 edge endpoint를 호출한다. | Evidence: L980-L999" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;dashed=1;fillColor=#f5f7fa;" vertex="1" parent="1">
<mxGeometry x="75.0" y="95.0" width="190.0" height="84.0" as="geometry"/>
<mxCell id="n_browser" value="Browser&lt;br/&gt;HttpOnly AP4_SESSION" tooltip="Opaque AP4_SESSION을 자동 첨부해 공개 edge endpoint를 호출한다. | Evidence: L1018-L1039" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;dashed=1;fillColor=#f5f7fa;" vertex="1" parent="1">
<mxGeometry x="70.0" y="188.5" width="170.0" height="84.0" as="geometry"/>
</mxCell>
<mxCell id="n_nginx" value="Nginx edge&lt;br/&gt;auth_request&lt;br/&gt;client header overwrite" tooltip="Internal auth subrequest를 만들고 검증 결과를 allowlisted upstream header로 다시 조립하는 공개 gateway. | Evidence: L914-L928, L1009-L1028" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;strokeColor=#2563eb;strokeWidth=2;" vertex="1" parent="1">
<mxGeometry x="595.0" y="95.0" width="190.0" height="88.0" as="geometry"/>
<mxCell id="n_nginx" value="Nginx edge&lt;br/&gt;/api/edge&lt;br/&gt;auth_request&lt;br/&gt;client header overwrite" tooltip="Internal auth subrequest를 만들고 검증 결과를 allowlisted upstream header로 다시 조립하는 공개 gateway. | Evidence: L952-L966, L1049-L1068" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;strokeColor=#2563eb;strokeWidth=2;" vertex="1" parent="1">
<mxGeometry x="400.0" y="178.0" width="195.0" height="105.0" as="geometry"/>
</mxCell>
<mxCell id="n_spring-upstream" value="Spring upstream&lt;br/&gt;X-Auth-Request-User&lt;br/&gt;X-Auth-Request-Email&lt;br/&gt;X-Internal-Auth-Token&lt;br/&gt;/edge/me controller check" tooltip="정제된 user header와 Nginx-owned internal token을 함께 검증하는 /edge/me upstream. | Evidence: L1017-L1037, L1065-L1078" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
<mxGeometry x="815.0" y="95.0" width="190.0" height="122.0" as="geometry"/>
<mxCell id="n_oauth2-proxy" value="oauth2-proxy&lt;br/&gt;edge-proxy client&lt;br/&gt;minimal cookie session&lt;br/&gt;returns user · email" tooltip="Confidential edge-proxy client이자 AP4_SESSION의 유효성을 판단하는 host 비공개 auth service. | Evidence: L978-L1028, L1049-L1054" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
<mxGeometry x="765.5" y="81.0" width="188.0" height="105.0" as="geometry"/>
</mxCell>
<mxCell id="n_oauth2-proxy" value="oauth2-proxy&lt;br/&gt;edge-proxy client&lt;br/&gt;minimal cookie session&lt;br/&gt;returns user · email" tooltip="Confidential edge-proxy client이자 AP4_SESSION의 유효성을 판단하는 host 비공개 auth service. | Evidence: L940-L990, L1009-L1014" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
<mxGeometry x="595.0" y="240.0" width="190.0" height="105.0" as="geometry"/>
<mxCell id="n_spring-upstream" value="Spring upstream&lt;br/&gt;X-Auth-Request-User&lt;br/&gt;X-Auth-Request-Email&lt;br/&gt;X-Internal-Auth-Token&lt;br/&gt;/edge/me controller check" tooltip="정제된 user header와 Nginx-owned internal token을 함께 검증하는 /edge/me upstream. | Evidence: L1057-L1077, L1105-L1118" style="whiteSpace=wrap;html=1;rounded=1;strokeWidth=2;fontSize=14;fontStyle=1;fillColor=#ffffff;strokeColor=#2d4357;verticalAlign=middle;" vertex="1" parent="1">
<mxGeometry x="755.0" y="258.0" width="209.0" height="122.0" as="geometry"/>
</mxCell>
<mxCell id="e_browser-to-nginx" value="GET /api/edge · AP4_SESSION" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_browser" target="n_nginx">
