@startuml
title Entra ID (Azure AD) <-> Amazon Cognito
caption SAML-Federation fuer die Capita Web-Tools · Shared Cognito Pool
left to right direction
skinparam backgroundColor transparent
skinparam shadowing false
skinparam linetype polyline
skinparam defaultFontName Inter
skinparam rectangle {
  RoundCorner 10
  BorderThickness 1.5
}
skinparam note {
  BorderColor #0078D4
  BackgroundColor #FFFFFF
  FontColor #0F5BA8
}

rectangle "Mitarbeiter\nUser / Browser" as userNode #F5F5F5

rectangle "AWS Cloud · eu-central-1" as aws #FFF6EE {
  rectangle "Web-Tools\nApps Portal / CloudFront+S3" as web #EDE7F6
  rectangle "Amazon Cognito\nUser Pool · Broker/SP" as cognito #FFEBEE
  rectangle "Pre-Token Lambda\nApp-Zugriff+Gruppen" as lambda #FFF2E8
  database "DynamoDB\napp-access · Gruppen" as dynamodb #F5E6F7
}

rectangle "Microsoft Azure · Entra ID Tenant" as azure #EAF1FB {
  rectangle "Microsoft Entra ID\nIdP · MFA · Cond. Access" as entra #EAF1FB
}

note bottom of entra
4 Anmeldung + MFA
Conditional Access
end note

userNode -[#4A5568]-> web : 1 Aufruf (HTTPS)
web -[#4A5568]-> cognito : 2 Login-Redirect · PKCE
cognito -[#0F6CBD,thickness=2]-> entra : 3 SAML AuthnRequest
entra -[#0F6CBD,thickness=2]-> cognito : 5 SAML-Assertion\nemailaddress = UPN
cognito -[#4A5568]-> lambda : 6 Pre-Token-Trigger
lambda -[#4A5568]-> dynamodb : 7 prueft Gruppen
cognito -[#1F7A52,thickness=2]-> web : 8 Token (JWT) -> eingeloggt
@enduml