====== ADUCID architecture ======

{{:documentation:aducid-architecture-overview.png?400|}}

This chapter describes internal functionality of ADUCID.

=== Server part of ADUCID ===

The entire server part along with the operating system and all third-party systems required to operate the server part of ADUCID are supplied as complete virtual appliance but can be installed as a set of components.
See [[components:aim|AIM - ADUCID Server Side Components]]

=== PEIG  - Client part of ADUCID ===

See [[components:client|PEIG - Client software]]

=== Target application ===
Target application is any application that uses ADUCID® services. Examples of such applications include web applications with standard thin client (standard browser), mobile applications with server counterpart, classic client-server applications, or even universal system tools which are not normally viewed as applications, e.g. a VPN system for remote access, Wi-Fi connection, terminal access (e.g. X terminal), etc.

From the system point of view, the application consists of a client part and a server part (TA Client and TA Server), which communicate with each other in their own manner via an R1 interface.

With [[nocode:start|No-Code Integration]] all applications are insulated behind AAA Proxy.
===== Interfaces =====

ADUCID uses four basic interfaces:

==== R1 ====

R1 is an application interface handled by customer application itself. In mobile application integration R1 is encapsulated in PEIG API.

==== R2 ====

R2 is an interface between client application and PEIG. This communication can be handled via:

  * URI scheme on mobile phones scheme **aducid**
  * Scanning a QR code
  * Integrated using PEIG API
  * Low level R2 is implemented as UNIX Socket or Windows Pipe

On Windows and OS X PEIG R2 can be called using auxiliary application PEIG which acceps RUI as an arguments and sends it via Unix socket / Windows pipe

==== R3 ====

R3 is an internal interface between PEIG and AIM which uses http transport and SOAP protocol.

==== R4 ====

R4 is interface between server application and AIM. Like R3 it uses http (or https) transport and SOAP protocol.

R4 is “a low level” layer. It is encapsulated in ADUCID WEB Platform SDK or ADUCID Client SDK for simplified integration.


===== Communication between components =====

A fundamental unit of activity in ADUCID<sup>®</sup>  is an operation. Such operation can be an authentication, creation (initialization) of an electronic identity, a change in electronic identity, etc. Operations can have their own parameters.

{{:developers:aducid-communication-diagram.png?nolink&601x376}}

**Communications diagram**

The server part of the target application first requests the required operation via the R4 control interface and specifies its AIM parameters.

The result is a unique, one-time authId operation identifier that can be initiated either by the target application or AIM.

The client part of the target application transmits the PEIG<sup>®</sup>  startup event through the R2 interface. The startup event includes authId and the R3 interface URL.

Communication between the client part and the server part of the target application via the R1 interface is handled by the target application.

The startup event from the R2 interface is sent to PEIG<sup>®</sup>  . PEIG<sup>®</sup>  then starts processing the operation by transmitting the authId to R3 URL. AIM manages the entire operation process that consists of transmitting and processing several messages between PEIG<sup>®</sup>  and AIM.

In terms of communication, PEIG<sup>®</sup>  is a client and an AIM a server. In terms of control, the operation is managed by the AIM (based on target application request submission).

When the operation is concluded, a random, one-time secret authKey is generated on PEIG<sup>®</sup>  (if successful), which is then transmitted to the client part of the target application along with authId via R2.

The server part uses authId and authKey for further communication with AIM via the R4 interface in order to obtain electronic identity attributes and to work with user data (personal objects). In order for these requests to be carried out successfully, correct values for authId and authKey (one-time secret that was transmitted at the end of a successful operation at the client part of the target application) must be transmitted.

PEIG finishes its activity by using a return URI. Then, depending on scenario, final action is executed (AJAX reload, page refresh, redirect). 

[<>]