sequenceDiagram
    participant User
    participant ReactApp as React App (Client)
    participant BackendServer as Backend Server
    participant OIDCProvider as OIDC Provider

    User->>ReactApp: Clicks Login
    ReactApp->>OIDCProvider: Redirect to /oidc/auth
    OIDCProvider->>User: Present Login Form
    User->>OIDCProvider: Enter Credentials
    OIDCProvider->>ReactApp: Redirect with Authorization Code
    ReactApp->>BackendServer: POST /exchange (code)
    BackendServer->>OIDCProvider: POST /oidc/token (code, client_id, client_secret)
    OIDCProvider->>BackendServer: Access Token, Refresh Token, ID Token
    BackendServer->>ReactApp: Access Token, Refresh Token, ID Token
    ReactApp->>ReactApp: Store Tokens

sequenceDiagram
    participant User
    participant ReactApp as React App (Client)
    participant BackendServer as Backend Server
    participant OIDCProvider as OIDC Provider

    User->>ReactApp: Requests Protected Resource
    ReactApp->>BackendServer: GET /api/private (with Access Token)
    BackendServer->>OIDCProvider: POST /oidc/introspect (Access Token)
    OIDCProvider->>BackendServer: Token Info (active: true/false)
    alt Token is valid
        BackendServer->>ReactApp: Private Data
    else Token is invalid
        BackendServer->>ReactApp: 401 Unauthorized
    end

sequenceDiagram
    participant User
    participant ReactApp as React App (Client)
    participant BackendServer as Backend Server
    participant OIDCProvider as OIDC Provider

    User->>ReactApp: Requests Protected Resource
    ReactApp->>BackendServer: GET /api/privateJWKS (with ID Token)
    BackendServer->>BackendServer: Check JWKS Cache
    alt JWKS is cached
        BackendServer->>BackendServer: Use cached JWKS
    else JWKS not cached
        BackendServer->>OIDCProvider: GET /oidc/jwks
        OIDCProvider->>BackendServer: JWKS
        BackendServer->>BackendServer: Cache JWKS
    end
    BackendServer->>BackendServer: Verify ID Token Signature using JWKS
    alt Signature is valid
        BackendServer->>ReactApp: Private Data
    else Signature is invalid
        BackendServer->>ReactApp: 401 Unauthorized
    end

sequenceDiagram
    participant User
    participant ReactApp as React App (Client)
    participant BackendServer as Backend Server
    participant OIDCProvider as OIDC Provider

    User->>ReactApp: Accesses Resource After Token Expiry
    ReactApp->>BackendServer: GET /api/private (with Access Token)
    BackendServer->>OIDCProvider: POST /oidc/introspect (Access Token)
    OIDCProvider->>BackendServer: Token Info (active: true/false)
    alt Token is invalid
        BackendServer->>ReactApp: 401 Unauthorized
        ReactApp->>BackendServer: POST /refresh (with Refresh Token)
        BackendServer->>OIDCProvider: POST /oidc/token (refresh_token, client_id, client_secret)
        OIDCProvider->>BackendServer: New Access Token
        BackendServer->>ReactApp: New Access Token
        ReactApp->>ReactApp: Store New Access Token
        ReactApp->>BackendServer: Retry GET /api/private (with New Access Token)
        BackendServer->>OIDCProvider: POST /oidc/introspect (New Access Token)
        OIDCProvider->>BackendServer: Token Info (active: true)
        BackendServer->>ReactApp: Private Data
    else Token is valid
        BackendServer->>ReactApp: Private Data
    end

sequenceDiagram
    participant User
    participant App3 as App 3 Frontend
    participant App4 as App 4 Frontend
    participant SP as Service Provider
    participant IdP as SAML Identity Provider

    User->>App3: Clicks "🚀 Login with SAML"
    App3->>SP: GET /sp/sso/initiate?app=app3&returnUrl=...
    SP->>SP: Generate SAML AuthnRequest + RelayState
    SP->>IdP: POST SAMLRequest (HTTP-POST Binding)
    IdP->>User: Present Login Form
    User->>IdP: Enter Credentials (john@example.com)
    IdP->>IdP: Validate User & Generate SAML Response
    IdP->>SP: POST SAML Response to ACS (/sp/acs)
    SP->>SP: Validate SAML Assertion & Create Session
    SP->>App3: HTTP 302 Redirect to App3
    App3->>App3: ✅ User Authenticated
    
    Note over User,IdP: 🎉 SSO Complete! User can now access App4 without re-authentication
    
