title Web client authentication process with referrer

participant client
participant resource-server.test
participant atlas-auth-proxy.resource-server.test
participant atlas-um.test
participant USM.test

autoactivation
client->resource-server.test:GET /this/page/is/protected

client<--resource-server.test:302 Redirect\nLocation: {atlas-auth-proxy.resource-server.test}/login

client->atlas-auth-proxy.resource-server.test:GET /login\nReferer: {resource-server.test}/this/page/is/protected

client<--atlas-auth-proxy.resource-server.test:302 Redirect\nLocation: {atlas-um.test}/usm/login

client->atlas-um.test:GET /usm/login

client<--atlas-um.test:302 Redirect\nLocation: {USM.test}/oauth2/openid/v1/authorize?state=…\nSet-Cookie: session=…; Domain={atlas-um.test}

client->USM.test:GET /oauth2/openid/v1/authorize?state=…

ref over client,USM.test:User authenticates with USM.test using their SME email,\npassword, and MFA. This is expected to take multiple\nsteps, and at least one out-of-band communication.

client<--USM.test:302 Redirect\nLocation: {atlas-um.test}/usm/login/callback?code=…

client->atlas-um.test:GET /usm/login/callback?code=…\nCookie: session=…

ref over atlas-um.test,USM.test:Fetch user identity

client<--atlas-um.test:Form with autosubmit to {atlas-auth-proxy.resource-server.test}/process \nSet-Cookie: session=…; Domain={atlas-um.test}\nSet-Cookie: authorization-token=…; Domain={atlas-um.test}\nSet-Cookie: SME-DNA_Bearer_Token=…

client->atlas-auth-proxy.resource-server.test:POST {atlas-auth-proxy.resource-server.test}/process data: token=...

client<--atlas-auth-proxy.resource-server.test:302 Redirect\nLocation: {resource-server.test}/this/page/is/protected \nSet-Cookie: session=…; Domain={resource-server.test}\nSet-Cookie: SME-DNA_Bearer_Token=…

client->resource-server.test:GET /this/page/is/protected\nCookie: SME-DNA_Bearer_Token=…

client<--resource-server.test:200 OK