# dromara/maxkey architecture

> Architecture diagram of the GitHub repository dromara/maxkey, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/dromara/maxkey
- Repository: https://github.com/dromara/maxkey

## Overview

MaxKey is an enterprise IAM/IDaaS platform for centralized authentication, SSO, identity lifecycle management, application access, and administration. Its documented user journey is sign-in through a selected authentication method, issuance of authentication state or tokens, and access to trusted applications through federation protocols. Administration configures applications and access resources; identity lifecycle and directory-management capabilities form related branches. The tree and excerpts support the authentication/token and application-service details shown; most protocol and lifecycle implementations are represented at their enclosing directories because their source was not sampled.

Main entry points: [`maxkey-authentications/maxkey-authentication-core/src/main/java/org/dromara/maxkey/authn/jwt/AuthTokenService.java`](https://github.com/dromara/maxkey/blob/main/maxkey-authentications/maxkey-authentication-core/src/main/java/org/dromara/maxkey/authn/jwt/AuthTokenService.java) (JWT and tokens), [`maxkey-authentications/maxkey-authentication-provider/src/main/java/org/dromara/maxkey/authn/provider/AuthenticationProviderFactory.java`](https://github.com/dromara/maxkey/blob/main/maxkey-authentications/maxkey-authentication-provider/src/main/java/org/dromara/maxkey/authn/provider/AuthenticationProviderFactory.java) (Sign-in providers), [`maxkey-authentications/maxkey-authentication-provider/src/main/java/org/dromara/maxkey/authn/realm/ldap/LdapAuthenticationRealmService.java`](https://github.com/dromara/maxkey/blob/main/maxkey-authentications/maxkey-authentication-provider/src/main/java/org/dromara/maxkey/authn/realm/ldap/LdapAuthenticationRealmService.java) (LDAP and AD), [`maxkey-protocols/maxkey-protocol-oauth-2.0`](https://github.com/dromara/maxkey/tree/main/maxkey-protocols/maxkey-protocol-oauth-2.0) (OAuth and OIDC)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_auth["Authentication"]
  node_providers["Sign-in providers"]
  node_ldap["LDAP and AD"]
  node_token["JWT and tokens"]
  node_jwt["JWT signing"]
  node_sessions["Sessions"]
end

subgraph group_federation["Federation protocols"]
  node_oauth["OAuth and OIDC"]
  node_saml["SAML 2.0"]
  node_cas["CAS"]
end

subgraph group_management["Identity management"]
  node_ldapconfig["Directory config"]
  node_scim["SCIM lifecycle"]
  node_adminui["Management UI<br/>[apps.service.ts]"]
  node_appservice["Application service<br/>[apps.service.ts]"]
end

subgraph group_runtime["Access runtime"]
  node_appui["User application UI<br/>[apps.service.ts]"]
  node_resources["Access resources"]
  node_momentary[("Temporary state")]
end

node_user(("User"))
node_app(("Trusted application"))
node_admin(("Administrator"))
node_directory[("LDAP directory")]

node_user -->|"selects method"| node_providers
node_providers -->|"checks directory"| node_ldap
node_ldap -->|"loads configuration"| node_ldapconfig
node_ldap -.->|"authenticates against"| node_directory
node_providers -->|"issues credentials"| node_token
node_token -->|"creates JWT"| node_jwt
node_token -->|"stores tickets"| node_sessions
node_token -->|"checks captcha"| node_momentary
node_app -->|"requests SSO"| node_oauth
node_app -->|"requests SSO"| node_saml
node_app -->|"requests SSO"| node_cas
node_oauth -->|"returns identity"| node_app
node_saml -->|"returns assertion"| node_app
node_cas -->|"returns ticket"| node_app
node_admin -->|"manages platform"| node_adminui
node_adminui -->|"calls application API"| node_appservice
node_admin -->|"configures directories"| node_ldapconfig
node_admin -->|"manages lifecycle"| node_scim
node_user -->|"opens applications"| node_appui
node_appui -->|"requests access"| node_resources
node_resources -->|"grants application resources"| node_app

