| // |
| // Licensed to the Apache Software Foundation (ASF) under one |
| // or more contributor license agreements. See the NOTICE file |
| // distributed with this work for additional information |
| // regarding copyright ownership. The ASF licenses this file |
| // to you under the Apache License, Version 2.0 (the |
| // "License"); you may not use this file except in compliance |
| // with the License. You may obtain a copy of the License at |
| // |
| // http://www.apache.org/licenses/LICENSE-2.0 |
| // |
| // Unless required by applicable law or agreed to in writing, |
| // software distributed under the License is distributed on an |
| // "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| // KIND, either express or implied. See the License for the |
| // specific language governing permissions and limitations |
| // under the License. |
| // |
| |
| == Architecture |
| |
| Apache Syncope is made of several components, which are logically summarized in the picture below. |
| |
| [.text-center] |
| image::architecture.png[title="Architecture",alt="Architecture"] |
| |
| === Keymaster |
| |
| The *_Keymaster_* allows for dynamic service discovery so that other components are able to find each other. + |
| On startup, all other component instances will register themselves into Keymaster so that their references |
| can be found later, for intra-component communication. |
| |
| In addition, the Keymaster is also used as key / value store for <<configuration-parameters, configuration parameters>> |
| and as a directory for defined <<domains,domains>>. |
| |
| Two different implementations are provided, following the actual needs: |
| |
| . as an additional set of RESTful services exposed by the Core, for traditional deployments |
| (also known as _Self Keymaster_); |
| . as a separate container / pod based on https://zookeeper.apache.org/[Apache Zookeeper^], for microservice-oriented |
| deployments. |
| |
| include::core.adoc[] |
| |
| === Web Access |
| |
| The *_Web Access_* component is based on https://apereo.github.io/cas/[Apereo CAS^]. |
| |
| In addition to all the configuration options and features from Apereo CAS, the Web Access is integrated with Keymaster, |
| Core and Admin UI to offer centralized configuration and management. |
| |
| === Secure Remote Access |
| |
| The *_Secure Remote Access_* component is built on https://spring.io/projects/spring-cloud-gateway[Spring Cloud Gateway^]. |
| |
| In addition to all the configuration options and features from Spring Cloud Gateway, the Secure Remote Access is |
| integrated with Keymaster, Core and Admin UI to offer centralized configuration and management. |
| |
| The Secure Remote Access allows to protect legacy applications by integrating with the Web Access or other third-party |
| Access Managers implementing standard protocols as OpenID Connect or SAML. |
| |
| [[admin-console-component]] |
| === Admin UI |
| |
| The *_Admin UI_* is the web-based console for configuring and administering running deployments, with full support |
| for delegated administration. |
| |
| The communication between Admin UI and Core is exclusively REST-based. |
| |
| More details are available in the dedicated <<admin-console,usage>> section. |
| |
| [[enduser-component]] |
| === End-user UI |
| |
| The *_End-user UI_* is the web-based application for self-registration, self-service and <<password-reset,password reset>>. |
| |
| The communication between End-user UI and Core is exclusively REST-based. |
| |
| More details are available in the dedicated <<enduser-application,usage>> section. |
| |
| === Third Party Applications |
| |
| Third-party applications are provided full access to IdM services by leveraging the REST interface, either via the |
| Java <<client-library,Client Library>> (the basis of Admin UI and End-user UI) or plain HTTP calls. |