    User->>App4: Navigate to App 4
    App4->>SP: GET /sp/session/status
    SP->>App4: { authenticated: true, assertion: {...} }
    App4->>App4: ✅ Already Authenticated (SSO!)

sequenceDiagram
    participant User
    participant App3 as App 3 (Analytics)
    participant App4 as App 4 (Dashboard)
    participant SP as Service Provider
    participant IdP as Identity Provider

    Note over User,IdP: User starts at App 3
    User->>App3: Access App 3
    App3->>SP: Check session status
    SP->>App3: Not authenticated
    User->>App3: Click "Login with SAML"
    
    rect rgb(200, 255, 200)
        Note over User,IdP: SAML Authentication (First Time)
        App3->>SP: Initiate SAML SSO
        SP->>IdP: SAML AuthnRequest
        IdP->>User: Login form
        User->>IdP: Provide credentials
        IdP->>SP: SAML Response
        SP->>SP: Create session
        SP->>App3: Redirect back
    end
    
    App3->>App3: ✅ Authenticated
    
    Note over User,IdP: User switches to App 4 (SSO Magic!)
    User->>App4: Access App 4
    App4->>SP: Check session status
    SP->>App4: ✅ Already authenticated!
    App4->>App4: ✅ Automatically logged in (No re-authentication needed)
    
    User->>App4: Fetch private data
    App4->>SP: GET /api/protected/app4
    SP->>App4: ✅ Protected data returned

sequenceDiagram
    participant User
    participant App3 as App 3
    participant App4 as App 4  
    participant SP as Service Provider
    participant IdP as Identity Provider

    Note over User,IdP: User authenticated in both apps
    App3->>App3: ✅ Authenticated
    App4->>App4: ✅ Authenticated
    
    User->>App3: Click "🔐 SAML Single Logout"
    App3->>SP: GET /sp/slo/initiate
    SP->>SP: Generate SAML LogoutRequest
    SP->>IdP: GET /idp/slo (SAMLRequest)
    IdP->>IdP: Clear IdP session
    IdP->>IdP: Generate SAML LogoutResponse  
    IdP->>SP: POST /sp/slo (SAMLResponse)
    SP->>SP: Clear SP session
    SP->>User: Show logout success page
    
    Note over User,IdP: 🚨 Global logout effect
    User->>App4: Try to access App 4
    App4->>SP: Check session status
    SP->>App4: ❌ Not authenticated (session destroyed)
    App4->>App4: ❌ User logged out
    
    User->>App3: Try to fetch protected data
    App3->>SP: GET /api/protected/app3
    SP->>App3: ❌ 401 Unauthorized (session destroyed)

sequenceDiagram
    participant User
    participant Frontend as React App
    participant SP as Service Provider
    
    User->>Frontend: Access protected resource
    Frontend->>SP: GET /api/protected/app3 (with cookies)
    SP->>SP: Check session.loggedIn
    
    alt Session exists and valid
        SP->>SP: Check assertion.validUntil (30 min)
        alt Session not expired  
            SP->>Frontend: ✅ Protected data + user attributes
        else Session expired
            SP->>SP: Destroy session
            SP->>Frontend: ❌ 401 - Session expired, please re-authenticate
        end
    else No session
        SP->>Frontend: ❌ 401 - Authentication required
        Frontend->>SP: Redirect to /sp/sso/initiate
    end

sequenceDiagram
    participant Browser as User Browser
    participant App as App 3/4<br/>(Frontend)
    participant SP as Service Provider<br/>(http://localhost:4001)
    participant IdP as Identity Provider<br/>(http://localhost:4002)

    Note over Browser,IdP: 🔴 HTTP-POST Binding Method (More Secure)
    
    Browser->>App: Click "🔴 Login with POST Method"
    App->>SP: GET /sp/sso/initiate-post?app=app3&returnUrl=...
    activate SP
    
    SP->>SP: Generate SAML AuthnRequest<br/>+ RequestID=_uuid<br/>+ IssueInstant=timestamp
    SP->>SP: Base64 encode AuthnRequest<br/>+ Create RelayState JSON
    SP->>Browser: HTML with Auto-Submit Form
    
    Note right of SP: &lt;form method="POST" action="http://localhost:4002/idp/sso"&gt;<br/>&lt;input name="SAMLRequest" value="base64XML..." /&gt;<br/>&lt;input name="RelayState" value='{"app":"app3"}' /&gt;<br/>&lt;/form&gt;
    
    Browser->>IdP: HTTP POST http://localhost:4002/idp/sso<br/>Content-Type: application/x-www-form-urlencoded<br/>Body: SAMLRequest=base64...&RelayState=...
    activate IdP
    