click node_providers "https://github.com/dromara/maxkey/blob/main/maxkey-authentications/maxkey-authentication-provider/src/main/java/org/dromara/maxkey/authn/provider/AuthenticationProviderFactory.java"
click node_ldap "https://github.com/dromara/maxkey/blob/main/maxkey-authentications/maxkey-authentication-provider/src/main/java/org/dromara/maxkey/authn/realm/ldap/LdapAuthenticationRealmService.java"
click node_ldapconfig "https://github.com/dromara/maxkey/blob/main/maxkey-persistence/src/main/java/org/dromara/maxkey/persistence/service/CnfLdapContextService.java"
click node_token "https://github.com/dromara/maxkey/blob/main/maxkey-authentications/maxkey-authentication-core/src/main/java/org/dromara/maxkey/authn/jwt/AuthTokenService.java"
click node_jwt "https://github.com/dromara/maxkey/blob/main/maxkey-authentications/maxkey-authentication-core/src/main/java/org/dromara/maxkey/authn/jwt/AuthJwtService.java"
click node_sessions "https://github.com/dromara/maxkey/blob/main/maxkey-authentications/maxkey-authentication-core/src/main/java/org/dromara/maxkey/authn/session/SessionManager.java"
click node_oauth "https://github.com/dromara/maxkey/tree/main/maxkey-protocols/maxkey-protocol-oauth-2.0"
click node_saml "https://github.com/dromara/maxkey/tree/main/maxkey-protocols/maxkey-protocol-saml-2.0"
click node_scim "https://github.com/dromara/maxkey/tree/main/maxkey-protocols"
click node_adminui "https://github.com/dromara/maxkey/blob/main/maxkey-web-frontend/maxkey-web-mgt-app/src/app/service/apps.service.ts"
click node_appservice "https://github.com/dromara/maxkey/blob/main/maxkey-web-frontend/maxkey-web-mgt-app/src/app/service/apps.service.ts"
click node_appui "https://github.com/dromara/maxkey/blob/main/maxkey-web-frontend/maxkey-web-app/src/app/service/apps.service.ts"
click node_resources "https://github.com/dromara/maxkey/blob/main/maxkey-persistence/src/main/java/org/dromara/maxkey/persistence/service/AuthzResourceService.java"
click node_momentary "https://github.com/dromara/maxkey/blob/main/maxkey-commons/maxkey-cache/src/main/java/org/dromara/maxkey/persistence/cache/MomentaryService.java"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_providers,node_ldap,node_token,node_jwt,node_sessions,node_user toneBlue
class node_oauth,node_saml,node_cas,node_directory toneAmber
class node_ldapconfig,node_scim,node_adminui,node_appservice toneMint
class node_appui,node_resources,node_momentary toneRose
class node_app,node_admin toneIndigo
```

## Components

### Authentication

- [Sign-in providers](https://github.com/dromara/maxkey/blob/main/maxkey-authentications/maxkey-authentication-provider/src/main/java/org/dromara/maxkey/authn/provider/AuthenticationProviderFactory.java): `maxkey-authentications/maxkey-authentication-provider/src/main/java/org/dromara/maxkey/authn/provider/AuthenticationProviderFactory.java`
- [LDAP and AD](https://github.com/dromara/maxkey/blob/main/maxkey-authentications/maxkey-authentication-provider/src/main/java/org/dromara/maxkey/authn/realm/ldap/LdapAuthenticationRealmService.java): `maxkey-authentications/maxkey-authentication-provider/src/main/java/org/dromara/maxkey/authn/realm/ldap/LdapAuthenticationRealmService.java`
- [JWT and tokens](https://github.com/dromara/maxkey/blob/main/maxkey-authentications/maxkey-authentication-core/src/main/java/org/dromara/maxkey/authn/jwt/AuthTokenService.java): `maxkey-authentications/maxkey-authentication-core/src/main/java/org/dromara/maxkey/authn/jwt/AuthTokenService.java`
