.. SPDX-FileCopyrightText: 2024 Univention GmbH .. .. SPDX-License-Identifier: AGPL-3.0-only .. index:: pair: overview; functional components .. _overview-components: ********************* Functional components ********************* This section provides an overview of the functional components of Univention Nubus for Kubernetes. For each component, it describes the purpose and the main tasks. :numref:`overview-components-fig` provides an overview of all the functional components grouped by their main tasks: #. :ref:`overview-components-end-user-facing` #. :ref:`overview-components-authentication-authorization` #. :ref:`overview-components-integration` #. :ref:`overview-components-connectors` Univention Nubus for Kubernetes consists of the following functional components: #. :ref:`overview-components-authorization-service` #. :ref:`overview-components-directory-manager` #. :ref:`overview-components-end-user-self-service` #. :ref:`overview-components-identity-provider` #. :ref:`overview-components-identity-store` #. :ref:`overview-components-intercom-service` #. :ref:`overview-components-management-ui` #. :ref:`overview-components-portal-service` #. :ref:`overview-components-provision-service` #. :ref:`overview-components-connectors-iam-connector` #. :ref:`overview-components-2fa-helpdesk` .. _overview-components-fig: .. figure:: /images/Overview_functional_Components_structured.* :target: ../_images/Overview_functional_Components_structured.svg :alt: Overview of functional components in Univention Nubus for Kubernetes Overview of functional components in Univention Nubus for Kubernetes .. index:: pair: functional component; end user facing .. _overview-components-end-user-facing: End user facing =============== Functional components that provide features that directly serve the end user are end user facing. These components are the following: * Portal * End User Self Service * Management UI * 2FA Helpdesk .. figure:: /images/Overview_functional_Components_End_user_facing.* :target: ../_images/Overview_functional_Components_End_user_facing.svg :alt: Functional components facing the end user Functional components facing the end user .. index:: pair: functional component; portal service pair: end user facing; portal service .. _overview-components-portal-service: Portal Service -------------- The *Portal Service* is a web application that shows administrators and end users the applications they have access to, manages sign-in and sign-on redirects, and visually integrates different applications into one desktop. Purpose * Delivers customer access, for example for end users. * Delivers access to administer user accounts and user groups in Univention Nubus for Kubernetes. * Delivers user interface (UI) integration layer for other services. Tasks: * Login form for end users to sign in. * Portal UI. * Link to end user self service. * Link to administer user accounts and user groups. * Link to other modules. * Present notifications from a central notification service. .. seealso:: :ref:`interfaces-portal-service` in the interfaces section for information about incoming and outgoing interfaces. :ref:`deployment-portal` in the deployment view section for information about container images, Kubernetes pods, and Helm Charts used for deployment. :ref:`component-portal-service` in components section for information about internal components and behavior. .. index:: pair: functional component; management ui pair: end user facing; management ui .. _overview-components-management-ui: Management UI ------------- The *Management UI* allows customers to administer :term:`IAM` resources like user accounts and user groups. Purpose User interface (UI) for administration of directory objects, such as user account objects, user group objects, and asset objects. Administrators manage user account and group objects through the *Management UI*, if Nubus has no external IAM system connected. For more information, see :ref:`overview-components-connectors`. Tasks * :term:`CRUD` operations for directory objects, such as user account objects and user group objects. * UI for the CRUD operations that depends on permissions. .. seealso:: :ref:`interfaces-management-ui` in interfaces protocols section for information about incoming and outgoing interfaces. :ref:`deployment-management-ui` in the deployment view section for information about container images, Kubernetes pods, and Helm Charts used for deployment. :ref:`component-management-ui` in components section for information about internal components and behavior. .. index:: pair: functional component; end user self service pair: end user facing; end user self service .. _overview-components-end-user-self-service: End User Self Service --------------------- The *End User Self Service* allows end users to modify certain data of their own user account object, including a password reset service. Purpose UI for end users to manage distinct attributes of their user account object Tasks: * Maintenance of user account data, such as profile information. * Actions for forgotten password and password change. .. seealso:: :ref:`interfaces-end-user-self-service` in the interface section for information about incoming and outgoing interfaces. :ref:`deployment-end-user-self-service` in the deployment view section for information about container images, Kubernetes pods, and Helm Charts used for deployment. :ref:`component-end-user-self-service` in components section for information about internal components and behavior. .. index:: pair: functional component; 2FA Helpdesk pair: end user facing; 2FA Helpdesk .. _overview-components-2fa-helpdesk: 2FA Helpdesk ------------ The *2FA Helpdesk* allows administrators to manage 2FA tokens for end users. For end users it allows them to reset their 2FA tokens. Purpose UI for administrators and end users to reset 2FA tokens. Tasks: * Administrators reset end user 2FA tokens. * End users reset their own 2FA