chartletv0.23.0

← All examples

Tenant architecture: the sign-in and data path

The tenant architecture with the sign-in component emphasized and the path from the web backend through the API to the data in the accent. The legend lists the component kinds, the line patterns and the emphasis that occur, in rows that wrap.

Tenant architecture: the sign-in and data path

examples/shop-focus.json
{
  "schemaVersion": 1,
  "type": "architecture",
  "title": "Tenant architecture: the sign-in and data path",
  "source": "Illustrative reference architecture",
  "width": 1200,
  "height": 1144,
  "architecture": {
    "boundaries": [
      {
        "id": "rz",
        "label": "Data center"
      },
      {
        "id": "netz",
        "label": "Application network",
        "in": "rz"
      },
      {
        "id": "daten",
        "label": "Data zone",
        "in": "netz"
      }
    ],
    "components": [
      {
        "id": "nutzer",
        "label": "Teacher, parent",
        "kind": "person"
      },
      {
        "id": "browser",
        "label": "Browser",
        "kind": "frontend"
      },
      {
        "id": "proxy",
        "label": "Reverse proxy",
        "sublabel": "TLS 1.3, WAF",
        "kind": "security",
        "in": "rz"
      },
      {
        "id": "web",
        "label": "Web / BFF",
        "sublabel": "SvelteKit",
        "in": "netz"
      },
      {
        "id": "idp",
        "label": "Sign-in",
        "sublabel": "Keycloak, OIDC",
        "kind": "security",
        "in": "netz"
      },
      {
        "id": "api",
        "label": "Domain API",
        "sublabel": "Rust",
        "in": "netz"
      },
      {
        "id": "db",
        "label": "Domain data",
        "sublabel": "Postgres, RLS per tenant",
        "kind": "database",
        "in": "daten"
      },
      {
        "id": "audit",
        "label": "Audit log",
        "sublabel": "append only",
        "kind": "database",
        "in": "daten"
      },
      {
        "id": "backup",
        "label": "Backup",
        "sublabel": "second site",
        "kind": "storage"
      },
      {
        "id": "alt",
        "label": "School records",
        "sublabel": "legacy system",
        "kind": "external"
      },
      {
        "id": "soc",
        "label": "SIEM / SOC",
        "kind": "external"
      }
    ],
    "connections": [
      {
        "from": "nutzer",
        "to": "browser",
        "label": "uses"
      },
      {
        "from": "browser",
        "to": "proxy",
        "label": "calls",
        "technology": "HTTPS"
      },
      {
        "from": "proxy",
        "to": "web",
        "label": "forwards"
      },
      {
        "from": "web",
        "to": "idp",
        "label": "signs in",
        "technology": "OIDC"
      },
      {
        "from": "web",
        "to": "api",
        "label": "queries",
        "technology": "user context"
      },
      {
        "from": "api",
        "to": "db",
        "label": "reads, writes",
        "technology": "SQL/TLS"
      },
      {
        "from": "api",
        "to": "audit",
        "label": "logs"
      },
      {
        "from": "alt",
        "to": "api",
        "label": "master data",
        "technology": "REST/JSON"
      },
      {
        "from": "api",
        "to": "soc",
        "label": "events",
        "technology": "Syslog",
        "dash": "dashed"
      },
      {
        "from": "db",
        "to": "backup",
        "label": "backs up",
        "dash": "dashed"
      }
    ],
    "mainPath": [
      "nutzer",
      "browser",
      "proxy",
      "web",
      "api",
      "db"
    ],
    "orientation": "portrait"
  },
  "mobile": {
    "width": 468,
    "height": 1192
  },
  "emphasis": {
    "nodes": [
      "idp"
    ],
    "path": [
      "web",
      "api",
      "db"
    ]
  },
  "legend": "auto"
}
Focus
Tenant architecture: the sign-in and data path
Tenant architecture: the sign-in and data pathArchitecture diagram with 11 components and 10 connections in 3 boundaries. Data center: Reverse proxy, Application network. Application network (in Data center): Web / BFF, Sign-in, Domain API, Data zone. Data zone (in Application network): Domain data, Audit log. Main path: Teacher, parent → Browser → Reverse proxy → Web / BFF → Domain API → Domain data. Most connected: Domain API (5 connections). Nothing leads into Teacher, parent and School records. Teacher, parent (person): connects to Browser (uses). Browser (frontend): connects to Reverse proxy (calls, via HTTPS). School records (external system): connects to Domain API (master data, via REST/JSON). Reverse proxy (security): connects to Web / BFF (forwards). Web / BFF (service): connects to Sign-in (signs in, via OIDC) and Domain API (queries, via user context). Sign-in (security): no outgoing connection. Domain API (service): connects to Domain data (reads, writes, via SQL/TLS), Audit log (logs) and SIEM / SOC (events, via Syslog). Domain data (database): connects to Backup (backs up). Audit