Maximize
Component View: ORamaVR Cloud - ORamaVR Portal Detailed login and product authorization from the Portal OIDC session through token issuance, role and tenant claims, feature grants, and SDK user or tenant license checks. ORamaVR Cloud [Software System] Login API [Container: C# / ASP.NET Core] ORamaVR Portal [Container: Angular / TypeScript — AnalyticsClient/src/app] SDK License API [Component: C# — LicenseController] Authenticated endpoints for license queries, grants, assignments, checkouts, updates, and removals. Product Catalogue API [Component: C# — ProductsController] Product catalogue, versions, tenant and user product links, and license inventory endpoints. Tenant Administration API [Component: C# — TenantsController] Tenant hierarchy, members, feature grants, and tenant lifecycle endpoints. User Administration API [Component: C# — UsersController] Current-user, account, role, tenant, and user-management endpoints. OIDC & OAuth Authorization Server [Component: C# — IdentityServer4 + Startup/Config] Authorization-code with PKCE, refresh, client credentials, and external token-exchange flows for Portal and SDK clients. Interactive Account Sign-in [Component: C# — AccountController + ExternalController + ASP.NET Identity] Username/password and external-provider login, account confirmation, lockout, cookies, and authorization redirects. External Token Exchange [Component: C# — CustomGrantValidator] Validates an external identity token, resolves the local user, and requires acceptance of the license agreement. Token Claims & Profile [Component: C# — ProfileService] Loads the active user and emits identity, role, and tenant claims into ID and access tokens. License Grants & Assignments [Component: C# — LicenseService] Checks product access and manages SDK license grants, seats, assignments, and checkout lifecycle. Product & Access Management [Component: C# — ProductService] Manages products, versions, tenant and user product access, downloads, and license inventory. Tenant & Feature Management [Component: C# — TenantService] Manages tenants, sub-tenants, members, and feature grants. User & Invitation Management [Component: C# — UserService + UserInvitationService] Manages users, roles, tenant membership, invitations, and accepted license agreements. Identity & License Persistence [Component: EF Core — ApplicationDbContext] Stores users, tenants, products, license grants, license assignments, feature grants, and invitations. OIDC Session Client [Component: TypeScript — AuthService + angular-auth-oidc-client] Starts the authorization-code with PKCE flow and manages authentication state, user claims, access tokens, renewal, and logout. Route, Role & Feature Guard [Component: TypeScript — AuthorizationGuard] Requires an authenticated session, validates role claims, loads the current user, and checks tenant feature grants. Bearer Token Interceptor [Component: TypeScript — AuthInterceptor] Attaches the current access token to protected API requests and logs out on 401 or 403 responses. SDK Product Access Evaluator [Component: TypeScript — SdkProAccessService] Allows protected SDK features when either the user or tenant has a current premium SDK license. SDKLicenseAPI → LicenseGrantsAssignments — Queries and manages licenses Queries and manages licenses ProductCatalogueAPI → ProductAccessManagement — Manages products and product access Manages products and product access TenantAdministrationAPI → TenantFeatureManagement — Manages tenants and feature grants Manages tenants and feature grants UserAdministrationAPI → UserInvitationManagement — Manages users, roles, and membership Manages users, roles, and membership OIDCOAuthAuthorizationServer → InteractiveAccountSignin — Redirects browser authentication Redirects browser authentication OIDCOAuthAuthorizationServer → ExternalTokenExchange — Validates external token exchange grants Validates external token exchange grants OIDCOAuthAuthorizationServer → TokenClaimsProfile — Builds identity and access-token claims Builds identity and access-token claims InteractiveAccountSignin → IdentityLicensePersistence — Validates users and sign-in state Validates users and sign-in state ExternalTokenExchange → IdentityLicensePersistence — Resolves external identities and agreement acceptance Resolves external identities and agreement acceptance TokenClaimsProfile → IdentityLicensePersistence — Loads users, roles, and tenant context Loads users, roles, and tenant context ProductAccessManagement → LicenseGrantsAssignments — Coordinates product license operations Coordinates product license operations TenantFeatureManagement → ProductAccessManagement — Resolves tenant product access Resolves tenant product