workspace "Entra ID (Azure AD) <-> Amazon Cognito" "SAML-Federation fuer die Capita Web-Tools · Shared Cognito Pool" {
  model {
    user = person "Mitarbeiter" "User / Browser"

    aws = softwareSystem "AWS Cloud · eu-central-1" {
      web = container "Web-Tools" "Apps Portal / CloudFront+S3" "CloudFront + S3"
      cognito = container "Amazon Cognito" "User Pool · Broker/SP" "SAML Service Provider / Identity Broker"
      lambda = container "Pre-Token Lambda" "App-Zugriff+Gruppen" "AWS Lambda"
      dynamodb = container "DynamoDB" "app-access · Gruppen" "Amazon DynamoDB"
    }

    azure = softwareSystem "Microsoft Azure · Entra ID Tenant" {
      entra = container "Microsoft Entra ID" "IdP · MFA · Cond. Access" "SAML Identity Provider"
    }

    user -> web "1 Aufruf (HTTPS)"
    web -> cognito "2 Login-Redirect · PKCE"
    cognito -> entra "3 SAML AuthnRequest"
    entra -> cognito "5 SAML-Assertion, emailaddress = UPN"
    cognito -> lambda "6 Pre-Token-Trigger"
    lambda -> dynamodb "7 prueft Gruppen"
    cognito -> web "8 Token (JWT) -> eingeloggt"
  }

  views {
    container aws "saml-federation" {
      include *
      autoLayout lr
      title "Entra ID (Azure AD) <-> Amazon Cognito"
      description "4 Anmeldung + MFA / Conditional Access findet am Entra-Knoten statt."
    }

    styles {
      element "Person" {
        background "#F5F5F5"
        color "#24292F"
        stroke "#666666"
      }
      element "Container" {
        shape RoundedBox
      }
      element "Software System" {
        background "#FFF6EE"
        color "#232F3E"
      }
      relationship "Relationship" {
        color "#4A5568"
        thickness 2
      }
    }
  }
}