diff --git a/assets/sso-and-identity-oidc-cross-zone-redirect.svg b/assets/sso-and-identity-oidc-cross-zone-redirect.svg index d096fcd..50c9bd3 100644 --- a/assets/sso-and-identity-oidc-cross-zone-redirect.svg +++ b/assets/sso-and-identity-oidc-cross-zone-redirect.svg @@ -1,4 +1,4 @@ -
BROWSER-FACING ZONE — *.local.thesabear.net
SERVICE-TO-SERVICE ZONE — *.caddy.thesabear.net (no mTLS on this hop)
Browser
App
Authentik
1. User opens app
2. App's response: redirect to Authentik
3. Browser follows it — OAuth authorize/token exchange, crossing into the caddy zone
4. Authentik's response: success, redirect back
5. Browser lands back on the app — still the local zone
Gray — stays within a single zone
Orange — the one hop that crosses into the service-to-service zone
Every hop is carried by the browser itself — Authentik and the app never talk to each other directly. Every app's OIDC discovery/authority setting points at the caddy zone for exactly this reason, even though the app itself always lives on the local zone.
 \ No newline at end of file +
BROWSER-FACING ZONE
SERVICE-TO-SERVICE ZONE (no mTLS on this hop)
Browser
App
Authentik
1. User opens app
2. App's response: redirect to Authentik
3. Browser follows it — OAuth authorize/token exchange, crossing into the caddy zone
4. Authentik's response: success, redirect back
5. Browser lands back on the app — still the local zone
Gray — stays within a single zone
Orange — the one hop that crosses into the service-to-service zone
Every hop is carried by the browser itself — Authentik and the app never talk to each other directly. Every app's OIDC discovery/authority setting points at the caddy zone for exactly this reason, even though the app itself always lives on the local zone.
 \ No newline at end of file