tokens. .. seealso:: :ref:`interfaces-2fa-helpdesk` in the interface section for information about incoming and outgoing interfaces. :ref:`deployment-2fa-helpdesk` in the deployment view section for information about container images, Kubernetes pods, and Helm Charts used for deployment. :ref:`component-2fa-helpdesk` in components section for information about internal components and behavior. .. index:: pair: functional component; authentication and authorization .. _overview-components-authentication-authorization: Authentication and Authorization ================================ The *Guardian* is a generic *Authorization Service* where applications can register rules and roles. They can then use it to authorize the operations they offer to clients. Functional components listed in this section provide features for authentication and authorization. They're the following: * Authorization Service * Directory Manager * Identity Provider * Identity Store and Directory Service .. figure:: /images/Overview_functional_Components_Authentication_and_Authorization.* :target: ../_images/Overview_functional_Components_Authentication_and_Authorization.svg :alt: Functional components for authentication and authorization Functional components for authentication and authorization .. index:: pair: authentication and authorization; identity provider pair: functional component; identity provider .. _overview-components-identity-provider: Identity Provider ----------------- The *Identity Provider* service is responsible for authentication, token creation, renewal, and removal. The *Identity Provider* includes the software stack for *Keycloak* and the integration to the *Identity Store and Directory Service*. Purpose Authentication provider using the authentication protocols :term:`SAML` and :term:`OpenID Connect`. Tasks * Session handling for user authentications. * Offers authentication protocols SAML, and OpenID Connect. .. index:: ! authorization service; functional component, functional component; authorization service pair: authentication and authorization; authorization service .. seealso:: :ref:`interfaces-identity-provider` in interfaces and protocols section for information about incoming and outgoing interfaces. :ref:`deployment-identity-provider` in deployment view section for information about container images, Kubernetes pods, and Helm Charts used for deployment. :ref:`component-identity-provider` in components section for information about internal components and behavior. .. _overview-components-authorization-service: Authorization Service --------------------- The *Authorization Service* is responsible for managing user permissions and organizing them in roles. The software stack also has the name *Guardian*. Purpose The authorization service provides authorization for other Nubus components, such as the *End User Self Service*. .. note:: For the time being, no Nubus component uses the *Authorization Service*. If components use it, this section explicitly lists them. .. TODO: List Nubus components that use the *Authorization Service* here! Tasks: * Authorize operations in Management UI. * Deliver API for :term:`CRUD` operations for rules. * Deliver UI for management of rules. .. seealso:: :ref:`interfaces-authorization-service` in interfaces and protocols section for information about incoming and outgoing interfaces. :ref:`deployment-authorization-service` in the deployment view section for information about container images, Kubernetes pods, and Helm Charts used for deployment. :ref:`component-authorization-service` in components section for information about internal components and behavior. :cite:t:`uv-guardian-manual` for more information about the *Guardian*. .. index:: ! directory manager; functional component, functional component; directory manager pair: authentication and authorization; directory manager .. _overview-components-directory-manager: Directory Manager ----------------- The *Univention Directory Manager (UDM) REST API* offers an HTTP REST interface to manage the user account, user group, and asset objects stored in the :ref:`interfaces-identity-store`. Purpose Façade in front of the *Directory Service*, that transforms business actions on user account objects, user group objects, and asset objects. It orchestrates :term:`CRUD` operations for the *Directory Service*. Tasks: * Applies business logic on user account objects, group objects, and asset objects. * Transforms objects to and from directory service. .. seealso:: :ref:`interfaces-directory-manager` in interfaces and protocols section for information about incoming and outgoing interfaces. :ref:`deployment-directory-manager` in deployment view section for information about container images, Kubernetes pods, and Helm Charts used for deployment. :ref:`component-directory-manager` in components section for information about internal components and behavior. .. index:: ! identity store and directory manager; functional component, functional component; identity store and directory manager pair: authentication and authorization; identity store and directory manager .. _overview-components-identity-store: Identity Store and Directory Service ------------------------------------ The *Identity Store and Directory Service* uses *OpenLDAP* as the primary database for user account, user group, and asset objects. Purpose Persistence layer for structured directory service data. It implements availability and performance requirements. The structured data is user account objects, user group objects, and asset objects. Tasks: * Delivers user account objects and user group objects through read operations. * Triggers events for provisioning. .. index:: pair: functional component; integration .. seealso:: :ref:`interfaces-identity-store` in interfaces and protocols section for information about incoming and outgoing interfaces. :ref:`deployment-identity-store` in deployment view section for information about container images, Kubernetes pods, and Helm Charts used for deployment. :ref:`component-identity-store-directory-service` in components section for information about internal components and behavior. .. _overview-components-integration: Integration =========== Functional components listed in this section provide functions for the integration of the components into the central user interface (UI), as well as, the :ref:`overview-components-authentication-authorization`. They're the following: * Intercom Service * Provisioning Service .. figure:: /images/Overview_functional_Components_Integration.