MVP Dashboard Composition Flow — GARB ADS as submitted

MVP Dashboard Composition Flow — GARB ADS as submitted A sequence diagram generated by Archify. Access Dashboard Redirect for Authentication Authenticate Authorization Code Exchange Authorization Code ID Token + OAuth Access Token — decrypted, claims validated Create session in Cosmos DB → Redirect with Secure HttpOnly Cookie Request Dashboard with Session Cookie Validate Session → Exchange OAuth Access Token Gateway Access Token Render Dashboard Framework Load Eligible MFE + Provide Gateway Token via secure context Request Integration API (Bearer Gateway Token) + encrypted ForgeRock ID JWT Validate APIM Token, enforce scopes → Forward request Retrieve Business Data + ForgeRock ID JWT Token Response Normalized Response Authorized Response (Widget Model) Map Response to Widget Model → Render Widget/Page MFE Tiles/Experience rendered OIDC authentication Session + shell render MFE data retrieval Widget render Customer Browser · Sequence participant Customer Browser ForgeRock CIAM · Sequence participant ForgeRock CIAM Dashboard Shell + BFF · Sequence participant Dashboard Shell + BFF Product MFE · Sequence participant Product MFE API Gateway · Sequence participant API Gateway Integration API · Sequence participant Integration API BU APIs · Sequence participant BU APIs Legend request return security default message

Composition

  • • Shell framework renders before widget data
  • • MFEs fetch their own data asynchronously
  • • One MFE lane drawn; repeated per eligible BU

Three token hops

  • • CIAM tokens to a Secure HttpOnly session cookie
  • • OAuth token to a gateway access token
  • • MFE calls add an encrypted ForgeRock ID JWT

Not shown here

  • • Authorization stays in the BU portals
  • • BU Mapping decides MFE eligibility
  • • Cosmos DB session store, Redis cache