access UserInvitationManagement → ProductAccessManagement — Resolves user product access Resolves user product access UserInvitationManagement → LicenseGrantsAssignments — Coordinates user license operations Coordinates user license operations LicenseGrantsAssignments → IdentityLicensePersistence — Reads and writes grants and assignments Reads and writes grants and assignments ProductAccessManagement → IdentityLicensePersistence — Reads and writes products and access Reads and writes products and access TenantFeatureManagement → IdentityLicensePersistence — Reads and writes tenants and features Reads and writes tenants and features UserInvitationManagement → IdentityLicensePersistence — Reads and writes users and invitations Reads and writes users and invitations RouteRoleFeatureGuard → OIDCSessionClient — Checks authentication, claims, and current user Checks authentication, claims, and current user RouteRoleFeatureGuard → BearerTokenInterceptor — Sends authenticated authorization checks Sends authenticated authorization checks RouteRoleFeatureGuard → SDKProductAccessEvaluator — Requires SDK product access where configured Requires SDK product access where configured SDKProductAccessEvaluator → BearerTokenInterceptor — Sends authenticated product checks Sends authenticated product checks BearerTokenInterceptor → OIDCSessionClient — Reads the current access token Reads the current access token OIDCSessionClient → OIDCOAuthAuthorizationServer — Authorization code with PKCE, token renewal, and logout [OIDC / OAuth 2.0] Authorization code with PKCE, token renewal, and logout [OIDC / OAuth 2.0] OIDCSessionClient → UserAdministrationAPI — Loads the current user and tenant context [HTTPS / JSON] Loads the current user and tenant context [HTTPS / JSON] RouteRoleFeatureGuard → TenantAdministrationAPI — Checks tenant feature grants for protected routes [HTTPS / JSON] Checks tenant feature grants for protected routes [HTTPS / JSON] SDKProductAccessEvaluator → SDKLicenseAPI — Checks the authenticated user's SDK license type [HTTPS / JSON] Checks the authenticated user's SDK license type [HTTPS / JSON] SDKProductAccessEvaluator → ProductCatalogueAPI — Checks the tenant's current SDK product licenses [HTTPS / JSON] Checks the tenant's current SDK product licenses [HTTPS / JSON] Component View: ORamaVR Cloud - ORamaVR Portal Legend
Component View: ORamaVR Cloud - ORamaVR Portal Detailed login and product authorization from the Portal OIDC session through token issuance, role and tenant claims, feature grants, and SDK user or tenant license checks. ORamaVR Cloud [Software System] Login API [Container: C# / ASP.NET Core] ORamaVR Portal [Container: Angular / TypeScript — AnalyticsClient/src/app] SDK License API [Component: C# — LicenseController] Authenticated endpoints for license queries, grants, assignments, checkouts, updates, and removals. Product Catalogue API [Component: C# — ProductsController] Product catalogue, versions, tenant and user product links, and license inventory endpoints. Tenant Administration API [Component: C# — TenantsController] Tenant hierarchy, members, feature grants, and tenant lifecycle endpoints. User Administration API [Component: C# — UsersController] Current-user, account, role, tenant, and user-management endpoints. OIDC & OAuth Authorization Server [Component: C# — IdentityServer4 + Startup/Config] Authorization-code with PKCE, refresh, client credentials, and external token-exchange flows for Portal and SDK clients. Interactive Account Sign-in [Component: C# — AccountController + ExternalController + ASP.NET Identity] Username/password and external-provider login, account confirmation, lockout, cookies, and authorization redirects. External Token Exchange [Component: C# — CustomGrantValidator] Validates an external identity token, resolves the local user, and requires acceptance of the license agreement. Token Claims & Profile [Component: C# — ProfileService] Loads the active user and emits identity, role, and tenant claims into ID and access tokens. License Grants & Assignments [Component: C# — LicenseService] Checks product access and manages SDK license grants, seats, assignments, and checkout lifecycle. Product & Access Management [Component: C# — ProductService] Manages products, versions, tenant and user product access, downloads, and license inventory. Tenant & Feature Management [Component: C# — TenantService] Manages tenants, sub-tenants, members, and feature grants. User & Invitation Management [Component: C# — UserService + UserInvitationService] Manages users, roles, tenant membership, invitations, and accepted license agreements. Identity & License Persistence [Component: EF Core — ApplicationDbContext] Stores