<mxCell id="e_browser-to-nginx" value="AP4_SESSION" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_browser" target="n_nginx">
<mxGeometry relative="1" as="geometry">
<mxPoint x="454.0" y="138.0" as="offset"/>
<mxPoint x="320.0" y="202.5" as="offset"/>
</mxGeometry>
</mxCell>
<mxCell id="e_nginx-to-oauth2-proxy" value="internal /oauth2/auth subrequest" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_nginx" target="n_oauth2-proxy">
<mxCell id="e_nginx-to-oauth2-proxy" value="auth subrequest" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_nginx" target="n_oauth2-proxy">
<mxGeometry relative="1" as="geometry">
<mxPoint x="714.0" y="220.2" as="offset"/>
<mxPoint x="704.2" y="177.5" as="offset"/>
</mxGeometry>
</mxCell>
<mxCell id="e_nginx-to-upstream" value="allowlisted identity + internal token" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_nginx" target="n_spring-upstream">
<mxCell id="e_nginx-to-upstream" value="identity" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;endArrow=block;endFill=1;" edge="1" parent="1" source="n_nginx" target="n_spring-upstream">
<mxGeometry relative="1" as="geometry">
<mxPoint x="787.0" y="31.0" as="offset"/>
<mxPoint x="699.0" y="279.2" as="offset"/>
</mxGeometry>
</mxCell>
</root>
docs/keycloak/final/assets/ap4-edge-trust-architecture/ap4-edge-trust-architecture.excalidraw
+151 -159
View File
@@ -6,9 +6,9 @@
{
"id": "group-external-client-zone",
"type": "rectangle",
"x": 45.0,
"y": 49.0,
"width": 250.0,
"x": 40.0,
"y": 142.5,
"width": 230.0,
"height": 156.0,
"angle": 0,
"strokeColor": "#1e1e1e",
@@ -36,8 +36,8 @@
{
"id": "group-label-external-client-zone",
"type": "text",
"x": 61.0,
"y": 55.0,
"x": 56.0,
"y": 148.5,
"width": 144,
"height": 24,
"angle": 0,
@@ -75,10 +75,10 @@
{
"id": "group-ap4-deployment-zone",
"type": "rectangle",
"x": 565.0,
"y": 49.0,
"width": 470.0,
"height": 322.0,
"x": 370.0,
"y": 35.0,
"width": 624.0,
"height": 371.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "#f8f9fa",
@@ -105,8 +105,8 @@
{
"id": "group-label-ap4-deployment-zone",
"type": "text",
"x": 581.0,
"y": 55.0,
"x": 386.0,
"y": 41.0,
"width": 171,
"height": 24,
"angle": 0,
@@ -144,10 +144,10 @@
{
"id": "edge-browser-to-nginx",
"type": "arrow",
"x": 265.0,
"y": 137.0,
"width": 330.0,
"height": 2.0,
"x": 240.0,
"y": 230.5,
"width": 160.0,
"height": 0.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
@@ -174,16 +174,16 @@
0.0
],
[
165.0,
80.0,
0.0
],
[
165.0,
2.0
80.0,
0.0
],
[
330.0,
2.0
160.0,
0.0
]
],
"lastCommittedPoint": null,
@@ -204,9 +204,9 @@
{
"id": "edge-label-browser-to-nginx",
"type": "text",
"x": 346.0,
"y": 126.0,
"width": 216,
"x": 275.0,
"y": 190.5,
"width": 90,
"height": 24,
"angle": 0,
"strokeColor": "#1e1e1e",
@@ -232,11 +232,11 @@
"locked": false,
"fontSize": 13,
"fontFamily": 5,
"text": "GET /api/edge · AP4_SESSION",
"text": "AP4_SESSION",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "GET /api/edge · AP4_SESSION",
"originalText": "AP4_SESSION",
"autoResize": true,
"lineHeight": 1.25
},
@@ -244,9 +244,9 @@
"id": "edge-nginx-to-oauth2-proxy",
"type": "arrow",
"x": 595.0,
"y": 148.0,
"width": 190.0,
"height": 144.5,
"y": 133.5,
"width": 170.5,
"height": 88.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
@@ -268,21 +268,21 @@
"link": null,
"locked": false,
"points": [
[
190.0,
0.0
],
[
95.0,
0.0
],
[
