.. SPDX-FileCopyrightText: 2024 Univention GmbH
..
.. SPDX-License-Identifier: AGPL-3.0-only

.. _data-flow-directory-objects:

Directory objects flow
======================

This section gives an overview about :ref:`data-objects-directory` in Nubus for Kubernetes,
and provides information for the following aspects:

* :ref:`data-flow-Directory-objects-consumer`
* :ref:`data-flow-Directory-objects-ldap-read`
* :ref:`data-flow-Directory-objects-ldap-write`

Nubus for Kubernetes uses an :term:`LDAP` directory service.
From an architectural perspective,
this documentation uses the more general term *Directory objects*
which refers to *LDAP objects*.

.. seealso::

   :ref:`component-identity-store-directory-service` in the functional components section
      for more information about the use of directory objects.

   :ref:`data-objects-directory` in data objects section
      for information about *Directory objects*.

.. _data-flow-directory-objects-consumer:

Consumers of directory objects
------------------------------

Internal Nubus components and *Third-party applications, not part of Nubus*
consume :ref:`data-objects-directory`,
as shown in :numref:`data-flow-directory-objects-ldap-read-figure`.
Third-party application send their requests for directory objects
directly to the LDAP server.

As shown in the figure below, Nubus functional components
with different components access the *LDAP Server*.

* The :ref:`component-management-ui` receives directory objects through the *UMC Server*.
* The :ref:`component-portal-service` receives directory objects through the *Portal Consumer*.
* The :ref:`component-provisioning-service` receives directory objects through the *UDM Listener*.
* The :ref:`component-directory-manager` uses the *UDM Library* for directory objects.
* The :ref:`component-identity-provider` uses directory objects in *Keycloak*.
* The :ref:`component-nubus-directory-importer` reads directory objects for synchronization.

.. _data-flow-directory-objects-ldap-read-figure:

.. figure:: /images/Data_object_flow_Directory_objects_LDAP_read.*
   :target: ../_images/Data_object_flow_Directory_objects_LDAP_read.svg
   :alt: Consumers of directory objects

   Flow relationships for *Directory objects* from the *LDAP Server* to various consumers

.. _data-flow-directory-objects-ldap-read:

Data flow - Read directory objects
----------------------------------

:numref:`data-flow-directory-objects-ldap-read-detail-figure`
shows the flow relationships for directory objects on a detailed level looking at the component
behaviors.

The *UMC Server* in the *Management UI* consumes all kinds of :ref:`data-objects-directory`
and doesn't limit it to user accounts or user account group objects.

The *LDAP Server* has a functionality to *Push object modification to Provisioning*
that sends *Directory objects* to the *Provisioning Service*.
There, the *UDM Listener* reads the events from the directory service
and writes them to the directory objects queue that include *Directory objects*.
The *UDM Transformer* picks up these events with the *Directory objects* through *Consume directory
objects queue* and *Transform directory objects to UDM objects*.

The following components read user account and user group information
through LDAP directly from the *LDAP Server*:

* *Third-party applications not part of Nubus*

* *Keycloak* in the *Identity Provider*

* *UDM Library* in the *Directory Manager* to *Transform UDM objects to and from directory objects*.

* *Portal Consumer* in the *Portal Service* to *Recreate user group cache*.

* *Nubus Directory Importer*
  to *Search for user account and user group objects in target*
  and *Determine difference between source and target*.

.. _data-flow-directory-objects-ldap-read-detail-figure:

.. figure:: /images/Data_object_flow_Directory_objects_LDAP_read_detail.*
   :target: ../_images/Data_object_flow_Directory_objects_LDAP_read_detail.svg
   :alt: Data flow - Read directory objects in detail

   Data flow - Read directory objects in detail

.. _data-flow-directory-objects-ldap-write:

Data flow - Write directory objects
-----------------------------------

:numref:`data-flow-directory-objects-ldap-write-figure` shows
that two systems have write permission to the :ref:`component-identity-store-directory-service` for directory objects:
:ref:`component-management-ui` and :ref:`component-directory-manager`.

.. _data-flow-directory-objects-ldap-write-figure:

.. figure:: /images/Data_object_flow_Directory_objects_LDAP_write.*
   :target: ../_images/Data_object_flow_Directory_objects_LDAP_write.svg
   :alt: Data flow - Write directory objects
   :width: 650px

   Data flow - Write directory objects

In detail:

* The :ref:`overview-components-management-ui` writes directly
  to the :ref:`component-identity-store-directory-service`
  using the *UMC Server*.
  The *UMC Server* runs the *UDM Library* internally.

* The :ref:`component-directory-manager` writes directly to the :ref:`component-identity-store-directory-service` using the *UDM Library*.

:numref:`data-flow-directory-objects-ldap-write-detail-figure` shows the behaviors involved
in the write operations.

.. _data-flow-directory-objects-ldap-write-detail-figure:

.. figure:: /images/Data_object_flow_Directory_objects_LDAP_write_detail.*
   :target: ../_images/Data_object_flow_Directory_objects_LDAP_write_detail.svg
   :alt: Data flow - Write directory objects in detail

   Data flow - Write directory objects in detail