    IdP->>IdP: Decode Base64 SAMLRequest<br/>+ Parse XML AuthnRequest<br/>+ Extract RequestID
    IdP->>Browser: Login Form HTML<br/>(Email/Password + hidden SAMLRequest)
    Browser->>Browser: User enters credentials<br/>(john@example.com / password123)
    Browser->>IdP: HTTP POST /idp/login<br/>Body: email=john@example.com&password=...&SAMLRequest=...
    IdP->>IdP: Validate credentials<br/>+ Generate SAML Response<br/>+ InResponseTo=RequestID
    IdP->>Browser: Auto-Submit Form to SP ACS
    
    Note right of IdP: &lt;form method="POST" action="http://localhost:4001/sp/acs"&gt;<br/>&lt;input name="SAMLResponse" value="base64Response..." /&gt;<br/>&lt;input name="RelayState" value='{"app":"app3"}' /&gt;<br/>&lt;/form&gt;
    
    Browser->>SP: HTTP POST http://localhost:4001/sp/acs<br/>Body: SAMLResponse=base64...&RelayState=...
    SP->>SP: Decode SAML Response<br/>+ Validate Assertion<br/>+ Create Session<br/>+ Extract user attributes
    SP->>Browser: HTTP 302 Redirect<br/>Location: http://localhost:4003
    deactivate SP
    deactivate IdP

    Note over Browser,IdP: 🟢 HTTP-Redirect Binding Method (Simpler)
    
    Browser->>App: Click "🟢 Login with Redirect Method"
    App->>SP: GET /sp/sso/initiate-redirect?app=app4&returnUrl=...
    activate SP
    
    SP->>SP: Generate SAML AuthnRequest<br/>+ RequestID=_uuid<br/>+ IssueInstant=timestamp
    SP->>SP: Base64 + URL encode AuthnRequest<br/>+ Create RelayState JSON
    SP->>Browser: HTTP 302 Redirect<br/>Location: http://localhost:4002/idp/sso?SAMLRequest=urlEncoded...&RelayState=urlEncoded...
    
    Browser->>IdP: HTTP GET http://localhost:4002/idp/sso<br/>Query Params:<br/>- SAMLRequest=base64UrlEncoded...<br/>- RelayState=urlEncodedJSON...
    activate IdP
    
    IdP->>IdP: URL decode + Base64 decode SAMLRequest<br/>+ Parse XML AuthnRequest<br/>+ Extract RequestID
    IdP->>Browser: Login Form HTML<br/>(Same form but method=GET in URL)
    Browser->>Browser: User enters credentials<br/>(john@example.com / password123)
    Browser->>IdP: HTTP POST /idp/login<br/>Body: email=john@example.com&password=...&SAMLRequest=...&originalMethod=GET
    IdP->>IdP: Validate credentials<br/>+ Generate SAML Response<br/>+ InResponseTo=RequestID
    IdP->>Browser: Auto-Submit Form to SP ACS
    
    Note right of IdP: &lt;form method="POST" action="http://localhost:4001/sp/acs"&gt;<br/>&lt;input name="SAMLResponse" value="base64Response..." /&gt;<br/>&lt;input name="RelayState" value='{"app":"app4"}' /&gt;<br/>&lt;/form&gt;<br/>Note: Response always uses POST
    
    Browser->>SP: HTTP POST http://localhost:4001/sp/acs<br/>Body: SAMLResponse=base64...&RelayState=...
    SP->>SP: Decode SAML Response<br/>+ Validate Assertion<br/>+ Create Session<br/>+ Extract user attributes
    SP->>Browser: HTTP 302 Redirect<br/>Location: http://localhost:4004
    deactivate SP
    deactivate IdP

    Note over Browser,IdP: 📊 Technical Comparison
    
    rect rgb(255, 200, 200)
        Note over Browser,IdP: HTTP-POST Binding:<br/>✅ SAMLRequest in HTTP POST body<br/>✅ More secure (not visible in URL/logs)<br/>✅ Can handle larger payloads (>2048 chars)<br/>✅ Content-Type: application/x-www-form-urlencoded<br/>❌ Requires JavaScript for auto-submit
    end
    
    rect rgb(200, 255, 200)
        Note over Browser,IdP: HTTP-Redirect Binding:<br/>✅ SAMLRequest in URL query parameters<br/>✅ Simpler implementation (no forms)<br/>✅ Works without JavaScript<br/>✅ Faster (fewer network calls)<br/>❌ Visible in browser history/logs<br/>❌ URL length limitations (~2048 chars)<br/>❌ GET request can be cached
    end