* :target: ../_images/Overview_functional_Components_Integration.svg :alt: Functional components for integration Functional components for integration .. index:: ! provisioning service; functional component, functional component; provisioning service pair: integration; provisioning service .. _overview-components-provision-service: Provisioning Service -------------------- The *Provisioning Service* notifies interested services of changes to directory objects in the :ref:`component-identity-store-directory-service`. For example, imagine a service that wants to take action in its database, such as populating initial data for a user when an administrator creates a user account in the :term:`IAM` database. Interested services register with the Provisioning Service in advance. Purpose Connection and synchronization of user account objects, user group objects and asset objects, that the *Identity Store and Directory Service* manages, with functional components that have their own data persistence. Tasks: * Informs about changes in the *Identity Store and Directory Service*. * Delivers objects based on events from the *Identity Store and Directory Service* to the functional component. .. seealso:: :ref:`interfaces-provisioning-service` in interfaces and protocols section for information about incoming and outgoing interfaces. :ref:`deployment-provisioning` in deployment view section for information about container images, Kubernetes pods, and Helm Charts used for deployment. :ref:`component-provisioning-service` in components section for information about internal components and behavior. .. index:: ! intercom service; functional component, functional component; intercom service pair: integration; intercom service .. _overview-components-intercom-service: Intercom Service ---------------- The *Intercom Service* is an intermediary for communication between applications like Nextcloud, OX App Suite and Matrix. Purpose Intermediary to allow sharing of resources between different backends directly from the browser. Tasks Provide restricted usage of resources across functional components. .. seealso:: :ref:`interfaces-intercom-service` in interfaces protocols section for information about incoming and outgoing interfaces. :ref:`component-intercom-service` in components section for information about internal components and behavior. :external+uv-nubus-kubernetes-operation:ref:`ics-deployment` in :cite:t:`uv-nubus-kubernetes-operation` for information about the deployment of *Intercom Service*. .. index:: pair: functional component; connectors .. _overview-components-connectors: Connectors ========== Connectors enable the connection of external systems to Nubus. .. figure:: /images/Overview_functional_Components_Connectors.* :target: ../_images/Overview_functional_Components_Connectors.svg :alt: Functional components for connectors Functional components for connectors .. index:: ! iam connector; functional component, functional component; iam connector pair: connectors; iam connector .. _overview-components-connectors-iam-connector: IAM Connector ------------- A central external identity and access management (:term:`IAM`) system is the leading and authoritative source system for management and maintenance of user accounts and user group memberships. Purpose The connector serves the setup of a direct interface between the external IAM and the :ref:`overview-components-authentication-authorization` from Nubus. Tasks * Synchronize user account and user group data from the external IAM to Nubus. * Provide an unidirectional or bidirectional synchronization. .. seealso:: :ref:`component-iam-connector` in components section for information about internal components and behavior. .. index:: ! nubus directory importer; functional component, functional component; nubus directory importer pair: connectors; nubus directory importer .. _overview-components-connectors-nubus-directory-importer: Nubus Directory Importer ------------------------ The *Nubus Directory Importer* is a distinct implementation of the :ref:`overview-components-connectors-iam-connector`, as shown in :numref:`overview-components-connectors-nubus-directory-importer-fig`. .. _overview-components-connectors-nubus-directory-importer-fig: .. figure:: /images/Overview_functional_Components_Nubus_Directory_Importer.* :target: ../_images/Overview_functional_Components_Nubus_Directory_Importer.svg :alt: Nubus Directory Importer as implementation for an IAM Connector :width: 150px Nubus Directory Importer as implementation for an :term:`IAM` Connector Purpose The connector synchronizes the :ref:`overview-components-directory-manager` in Nubus with the directory structure of several external directories using LDAP. Tasks: * Search for user account objects and user group objects in the source and the target through LDAP. * Determine the differences between the source and target to calculate the modification operations. * Synchronize the found objects to the *Directory Manager* through the UDM HTTP REST API. .. seealso:: :ref:`component-nubus-directory-importer` in components section for information about internal components and behavior. :external+uv-nubus-kubernetes-operation:ref:`conf-import-external-iam` for more information about how to connect Nubus through the Nubus Directory Importer with an external directory service.