users, tenants, products, license grants, license assignments, feature grants, and invitations. OIDC Session Client [Component: TypeScript — AuthService + angular-auth-oidc-client] Starts the authorization-code with PKCE flow and manages authentication state, user claims, access tokens, renewal, and logout. Route, Role & Feature Guard [Component: TypeScript — AuthorizationGuard] Requires an authenticated session, validates role claims, loads the current user, and checks tenant feature grants. Bearer Token Interceptor [Component: TypeScript — AuthInterceptor] Attaches the current access token to protected API requests and logs out on 401 or 403 responses. SDK Product Access Evaluator [Component: TypeScript — SdkProAccessService] Allows protected SDK features when either the user or tenant has a current premium SDK license. SDKLicenseAPI → LicenseGrantsAssignments — Queries and manages licenses Queries and manages licenses ProductCatalogueAPI → ProductAccessManagement — Manages products and product access Manages products and product access TenantAdministrationAPI → TenantFeatureManagement — Manages tenants and feature grants Manages tenants and feature grants UserAdministrationAPI → UserInvitationManagement — Manages users, roles, and membership Manages users, roles, and membership OIDCOAuthAuthorizationServer → InteractiveAccountSignin — Redirects browser authentication Redirects browser authentication OIDCOAuthAuthorizationServer → ExternalTokenExchange — Validates external token exchange grants Validates external token exchange grants OIDCOAuthAuthorizationServer → TokenClaimsProfile — Builds identity and access-token claims Builds identity and access-token claims InteractiveAccountSignin → IdentityLicensePersistence — Validates users and sign-in state Validates users and sign-in state ExternalTokenExchange → IdentityLicensePersistence — Resolves external identities and agreement acceptance Resolves external identities and agreement acceptance TokenClaimsProfile → IdentityLicensePersistence — Loads users, roles, and tenant context Loads users, roles, and tenant context ProductAccessManagement → LicenseGrantsAssignments — Coordinates product license operations Coordinates product license operations TenantFeatureManagement → ProductAccessManagement — Resolves tenant product access Resolves tenant product access UserInvitationManagement → ProductAccessManagement — Resolves user product access Resolves user product access UserInvitationManagement → LicenseGrantsAssignments — Coordinates user license operations Coordinates user license operations LicenseGrantsAssignments → IdentityLicensePersistence — Reads and writes grants and assignments Reads and writes grants and assignments ProductAccessManagement → IdentityLicensePersistence — Reads and writes products and access Reads and writes products and access TenantFeatureManagement → IdentityLicensePersistence — Reads and writes tenants and features Reads and writes tenants and features UserInvitationManagement → IdentityLicensePersistence — Reads and writes users and invitations Reads and writes users and invitations RouteRoleFeatureGuard → OIDCSessionClient — Checks authentication, claims, and current user Checks authentication, claims, and current user RouteRoleFeatureGuard → BearerTokenInterceptor — Sends authenticated authorization checks Sends authenticated authorization checks RouteRoleFeatureGuard → SDKProductAccessEvaluator — Requires SDK product access where configured Requires SDK product access where configured SDKProductAccessEvaluator → BearerTokenInterceptor — Sends authenticated product checks Sends authenticated product checks BearerTokenInterceptor → OIDCSessionClient — Reads the current access token Reads the current access token OIDCSessionClient → OIDCOAuthAuthorizationServer — Authorization code with PKCE, token renewal, and logout [OIDC / OAuth 2.0] Authorization code with PKCE, token renewal, and logout [OIDC / OAuth 2.0] OIDCSessionClient → UserAdministrationAPI — Loads the current user and tenant context [HTTPS / JSON] Loads the current user and tenant context [HTTPS / JSON] RouteRoleFeatureGuard → TenantAdministrationAPI — Checks tenant feature grants for protected routes [HTTPS / JSON] Checks tenant feature grants for protected routes [HTTPS / JSON] SDKProductAccessEvaluator → SDKLicenseAPI — Checks the authenticated user's SDK license type [HTTPS / JSON] Checks the authenticated user's SDK license type [HTTPS / JSON] SDKProductAccessEvaluator → ProductCatalogueAPI — Checks the tenant's current SDK product licenses [HTTPS / JSON] Checks the tenant's current SDK product licenses [HTTPS / JSON] Component View: ORamaVR Cloud - ORamaVR Portal [
svg |
png |
puml ]