adaptive-shield-matrix · October 14, 2021 09:12 · Nov 10, 2020 · Nov 10, 2020 · Apr 26, 2019 · Apr 26, 2019
diff --git a/gistfile1.txt → readme.md b/gistfile1.txt → readme.md
diff --git a/1. basic flow with auth code and access token b/1. basic flow with auth code and access token
@@ -1,15 +1,27 @@
-@startuml
-skinparam handwritten true
-"You/Browser" -> slack.com: 1. I would like to access my files on Google Drive via your interface.
-slack.com -> "You/Browser": 2. You should apply the "Authorization Code" from Google for me first.
-"You/Browser" -> account.google.com: 3. I would like to permit slack.com to access my files.
-account.google.com -> "You/Browser": 4. Are you sure?
-"You/Browser" -> account.google.com: 5. [Y]
-account.google.com -> "You/Browser": 6. Okay. Here is the "Authorization Code." Plz give it back to slack.com now.
-"You/Browser" -> slack.com: 7. You can do what I asked now (with the Authorization Code which is just received from Google.) 
-slack.com -> account.google.com: 8. I would like to exchange the "Authorization Code" for the "Access Token."
-account.google.com -> slack.com: 9. Your Access Token here. 
-slack.com -> drive.google.com: 10. I would like to read files which belong to one of my customers. Here is the Access Token.
-drive.google.com -> slack.com: 11. Hmmm...the Access Token is vaild. Here is list of files you asked.
-slack.com -> "You/Browser": 12. Grant succeed. You can see your files stored in Google Drive from my interface now!
-@enduml
+@startuml OAuth basic flow with auth code and access token
+skinparam monochrome true
+skinparam defaultFontSize 14
+' plantuml: https://plantuml.com/sequence-diagram
+' source: https://gist.github.com/hrchu/d88efb56e72534a1233d16f36eb3e3e9
+
+title OAuth basic flow with auth code and access token
+
+actor "You/Browser" as b
+participant "slack.com" as s
+participant "account.google.com" as a
+participant "drive.google.com" as d
+
+b -> s: 1. I would like to access my files on Google Drive via your interface.
+s -> b: 2. You should apply the "Authorization Code" from Google for me first.
+b -> a: 3. I would like to permit slack.com to access my files.
+a -> b: 4. Are you sure?
+b -> a: 5. [Y]
+a -> b: 6. Okay. Here is the "Authorization Code." Plz give it back to slack.com now.
+b -> s: 7. You can do what I asked now \n(with the Authorization Code which is just received from Google.)
+s -> a: 8. I would like to exchange the "Authorization Code" for the "Access Token."
+a -> s: 9. Your Access Token here.
+s -> d: 10. I would like to read files which belong to one of my customers. Here is the Access Token.
+d -> s: 11. Hmmm...the Access Token is vaild. Here is list of files you asked.
+s -> b: 12. Grant succeed. You can see your files stored in Google Drive!
+
+@enduml
diff --git a/2. introduce roles b/2. introduce roles
@@ -1,15 +1,27 @@
-@startuml
-skinparam handwritten true
-"ResourceOwner/User-Agent" -> Client: 1. I would like to access my resources on Resource Server via your interface.
-Client -> "ResourceOwner/User-Agent": 2. You should apply the "Authorization Code" from Authorization Server for me first.
-"ResourceOwner/User-Agent" -> AuthorizationServer: 3. I would like to permit the Client to access my resources.
-AuthorizationServer -> "ResourceOwner/User-Agent": 4. Are you sure?
-"ResourceOwner/User-Agent" -> AuthorizationServer: 5. [Y]
-AuthorizationServer -> "ResourceOwner/User-Agent": 6. Okay. Here is the "Authorization Code." Plz give it back to Client now.
-"ResourceOwner/User-Agent" -> Client: 7. You can do what I asked now. (With the Authorization Code which is just received from the Authorization Server) 
-Client -> AuthorizationServer: 8. I would like to exchange the "Authorization Code" for the "Access Token."
-AuthorizationServer -> Client: 9. Your Access Token here. 
-Client -> ResourceServer: 10. I would like to access resources which belong to the Resource Owner. Here is the Access Token.