95.0,
144.5
],
[
0.0,
144.5
88.0
],
[
85.25,
88.0
],
[
85.25,
0.0
],
[
170.5,
0.0
]
],
"lastCommittedPoint": null,
@@ -303,9 +303,9 @@
{
"id": "edge-label-nginx-to-oauth2-proxy",
"type": "text",
"x": 586.0,
"y": 208.25,
"width": 256,
"x": 644.25,
"y": 165.5,
"width": 120,
"height": 24,
"angle": 0,
"strokeColor": "#1e1e1e",
@@ -331,21 +331,21 @@
"locked": false,
"fontSize": 13,
"fontFamily": 5,
"text": "internal /oauth2/auth subrequest",
"text": "auth subrequest",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "internal /oauth2/auth subrequest",
"originalText": "auth subrequest",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "edge-nginx-to-upstream",
"type": "arrow",
"x": 785.0,
"y": 59.0,
"width": 30.0,
"height": 97.0,
"x": 595.0,
"y": 239.5,
"width": 160.0,
"height": 79.5,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
@@ -369,27 +369,19 @@
"points": [
[
0.0,
71.0
],
[
30.0,
71.0
],
[
30.0,
0.0
],
[
0.0,
80.0,
0.0
],
[
0.0,
97.0
80.0,
79.5
],
[
30.0,
97.0
160.0,
79.5
]
],
"lastCommittedPoint": null,
@@ -410,9 +402,9 @@
{
"id": "edge-label-nginx-to-upstream",
"type": "text",
"x": 639.0,
"y": 19.0,
"width": 296,
"x": 654.0,
"y": 267.25,
"width": 90,
"height": 24,
"angle": 0,
"strokeColor": "#1e1e1e",
@@ -438,20 +430,20 @@
"locked": false,
"fontSize": 13,
"fontFamily": 5,
"text": "allowlisted identity + internal token",
"text": "identity",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "allowlisted identity + internal token",
"originalText": "identity",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "node-browser",
"type": "rectangle",
"x": 75.0,
"y": 95.0,
"width": 190.0,
"x": 70.0,
"y": 188.5,
"width": 170.0,
"height": 84.0,
"angle": 0,
"strokeColor": "#1e1e1e",
@@ -479,9 +471,9 @@
{
"id": "node-label-browser",
"type": "text",
"x": 85.0,
"y": 105.0,
"width": 170.0,
"x": 80.0,
"y": 198.5,
"width": 150.0,
"height": 64.0,
"angle": 0,
"strokeColor": "#1e1e1e",
@@ -518,10 +510,10 @@
{
"id": "node-nginx",
"type": "rectangle",
"x": 595.0,
"y": 95.0,
"width": 190.0,
"height": 88.0,
"x": 400.0,
"y": 178.0,
"width": 195.0,
"height": 105.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "#ffffff",
@@ -548,10 +540,10 @@
{
"id": "node-label-nginx",
"type": "text",
"x": 605.0,
"y": 105.0,
"width": 170.0,
"height": 68.0,
"x": 410.0,
"y": 188.0,
"width": 175.0,
"height": 85.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
@@ -576,89 +568,20 @@
"locked": false,
"fontSize": 15,
"fontFamily": 5,
"text": "Nginx edge\nauth_request\nclient header overwrite",
"text": "Nginx edge\n/api/edge\nauth_request\nclient header overwrite",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "Nginx edge\nauth_request\nclient header overwrite",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "node-spring-upstream",
"type": "rectangle",
"x": 815.0,
"y": 95.0,
"width": 190.0,
"height": 122.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "#ffffff",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 1886263514,
"version": 1,
"versionNonce": 1117537622,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false
},
{
"id": "node-label-spring-upstream",
"type": "text",
"x": 825.0,
"y": 105.0,
"width": 170.0,
"height": 102.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 1165629413,
"version": 1,
"versionNonce": 1538645325,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 15,
