How Gateway handles state

When gateway handles a request, some information about that request is stored in the session data of the user. This document describes the various flows within Stepup, in what parts of the code the flows are implemented and what the implementation stores and reads from the user session.

Gateway login flow

Gateway SFO flow

Gateway GSSP verification flow

This flow happens when a user is asked to verify his second factor token, the service provider in this diagram can be any (external) service provider, or SelfService when the "Test a token" button is used.

Gateway GSSP registration flow

This flow happens when users register their token in SelfService and when this token is verified in RA. So the service provider in this diagram is always SelfService or RA.