“An identity and access component diagram with a client application calling an authentication API. The API uses a credential validator and token service; the validator checks a user directory; and the token service uses a policy evaluator, session store and audit component.”
Read the decisions behind it.
Separates validation from the public API.
Gives sessions and policy evaluation to the token service.
Records authentication activity as a separate component.
Use this view to explain the major components of an authentication and access-control service.
Other examples in this family.
Common questions
Why separate credential validation and token issuance?
They have different responsibilities and may need different security controls or external integrations.
What is the session store for?
It retains server-side session or token state when the chosen authentication model needs it.
Why include auditing?
Authentication events are often needed for monitoring, investigation and compliance.