"fontFamily": 5,
"text": "Spring upstream\nX-Auth-Request-User\nX-Auth-Request-Email\nX-Internal-Auth-Token\n/edge/me controller check",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "Spring upstream\nX-Auth-Request-User\nX-Auth-Request-Email\nX-Internal-Auth-Token\n/edge/me controller check",
"originalText": "Nginx edge\n/api/edge\nauth_request\nclient header overwrite",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "node-oauth2-proxy",
"type": "rectangle",
"x": 595.0,
"y": 240.0,
"width": 190.0,
"x": 765.5,
"y": 81.0,
"width": 188.0,
"height": 105.0,
"angle": 0,
"strokeColor": "#1e1e1e",
@@ -686,9 +609,9 @@
{
"id": "node-label-oauth2-proxy",
"type": "text",
"x": 605.0,
"y": 250.0,
"width": 170.0,
"x": 775.5,
"y": 91.0,
"width": 168.0,
"height": 85.0,
"angle": 0,
"strokeColor": "#1e1e1e",
@@ -721,6 +644,75 @@
"originalText": "oauth2-proxy\nedge-proxy client\nminimal cookie session\nreturns user · email",
"autoResize": true,
"lineHeight": 1.25
},
{
"id": "node-spring-upstream",
"type": "rectangle",
"x": 755.0,
"y": 258.0,
"width": 209.0,
"height": 122.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "#ffffff",
"fillStyle": "solid",
"strokeWidth": 2,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 1886263514,
"version": 1,
"versionNonce": 1117537622,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false
},
{
"id": "node-label-spring-upstream",
"type": "text",
"x": 765.0,
"y": 268.0,
"width": 189.0,
"height": 102.0,
"angle": 0,
"strokeColor": "#1e1e1e",
"backgroundColor": "transparent",
"fillStyle": "solid",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 0,
"opacity": 100,
"groupIds": [],
"frameId": null,
"index": null,
"roundness": {
"type": 3
},
"seed": 1165629413,
"version": 1,
"versionNonce": 1538645325,
"isDeleted": false,
"boundElements": [],
"updated": 0,
"link": null,
"locked": false,
"fontSize": 15,
"fontFamily": 5,
"text": "Spring upstream\nX-Auth-Request-User\nX-Auth-Request-Email\nX-Internal-Auth-Token\n/edge/me controller check",
"textAlign": "center",
"verticalAlign": "middle",
"containerId": null,
"originalText": "Spring upstream\nX-Auth-Request-User\nX-Auth-Request-Email\nX-Internal-Auth-Token\n/edge/me controller check",
"autoResize": true,
"lineHeight": 1.25
}
],
"appState": {
docs/keycloak/final/assets/ap4-edge-trust-architecture/ap4-edge-trust-architecture.manifest.json
+7 -7
View File
@@ -2,14 +2,14 @@
"harness_version": "0.2.0",
"spec_id": "ap4-edge-trust-architecture",
"spec_version": "1.1",
"spec_sha256": "c236660298ed5ff0bc3b8ce960fccdffefe7d45047f379c4067bfd2934d0e0b9",
"spec_sha256": "8ebbe718a7c7581b0e6d398fbf0e67e0c1ac32ac06e4d1b2f1127ac0a5649935",
"source_context": {
"document": "document.md",
"document_sha256": "df4d1a604c74e756672b5b40510abfedb8c67b39af280a5f51985ea9972f5371",
"document_sha256": "e2cc061f683294c937f089ad874cbf7a617f7313c07a92c2148fb11287a0da37",
"anchor": {
"kind": "marker",
"value": "ap4-edge-trust-architecture",
"line": 182
"kind": "heading",
"value": "AP4: OAuth를 모르는 upstream 앞에서 신뢰 경로를 만든다",
"line": 202
}
},
"outputs": [
@@ -24,9 +24,9 @@
"lint_issue_count": 0,
"assumption_count": 0,
"assumptions_allowed": false,
"composition_profile": "two-zone-pipeline",
"composition_profile": "component-flow",
"reference_ids": [
"localization-pipeline"
"payment-event-flow"
],
"diagram_only": true
}