-ResourceServer -> Client: 11. Hmmm...the Access Token is vaild. Here are resources you asked.
-Client -> "ResourceOwner/User-Agent": 12. Grant succeed. You can access your resources located in Resource Server from me now!
-@enduml
+@startuml OAuth introduce roles
+skinparam monochrome true
+skinparam defaultFontSize 14
+' plantuml: https://plantuml.com/sequence-diagram
+' source: https://gist.github.com/hrchu/d88efb56e72534a1233d16f36eb3e3e9
+
+title OAuth introduce roles
+
+actor "ResourceOwner/User-Agent" as r
+participant Client as c
+participant AuthorizationServer as a
+participant ResourceServer as s
+
+r -> c: 1. I would like to access my resources on Resource Server via your interface.
+c -> r: 2. You should apply the "Authorization Code" from Authorization Server for me first.
+r -> a: 3. I would like to permit the Client to access my resources.
+a -> r: 4. Are you sure?
+r -> a: 5. [Y]
+a -> r: 6. Okay. Here is the "Authorization Code." Plz give it back to Client now.
+r -> c: 7. You can do what I asked now. (With the Authorization Code which is just received from the Authorization Server)
+c -> a: 8. I would like to exchange the "Authorization Code" for the "Access Token."
+a -> c: 9. Your Access Token here.
+c -> s: 10. I would like to access resources which belong to the Resource Owner. Here is the Access Token.
+s -> c: 11. Hmmm...the Access Token is vaild. Here are resources you asked.
+c -> r: 12. Grant succeed. You can access your resources located in Resource Server from me now!
+
+@enduml
diff --git a/3. introduce protocol messages b/3. introduce protocol messages
@@ -1,15 +1,27 @@
-@startuml
-skinparam handwritten true
-"ResourceOwner/User-Agent" -> Client: 1. (Start the procedure by calling the client specific request.)
-Client -> "ResourceOwner/User-Agent": 2. HTTP 302: Redirect to the "Authorization Code Request" URL with parameters:\n scope=[specific_scope]&redirect_uri=[client_callback]&client_id=[client_id]&response_type=code&state=foobar
-"ResourceOwner/User-Agent" -> AuthorizationServer: 3. Call "Authorization Request" URL with parameters listed above.
-AuthorizationServer -> "ResourceOwner/User-Agent": 4. Whould you like to permit [specific_scope] for [client]?
-"ResourceOwner/User-Agent" -> AuthorizationServer: 5. [Y]
-AuthorizationServer -> "ResourceOwner/User-Agent": 6. HTTP 302: Redirect to the [client_callback] URL with parameters: code=[authorization_code]&state=foobar
-"ResourceOwner/User-Agent" -> Client: 7. Call [client_callback] URL with parameters listed above.
-Client -> AuthorizationServer: 8. Call "Access Token Request" URL with parameters:\n code=[authorization_code]&client_id=[client_id]&client_secret=[client_secret]&grant_type=authorization_code
-AuthorizationServer -> Client: 9. HTTP 200 with the [access_token]
-Client -> ResourceServer: 10. Call rsource specific API with the header: {Authorization: Bearer [access_token]}
-ResourceServer -> Client: 11. HTTP 200 with protected resources
-Client -> "ResourceOwner/User-Agent": 12. (Show grant succeed and protected resources.)
-@enduml
+@startuml OAuth introduce protocol messages
+skinparam monochrome true
+skinparam defaultFontSize 14
+' plantuml: https://plantuml.com/sequence-diagram
+' source: https://gist.github.com/hrchu/d88efb56e72534a1233d16f36eb3e3e9
+
+title OAuth introduce protocol messages
+
+actor "ResourceOwner/User-Agent" as r
+participant Client as c
+participant AuthorizationServer as a
+participant ResourceServer as s
+
+r -> c: 1. (Start the procedure by calling the client specific request.)
+c -> r: 2. HTTP 302: Redirect to the "Authorization Code Request"\n scope=[specific_scope]&redirect_uri=[client_callback]\n&client_id=[client_id]&response_type=code&state=foobar
+r -> a: 3. Call "Authorization Request" URL with parameters listed above.