log (database): no outgoing connection. Backup (storage): no outgoing connection. SIEM / SOC (external system): no outgoing connection. Emphasized: Sign-in. Emphasized path: Web / BFF → Domain API → Domain data. Legend: person, frontend, service, database, storage, security, external system, emphasized, solid line, dashed line, emphasized path.Data centerApplication networkData zoneTeacher, parent → Browser: usesBrowser → Reverse proxy: calls [HTTPS]Reverse proxy → Web / BFF: forwardsWeb / BFF → Sign-in: signs in [OIDC]Web / BFF → Domain API: queries [user context]Domain API → Domain data: reads, writes [SQL/TLS]Domain API → Audit log: logsSchool records → Domain API: master data [REST/JSON]Domain API → SIEM / SOC: events [Syslog]Domain data → Backup: backs upusescalls[HTTPS]forwardssigns in[OIDC]queries[user context]reads, writes[SQL/TLS]logsmaster data[REST/JSON]events[Syslog]backs upTeacher, parentTeacher, parentBrowserBrowserReverse proxy – TLS 1.3, WAFReverse proxyTLS 1.3, WAFWeb / BFF – SvelteKitWeb / BFFSvelteKitSign-in – Keycloak, OIDCSign-inKeycloak, OIDCDomain API – RustDomain APIRustDomain data – Postgres, RLS per tenantDomain dataPostgres, RLS per tenantAudit log – append onlyAudit logappend onlyBackup – second siteBackupsecond siteSchool records – legacy systemSchool recordslegacy systemSIEM / SOCSIEM / SOCPersonFrontendServiceDatabaseStorageSecurityExternal systemEmphasizedSolid lineDashed lineEmphasized path
Tenant architecture: the sign-in and data pathArchitecture diagram with 11 components and 10 connections in 3 boundaries. Data center: Reverse proxy, Application network. Application network (in Data center): Web / BFF, Sign-in, Domain API, Data zone. Data zone (in Application network): Domain data, Audit log. Main path: Teacher, parent → Browser → Reverse proxy → Web / BFF → Domain API → Domain data. Most connected: Domain API (5 connections). Nothing leads into Teacher, parent and School records. Teacher, parent (person): connects to Browser (uses). Browser (frontend): connects to Reverse proxy (calls, via HTTPS). School records (external system): connects to Domain API (master data, via REST/JSON). Reverse proxy (security): connects to Web / BFF (forwards). Web / BFF (service): connects to Sign-in (signs in, via OIDC) and Domain API (queries, via user context). Sign-in (security): no outgoing connection. Domain API (service): connects to Domain data (reads, writes, via SQL/TLS), Audit log (logs) and SIEM / SOC (events, via Syslog). Domain data (database): connects to Backup (backs up). Audit log (database): no outgoing connection. Backup (storage): no outgoing connection. SIEM / SOC (external system): no outgoing connection. Emphasized: Sign-in. Emphasized path: Web / BFF → Domain API → Domain data. Legend: person, frontend, service, database, storage, security, external system, emphasized, solid line, dashed line, emphasized path.Data centerApplication networkData zoneTeacher, parent → Browser: usesBrowser → Reverse proxy: calls [HTTPS]Reverse proxy → Web / BFF: forwardsWeb / BFF → Sign-in: signs in [OIDC]Web / BFF → Domain API: queries [user context]Domain API → Domain data: reads, writes [SQL/TLS]Domain API → Audit log: logsSchool records → Domain API: master data [REST/JSON]Domain API → SIEM / SOC: events [Syslog]Domain data → Backup: backs upusescalls[HTTPS]forwardssigns in[OIDC]queries[user context]reads, writes[SQL/TLS]logsmaster data[REST/JSON]events[Syslog]backs upTeacher, parentTeacher,parentBrowserBrowserReverse proxy – TLS 1.3, WAFReverse proxyTLS 1.3, WAFWeb / BFF – SvelteKitWeb / BFFSvelteKitSign-in – Keycloak, OIDCSign-inKeycloak, OIDCDomain API – RustDomain APIRustDomain data – Postgres, RLS per tenantDomain dataPostgres, RLSper tenantAudit log – append onlyAudit logappend onlyBackup – second siteBackupsecond siteSchool records – legacy systemSchoolrecordslegacy systemSIEM / SOCSIEM / SOCPersonFrontendServiceDatabaseStorageSecurityExternal systemEmphasizedSolid lineDashed lineEmphasized path

Source: Illustrative reference architecture

Show chart data
Data for Tenant architecture: the sign-in and data path
ComponentKindBoundaryConnects toEmphasis
Teacher, parentpersonBrowser (uses)
BrowserfrontendReverse proxy (calls, via HTTPS)
School recordsexternal systemDomain API (master data, via REST/JSON)
Reverse proxysecurityData centerWeb / BFF (forwards)
Web / BFFserviceData center › Application networkSign-in (signs in, via OIDC), Domain API (queries, via user context)on emphasized path
Sign-insecurityData center › Application networkemphasized
Domain APIserviceData center › Application networkDomain data (reads, writes, via SQL/TLS), Audit log (logs), SIEM / SOC (events, via Syslog)on emphasized path
Domain datadatabaseData center › Application network › Data zoneBackup (backs up)on emphasized path
Audit logdatabaseData center › Application network › Data zone
Backupstorage
SIEM / SOCexternal system
  • Architecture diagram with emphasis and a legend
  • Point at a component and the path of a request