docs/keycloak/final/assets/ap4-edge-trust-architecture/ap4-edge-trust-architecture.mmd
+3 -3
View File
@@ -9,8 +9,8 @@ flowchart LR
n2["Spring upstream"]
n3["oauth2-proxy"]
end
n0 -->|"GET /api/edge · AP4_SESSION"| n1
n1 -->|"internal /oauth2/auth subrequest"| n3
n1 -->|"allowlisted identity + internal token"| n2
n0 -->|"AP4_SESSION"| n1
n1 -->|"auth subrequest"| n3
n1 -->|"identity"| n2
classDef external stroke-dasharray: 6 4
class n0 external
docs/keycloak/final/assets/ap4-edge-trust-architecture/ap4-edge-trust-architecture.svg
+41 -40
View File
@@ -1,8 +1,8 @@
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="1080" height="416" viewBox="0 0 1080 416" role="img" aria-labelledby="diagram-title diagram-description">
<svg xmlns="http://www.w3.org/2000/svg" width="1039" height="451" viewBox="0 0 1039 451" role="img" aria-labelledby="diagram-title diagram-description">
<title id="diagram-title">AP4는 공개 edge에서 session을 정제된 upstream identity로 바꾼다</title>
<desc id="diagram-description">왼쪽 외부 브라우저가 AP4_SESSION과 함께 AP4 deployment path의 공개 Nginx entry point를 호출한다. 같은 deployment path에서 Nginx는 host 비공개 oauth2-proxy의 internal /oauth2/auth endpoint에 subrequest를 보내 session을 검증하고 user와 email 결과를 받는다. 이어서 client가 보낸 동명 header를 덮어쓰고 Nginx-owned identity header와 internal token을 host 비공개 Spring upstream의 /edge/me로 전달한다. Upstream은 user header와 internal token을 함께 확인하며 JWT를 직접 입력으로 받지 않는다.</desc>
<metadata>{&quot;techviz&quot;:{&quot;spec_version&quot;:&quot;1.1&quot;,&quot;id&quot;:&quot;ap4-edge-trust-architecture&quot;,&quot;profile&quot;:&quot;two-zone-pipeline&quot;},&quot;source_context&quot;:{&quot;document&quot;:&quot;document.md&quot;,&quot;document_sha256&quot;:&quot;df4d1a604c74e756672b5b40510abfedb8c67b39af280a5f51985ea9972f5371&quot;,&quot;anchor&quot;:{&quot;kind&quot;:&quot;marker&quot;,&quot;value&quot;:&quot;ap4-edge-trust-architecture&quot;,&quot;line&quot;:182}},&quot;evidence_policy&quot;:&quot;Each factual element cites source lines or is marked assumption.&quot;,&quot;diagram_only&quot;:true}</metadata>
<metadata>{&quot;techviz&quot;:{&quot;spec_version&quot;:&quot;1.1&quot;,&quot;id&quot;:&quot;ap4-edge-trust-architecture&quot;,&quot;profile&quot;:&quot;component-flow&quot;},&quot;source_context&quot;:{&quot;document&quot;:&quot;document.md&quot;,&quot;document_sha256&quot;:&quot;e2cc061f683294c937f089ad874cbf7a617f7313c07a92c2148fb11287a0da37&quot;,&quot;anchor&quot;:{&quot;kind&quot;:&quot;heading&quot;,&quot;value&quot;:&quot;AP4: OAuth를 모르는 upstream 앞에서 신뢰 경로를 만든다&quot;,&quot;line&quot;:202}},&quot;evidence_policy&quot;:&quot;Each factual element cites source lines or is marked assumption.&quot;,&quot;diagram_only&quot;:true}</metadata>
<defs>
<marker id="arrow" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
<path d="M 0 0 L 10 5 L 0 10 z" />
@@ -49,48 +49,49 @@
.timeline-detail { font-size: 11px; fill: #4b5563; text-anchor: middle; }
</style>
</defs>
<rect class="canvas" width="1080" height="416" />
<rect class="group-box" x="45.0" y="49.0" width="250.0" height="156.0" rx="8" />
<rect class="group-label-bg" x="59.0" y="39.0" width="134.0" height="22" />
<text class="group-label" x="69.0" y="54.0">External browser</text>
<rect class="group-box" x="565.0" y="49.0" width="470.0" height="322.0" rx="8" />
<rect class="group-label-bg" x="579.0" y="39.0" width="155.0" height="22" />
