documentation/diagrams/refresh_flow.svg

<?xml version="1.0" encoding="UTF-8" standalone="no"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" contentScriptType="application/ecmascript" contentStyleType="text/css" height="345px" preserveAspectRatio="none" style="width:950px;height:345px;" version="1.1" viewBox="0 0 950 345" width="950px" zoomAndPan="magnify"><defs><filter height="300%" id="f1iygl4vgxuqf8" width="300%" x="-1" y="-1"><feGaussianBlur result="blurOut" stdDeviation="2.0"/><feColorMatrix in="blurOut" result="blurOut2" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .4 0"/><feOffset dx="4.0" dy="4.0" in="blurOut2" result="blurOut3"/><feBlend in="SourceGraphic" in2="blurOut3" mode="normal"/></filter></defs><g><rect fill="#FFFFFF" filter="url(#f1iygl4vgxuqf8)" height="227.9297" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="638.5" y="96.2969"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 5.0,5.0;" x1="104" x2="104" y1="86.2969" y2="333.2266"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 5.0,5.0;" x1="259" x2="259" y1="86.2969" y2="333.2266"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 5.0,5.0;" x1="643" x2="643" y1="86.2969" y2="333.2266"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 5.0,5.0;" x1="883" x2="883" y1="86.2969" y2="333.2266"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="186" x="8" y="82.9951">Resource Owner (browser)</text><ellipse cx="104" cy="13" fill="#FEFECE" filter="url(#f1iygl4vgxuqf8)" rx="8" ry="8" style="stroke: #A80036; stroke-width: 2.0;"/><path d="M104,21 L104,48 M91,29 L117,29 M104,48 L91,63 M104,48 L117,63 " fill="#FEFECE" filter="url(#f1iygl4vgxuqf8)" style="stroke: #A80036; stroke-width: 2.0;"/><rect fill="#FEFECE" filter="url(#f1iygl4vgxuqf8)" height="30.2969" style="stroke: #A80036; stroke-width: 1.5;" width="95" x="210" y="51"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="81" x="217" y="70.9951">OIDC issuer</text><rect fill="#FEFECE" filter="url(#f1iygl4vgxuqf8)" height="30.2969" style="stroke: #A80036; stroke-width: 1.5;" width="53" x="615" y="51"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="39" x="622" y="70.9951">Client</text><rect fill="#FEFECE" filter="url(#f1iygl4vgxuqf8)" height="30.2969" style="stroke: #A80036; stroke-width: 1.5;" width="95" x="834" y="51"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="81" x="841" y="70.9951">Solid Server</text><rect fill="#FFFFFF" filter="url(#f1iygl4vgxuqf8)" height="227.9297" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="638.5" y="96.2969"/><polygon fill="#FBFB77" filter="url(#f1iygl4vgxuqf8)" points="223,101.2969,223,126.2969,680,126.2969,680,111.2969,670,101.2969,223,101.2969" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="670" x2="670" y1="101.2969" y2="111.2969"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="680" x2="670" y1="111.2969" y2="111.2969"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="342" x="274" y="118.3638">Assuming that the Client already has a Refresh Token</text><rect fill="#EEEEEE" filter="url(#f1iygl4vgxuqf8)" height="3" style="stroke: #EEEEEE; stroke-width: 1.0;" width="935" x="3" y="155.9961"/><line style="stroke: #000000; stroke-width: 1.0;" x1="3" x2="938" y1="155.9961" y2="155.9961"/><line style="stroke: #000000; stroke-width: 1.0;" x1="3" x2="938" y1="158.9961" y2="158.9961"/><rect fill="#EEEEEE" filter="url(#f1iygl4vgxuqf8)" height="23.1328" style="stroke: #000000; stroke-width: 2.0;" width="117" x="412" y="145.4297"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="98" x="418" y="161.4966">Back channel</text><polygon fill="#A80036" points="270.5,195.5625,260.5,199.5625,270.5,203.5625,266.5,199.5625" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="264.5" x2="637.5" y1="199.5625" y2="199.5625"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="251" x="276.5" y="194.6294">Sends Refresh Token to token endpoint</text><polygon fill="#A80036" points="626.5,224.6953,636.5,228.6953,626.5,232.6953,630.5,228.6953" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="259.5" x2="632.5" y1="228.6953" y2="228.6953"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="355" x="266.5" y="223.7622">Sends Access, ID and (optional) rotated Refresh Tokens</text><line style="stroke: #A80036; stroke-width: 1.0;" x1="648.5" x2="690.5" y1="257.9609" y2="257.9609"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="690.5" x2="690.5" y1="257.9609" y2="270.9609"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="649.5" x2="690.5" y1="270.9609" y2="270.9609"/><polygon fill="#A80036" points="659.5,266.9609,649.5,270.9609,659.5,274.9609,655.5,270.9609" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="187" x="655.5" y="252.895">Initializes authenticated fetch</text><polygon fill="#A80036" points="871.5,310.9609,881.5,314.9609,871.5,318.9609,875.5,314.9609" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="648.5" x2="877.5" y1="314.9609" y2="314.9609"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="211" x="655.5" y="295.0278">Accesses the protected resource</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="138" x="655.5" y="310.1606">with the access token</text><!--
@startuml

actor RO as "Resource Owner (browser)"
participant Issuer as "OIDC issuer"
participant Client
participant RS as "Solid Server"

hide footbox

note over Issuer, Client
Assuming that the Client already has a Refresh Token
end note

== Back channel ==

activate Client
Client -> Issuer: Sends Refresh Token to token endpoint
Issuer -> Client: Sends Access, ID and (optional) rotated Refresh Tokens
Client -> Client: Initializes authenticated fetch
Client -> RS: Accesses the protected resource\nwith the access token

@enduml

PlantUML version 1.2017.15(Mon Jul 03 18:45:34 CEST 2017)
(GPL source distribution)
Java Runtime: OpenJDK Runtime Environment
JVM: OpenJDK 64-Bit Server VM
Java Version: 11.0.11+9-Ubuntu-0ubuntu2.18.04
Operating System: Linux
OS Version: 4.15.0-142-generic
Default Encoding: UTF-8
Language: fr
Country: FR
--></g></svg>