Skip to main content

Authentication Flows

How the Shell handles authentication with Ory Kratos, Hydra, and OpenFGA.

Authentication Architecture​

TODO: Add authentication flow diagram

User Login Flow​

TODO: Document login flow:

  1. User accesses Shell
  2. Shell checks for Kratos session cookie
  3. If not authenticated, redirect to Kratos login UI
  4. User enters credentials
  5. Kratos validates and creates session
  6. Kratos redirects back to Shell with session cookie
  7. Shell validates session with AppServer
  8. AppServer checks permissions via OpenFGA
  9. User logged in and sees platform

Session Validation​

TODO: Document session validation:

  • Cookie-based sessions
  • Session validation with AppServer
  • Permission loading
  • Session refresh

Logout Flow​

TODO: Document logout flow:

  1. User clicks logout
  2. Shell calls /api/host/logout
  3. Kratos session invalidated
  4. Session cookie removed
  5. User redirected to login

OAuth2/OIDC Flows​

TODO: Document OAuth2 flows with Hydra:

  • Authorization code flow
  • Consent screen
  • Token exchange

Permission Checking​

TODO: Document permission checking in Shell:

  • Route guards
  • Component-level checks
  • API-level checks