<text class="group-label" x="589.0" y="54.0">AP4 deployment path</text>
<polyline class="edge kind-request style-solid emphasis-normal" points="265.0,137.0 430.0,137.0 430.0,139.0 595.0,139.0" data-evidence="994-999" />
<rect class="edge-label-bg" x="354.6" y="124.0" width="198.9" height="22" rx="3" />
<text class="edge-label" x="454.0" y="139.0">GET /api/edge · AP4_SESSION</text>
<polyline class="edge kind-request style-solid emphasis-normal" points="785.0,148.0 690.0,148.0 690.0,292.5 595.0,292.5" data-evidence="922-928,1009-1009" />
<rect class="edge-label-bg" x="597.8" y="206.2" width="232.4" height="22" rx="3" />
<text class="edge-label" x="714.0" y="221.2">internal /oauth2/auth subrequest</text>
<polyline class="edge kind-data style-solid emphasis-primary" points="785.0,130.0 815.0,130.0 815.0,59.0 785.0,59.0 785.0,156.0 815.0,156.0" data-evidence="1017-1026,1065-1078" />
<rect class="edge-label-bg" x="654.0" y="17.0" width="265.9" height="22" rx="3" />
<text class="edge-label" x="787.0" y="32.0">allowlisted identity + internal token</text>
<rect class="canvas" width="1039" height="451" />
<rect class="group-box" x="40.0" y="142.5" width="230.0" height="156.0" rx="8" />
<rect class="group-label-bg" x="54.0" y="132.5" width="134.0" height="22" />
<text class="group-label" x="64.0" y="147.5">External browser</text>
<rect class="group-box" x="370.0" y="35.0" width="624.0" height="371.0" rx="8" />
<rect class="group-label-bg" x="384.0" y="25.0" width="155.0" height="22" />
<text class="group-label" x="394.0" y="40.0">AP4 deployment path</text>
<polyline class="edge kind-request style-solid emphasis-normal" points="240.0,230.5 320.0,230.5 320.0,230.5 400.0,230.5" data-evidence="1034-1039" />
<rect class="edge-label-bg" x="274.1" y="188.5" width="91.7" height="22" rx="3" />
<text class="edge-label" x="320.0" y="203.5">AP4_SESSION</text>
<polyline class="edge kind-request style-solid emphasis-normal" points="595.0,221.5 680.2,221.5 680.2,133.5 765.5,133.5" data-evidence="960-966,1049-1049" />
<rect class="edge-label-bg" x="645.0" y="163.5" width="118.5" height="22" rx="3" />
<text class="edge-label" x="704.2" y="178.5">auth subrequest</text>
<polyline class="edge kind-data style-solid emphasis-primary" points="595.0,239.5 675.0,239.5 675.0,319.0 755.0,319.0" data-evidence="1057-1066,1105-1118" />
<rect class="edge-label-bg" x="663.2" y="265.2" width="71.6" height="22" rx="3" />
<text class="edge-label" x="699.0" y="280.2">identity</text>
<g id="node-browser">
<g class="actor-symbol emphasis-normal" data-evidence="980-999"><circle cx="170.0" cy="115.0" r="11.0" /><line x1="170.0" y1="131.0" x2="170.0" y2="150.0" /><line x1="152.0" y1="141.0" x2="188.0" y2="141.0" /><line x1="170.0" y1="150.0" x2="155.0" y2="167.0" /><line x1="170.0" y1="150.0" x2="185.0" y2="167.0" /></g>
<text class="node-label" x="170.0" y="172.0">Browser</text>
<g class="actor-symbol emphasis-normal" data-evidence="1018-1039"><circle cx="155.0" cy="208.5" r="11.0" /><line x1="155.0" y1="224.5" x2="155.0" y2="233.5" /><line x1="137.0" y1="234.5" x2="173.0" y2="234.5" /><line x1="155.0" y1="233.5" x2="140.0" y2="250.5" /><line x1="155.0" y1="233.5" x2="170.0" y2="250.5" /></g>
<text class="node-label" x="155.0" y="265.5">Browser</text>
</g>
<g id="node-nginx">
<rect class="node-shape kind-service emphasis-primary role-service" data-evidence="914-928,1009-1028" x="595.0" y="95.0" width="190.0" height="88.0" rx="7" />