+a -> r: 4. Whould you like to permit [specific_scope] for [client]?
+r -> a: 5. [Y]
+a -> r: 6. HTTP 302: Redirect to the [client_callback] URL with parameters: code=[authorization_code]&state=foobar
+r -> c: 7. Call [client_callback] URL with parameters listed above.
+c -> a: 8. Call "Access Token Request" URL with parameters:\n code=[authorization_code]&client_id=[client_id]\n&client_secret=[client_secret]&grant_type=authorization_code
+a -> c: 9. HTTP 200 with the [access_token]
+c -> s: 10. Call resource specific API with the header: {Authorization: Bearer [access_token]}
+s -> c: 11. HTTP 200 with protected resources
+c -> r: 12. (Show grant succeed and protected resources.)
+
+@enduml
diff --git a/4. introduce openid connect b/4. introduce openid connect
@@ -1,15 +1,26 @@
-@startuml
-skinparam handwritten true
-"ResourceOwner/User-Agent" -> Client: 1. (Start the procedure by calling the client specific request.)
-Client -> "ResourceOwner/User-Agent": 2. HTTP 302: Redirect to the "Authorization Code Request" URL with parameters:\n scope="profile <color:red>openid</color>"&redirect_uri=[client_callback]&client_id=[client_id]&response_type=code&state=foobar
-"ResourceOwner/User-Agent" -> AuthorizationServer: 3. Call "Authorization Request" URL with parameters listed above.
-AuthorizationServer -> "ResourceOwner/User-Agent": 4. Whould you like to permit "<color:red>openid</color>, profile" for [client]?
-"ResourceOwner/User-Agent" -> AuthorizationServer: 5. [Y]
-AuthorizationServer -> "ResourceOwner/User-Agent": 6. HTTP 302: Redirect to the [client_callback] URL with parameters: code=[authorization_code]&state=foobar
-"ResourceOwner/User-Agent" -> Client: 7. Call [client_callback] URL with parameters listed above.
-Client -> AuthorizationServer: 8. Call <color:red>"Access Token / ID Token Request"</color> URL with parameters:\n code=[authorization_code]&client_id=[client_id]&client_secret=[client_secret]&grant_type=authorization_code
-AuthorizationServer -> Client: 9. HTTP 200 with the [access_token, <color:red>id_token</color>]
-Client -> ResourceServer: <color:red>10. Call userInfo endpoint with the header: {Authorization: Bearer [access_token]}
-ResourceServer -> Client: <color:red>11. HTTP 200 with more detailed user information.
-Client -> "ResourceOwner/User-Agent": <color:red>12. (Login succeed.)
-@enduml
+@startuml OAuth introduce openid connect
+skinparam monochrome true
+skinparam defaultFontSize 14
+' plantuml: https://plantuml.com/sequence-diagram
+' source: https://gist.github.com/hrchu/d88efb56e72534a1233d16f36eb3e3e9
+
+title OAuth introduce openid connect
+
+actor "ResourceOwner/User-Agent" as r
+participant AuthorizationServer as a
+participant Client as c
+participant ResourceServer as s
+
+r -> c: 1. (Start the procedure by calling the client specific request.)
+c -> r: 2. HTTP 302: Redirect to the "Authorization Code Request" URL with parameters:\n scope="profile <color:red>openid</color>"&redirect_uri=[client_callback]&client_id=[client_id]&response_type=code&state=foobar
+r -> a: 3. Call "Authorization Request" URL with parameters listed above.
+a -> r: 4. Whould you like to permit "<color:red>openid</color>, profile" for [client]?
+r -> a: 5. [Y]
+a -> r: 6. HTTP 302: Redirect to the [client_callback] URL with parameters: code=[authorization_code]&state=foobar
+r -> c: 7. Call [client_callback] URL with parameters listed above.
+c -> a: 8. Call <color:red>"Access Token / ID Token Request"</color> URL with parameters:\n code=[authorization_code]&client_id=[client_id]&client_secret=[client_secret]&grant_type=authorization_code
+a -> c: 9. HTTP 200 with the [access_token, <color:red>id_token</color>]
+c -> s: <color:red>10. Call userInfo endpoint with the header: {Authorization: Bearer [access_token]}
+s -> c: <color:red>11. HTTP 200 with more detailed user information.
