From 08d2f5a196fade9ac5ab1281ab236dc7bca7d596 Mon Sep 17 00:00:00 2001 From: thesabear Date: Fri, 28 Aug 2026 00:21:08 +0300 Subject: [PATCH] docs: sanitize real domain names out of OIDC diagram The zone-band labels spelled out *.local.thesabear.net and *.caddy.thesabear.net literally - the same internal zone naming pattern already sanitized out of this doc's prose, missed on the diagram itself. Replaced with generic zone names, no domain. --- assets/sso-and-identity-oidc-cross-zone-redirect.svg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/assets/sso-and-identity-oidc-cross-zone-redirect.svg b/assets/sso-and-identity-oidc-cross-zone-redirect.svg index d096fcd..50c9bd3 100644 --- a/assets/sso-and-identity-oidc-cross-zone-redirect.svg +++ b/assets/sso-and-identity-oidc-cross-zone-redirect.svg @@ -1,4 +1,4 @@ -
BROWSER-FACING ZONE — *.local.thesabear.net
SERVICE-TO-SERVICE ZONE — *.caddy.thesabear.net (no mTLS on this hop)
Browser
App
Authentik
1. User opens app
2. App's response: redirect to Authentik
3. Browser follows it — OAuth authorize/token exchange, crossing into the caddy zone
4. Authentik's response: success, redirect back
5. Browser lands back on the app — still the local zone
Gray — stays within a single zone
Orange — the one hop that crosses into the service-to-service zone
Every hop is carried by the browser itself — Authentik and the app never talk to each other directly. Every app's OIDC discovery/authority setting points at the caddy zone for exactly this reason, even though the app itself always lives on the local zone.
 \ No newline at end of file +
BROWSER-FACING ZONE
SERVICE-TO-SERVICE ZONE (no mTLS on this hop)
Browser
App
Authentik
1. User opens app
2. App's response: redirect to Authentik
3. Browser follows it — OAuth authorize/token exchange, crossing into the caddy zone
4. Authentik's response: success, redirect back
5. Browser lands back on the app — still the local zone
Gray — stays within a single zone
Orange — the one hop that crosses into the service-to-service zone
Every hop is carried by the browser itself — Authentik and the app never talk to each other directly. Every app's OIDC discovery/authority setting points at the caddy zone for exactly this reason, even though the app itself always lives on the local zone.
 \ No newline at end of file