<text class="node-label" x="690.0" y="122.0">Nginx edge</text>
<line class="node-detail-divider" x1="609.0" y1="143.0" x2="771.0" y2="143.0" />
<text class="node-detail" x="611.0" y="160.0">auth_request</text>
<text class="node-detail" x="611.0" y="176.0">client header overwrite</text>
</g>
<g id="node-spring-upstream">
<rect class="node-shape kind-service emphasis-normal role-sink" data-evidence="1017-1037,1065-1078" x="815.0" y="95.0" width="190.0" height="122.0" rx="7" />
<text class="node-label" x="910.0" y="122.0">Spring upstream</text>
<line class="node-detail-divider" x1="829.0" y1="143.0" x2="991.0" y2="143.0" />
<text class="node-detail" x="831.0" y="160.0">X-Auth-Request-User</text>
<text class="node-detail" x="831.0" y="176.0">X-Auth-Request-Email</text>
<text class="node-detail" x="831.0" y="192.0">X-Internal-Auth-Token</text>
<text class="node-detail" x="831.0" y="208.0">/edge/me controller check</text>
<rect class="node-shape kind-service emphasis-primary role-service" data-evidence="952-966,1049-1068" x="400.0" y="178.0" width="195.0" height="105.0" rx="7" />
<text class="node-label" x="497.5" y="205.0">Nginx edge</text>
<line class="node-detail-divider" x1="414.0" y1="226.0" x2="581.0" y2="226.0" />
<text class="node-detail" x="416.0" y="243.0">/api/edge</text>
<text class="node-detail" x="416.0" y="259.0">auth_request</text>
<text class="node-detail" x="416.0" y="275.0">client header overwrite</text>
</g>
<g id="node-oauth2-proxy">
<rect class="node-shape kind-service emphasis-normal role-service" data-evidence="940-990,1009-1014" x="595.0" y="240.0" width="190.0" height="105.0" rx="7" />
<text class="node-label" x="690.0" y="267.0">oauth2-proxy</text>
<line class="node-detail-divider" x1="609.0" y1="288.0" x2="771.0" y2="288.0" />
<text class="node-detail" x="611.0" y="305.0">edge-proxy client</text>
<text class="node-detail" x="611.0" y="321.0">minimal cookie session</text>
<text class="node-detail" x="611.0" y="337.0">returns user · email</text>
<rect class="node-shape kind-service emphasis-normal role-service" data-evidence="978-1028,1049-1054" x="765.5" y="81.0" width="188.0" height="105.0" rx="7" />
<text class="node-label" x="859.5" y="108.0">oauth2-proxy</text>
<line class="node-detail-divider" x1="779.5" y1="129.0" x2="939.5" y2="129.0" />
<text class="node-detail" x="781.5" y="146.0">edge-proxy client</text>
<text class="node-detail" x="781.5" y="162.0">minimal cookie session</text>
<text class="node-detail" x="781.5" y="178.0">returns user · email</text>
</g>
<g id="node-spring-upstream">
<rect class="node-shape kind-service emphasis-normal role-sink" data-evidence="1057-1077,1105-1118" x="755.0" y="258.0" width="209.0" height="122.0" rx="7" />
<text class="node-label" x="859.5" y="285.0">Spring upstream</text>
<line class="node-detail-divider" x1="769.0" y1="306.0" x2="950.0" y2="306.0" />
<text class="node-detail" x="771.0" y="323.0">X-Auth-Request-User</text>
<text class="node-detail" x="771.0" y="339.0">X-Auth-Request-Email</text>
<text class="node-detail" x="771.0" y="355.0">X-Internal-Auth-Token</text>
<text class="node-detail" x="771.0" y="371.0">/edge/me controller check</text>
</g>
</svg>
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 8.1 KiB

After

Width:  |  Height:  |  Size: 8.1 KiB