- [JWT signing](https://github.com/dromara/maxkey/blob/main/maxkey-authentications/maxkey-authentication-core/src/main/java/org/dromara/maxkey/authn/jwt/AuthJwtService.java): `maxkey-authentications/maxkey-authentication-core/src/main/java/org/dromara/maxkey/authn/jwt/AuthJwtService.java`
- [Sessions](https://github.com/dromara/maxkey/blob/main/maxkey-authentications/maxkey-authentication-core/src/main/java/org/dromara/maxkey/authn/session/SessionManager.java): `maxkey-authentications/maxkey-authentication-core/src/main/java/org/dromara/maxkey/authn/session/SessionManager.java`

### Federation protocols

- [OAuth and OIDC](https://github.com/dromara/maxkey/tree/main/maxkey-protocols/maxkey-protocol-oauth-2.0): `maxkey-protocols/maxkey-protocol-oauth-2.0`
- [SAML 2.0](https://github.com/dromara/maxkey/tree/main/maxkey-protocols/maxkey-protocol-saml-2.0): `maxkey-protocols/maxkey-protocol-saml-2.0`
- **CAS**

### Identity management

- [Directory config](https://github.com/dromara/maxkey/blob/main/maxkey-persistence/src/main/java/org/dromara/maxkey/persistence/service/CnfLdapContextService.java): `maxkey-persistence/src/main/java/org/dromara/maxkey/persistence/service/CnfLdapContextService.java`
- [SCIM lifecycle](https://github.com/dromara/maxkey/tree/main/maxkey-protocols): `maxkey-protocols`
- [Management UI](https://github.com/dromara/maxkey/blob/main/maxkey-web-frontend/maxkey-web-mgt-app/src/app/service/apps.service.ts): `maxkey-web-frontend/maxkey-web-mgt-app/src/app/service/apps.service.ts`
- [Application service](https://github.com/dromara/maxkey/blob/main/maxkey-web-frontend/maxkey-web-mgt-app/src/app/service/apps.service.ts): `maxkey-web-frontend/maxkey-web-mgt-app/src/app/service/apps.service.ts`

### Access runtime

- [User application UI](https://github.com/dromara/maxkey/blob/main/maxkey-web-frontend/maxkey-web-app/src/app/service/apps.service.ts): `maxkey-web-frontend/maxkey-web-app/src/app/service/apps.service.ts`
- [Access resources](https://github.com/dromara/maxkey/blob/main/maxkey-persistence/src/main/java/org/dromara/maxkey/persistence/service/AuthzResourceService.java): `maxkey-persistence/src/main/java/org/dromara/maxkey/persistence/service/AuthzResourceService.java`
- [Temporary state](https://github.com/dromara/maxkey/blob/main/maxkey-commons/maxkey-cache/src/main/java/org/dromara/maxkey/persistence/cache/MomentaryService.java): `maxkey-commons/maxkey-cache/src/main/java/org/dromara/maxkey/persistence/cache/MomentaryService.java`

### Other components

- **User**
- **Trusted application**
- **Administrator**
- **LDAP directory**

## Connections

- User → Sign-in providers: selects method
- Sign-in providers → LDAP and AD: checks directory
- LDAP and AD → Directory config: loads configuration
- LDAP and AD → LDAP directory: authenticates against
- Sign-in providers → JWT and tokens: issues credentials
- JWT and tokens → JWT signing: creates JWT
- JWT and tokens → Sessions: stores tickets
- JWT and tokens → Temporary state: checks captcha
- Trusted application → OAuth and OIDC: requests SSO
- Trusted application → SAML 2.0: requests SSO
- Trusted application → CAS: requests SSO
- OAuth and OIDC → Trusted application: returns identity
- SAML 2.0 → Trusted application: returns assertion
- CAS → Trusted application: returns ticket
- Administrator → Management UI: manages platform
- Management UI → Application service: calls application API
- Administrator → Directory config: configures directories
- Administrator → SCIM lifecycle: manages lifecycle
- User → User application UI: opens applications
- User application UI → Access resources: requests access
- Access resources → Trusted application: grants application resources