+c -> r: <color:red>12. (Login succeed.)
+@enduml
diff --git a/gistfile1.txt b/gistfile1.txt
@@ -0,0 +1,4 @@
+Pro Tip
+
+- use vscode (IDE): https://code.visualstudio.com/
+- install vscode plantuml plugin: https://github.com/qjebbs/vscode-plantuml
diff --git a/4. introduce openid connect b/4. introduce openid connect
@@ -9,7 +9,7 @@ AuthorizationServer -> "ResourceOwner/User-Agent": 6. HTTP 302: Redirect to the
 "ResourceOwner/User-Agent" -> Client: 7. Call [client_callback] URL with parameters listed above.
 Client -> AuthorizationServer: 8. Call <color:red>"Access Token / ID Token Request"</color> URL with parameters:\n code=[authorization_code]&client_id=[client_id]&client_secret=[client_secret]&grant_type=authorization_code
 AuthorizationServer -> Client: 9. HTTP 200 with the [access_token, <color:red>id_token</color>]
-Client -> ResourceServer: 10. Call rsource specific API with the header: {Authorization: Bearer [access_token]}
-ResourceServer -> Client: 11. HTTP 200 with protected resources
-Client -> "ResourceOwner/User-Agent": 12. (Show grant succeed and protected resources.)
+Client -> ResourceServer: <color:red>10. Call userInfo endpoint with the header: {Authorization: Bearer [access_token]}
+ResourceServer -> Client: <color:red>11. HTTP 200 with more detailed user information.
+Client -> "ResourceOwner/User-Agent": <color:red>12. (Login succeed.)
 @enduml
diff --git a/4. introduce openid connect b/4. introduce openid connect
@@ -0,0 +1,15 @@
+@startuml
+skinparam handwritten true
+"ResourceOwner/User-Agent" -> Client: 1. (Start the procedure by calling the client specific request.)
+Client -> "ResourceOwner/User-Agent": 2. HTTP 302: Redirect to the "Authorization Code Request" URL with parameters:\n scope="profile <color:red>openid</color>"&redirect_uri=[client_callback]&client_id=[client_id]&response_type=code&state=foobar
+"ResourceOwner/User-Agent" -> AuthorizationServer: 3. Call "Authorization Request" URL with parameters listed above.
+AuthorizationServer -> "ResourceOwner/User-Agent": 4. Whould you like to permit "<color:red>openid</color>, profile" for [client]?
+"ResourceOwner/User-Agent" -> AuthorizationServer: 5. [Y]
+AuthorizationServer -> "ResourceOwner/User-Agent": 6. HTTP 302: Redirect to the [client_callback] URL with parameters: code=[authorization_code]&state=foobar
+"ResourceOwner/User-Agent" -> Client: 7. Call [client_callback] URL with parameters listed above.
+Client -> AuthorizationServer: 8. Call <color:red>"Access Token / ID Token Request"</color> URL with parameters:\n code=[authorization_code]&client_id=[client_id]&client_secret=[client_secret]&grant_type=authorization_code
+AuthorizationServer -> Client: 9. HTTP 200 with the [access_token, <color:red>id_token</color>]
+Client -> ResourceServer: 10. Call rsource specific API with the header: {Authorization: Bearer [access_token]}
+ResourceServer -> Client: 11. HTTP 200 with protected resources
+Client -> "ResourceOwner/User-Agent": 12. (Show grant succeed and protected resources.)
+@enduml
diff --git a/Basic flow with auth code and access token → ...asic flow with auth code and access token b/Basic flow with auth code and access token → ...asic flow with auth code and access token
diff --git a/introduce roles → 2. introduce roles b/introduce roles → 2. introduce roles
diff --git a/introduce protocol messages → 3. introduce protocol messages b/introduce protocol messages → 3. introduce protocol messages
diff --git a/v1 → Basic flow with auth code and access token b/v1 → Basic flow with auth code and access token
diff --git a/v3 → introduce protocol messages b/v3 → introduce protocol messages
diff --git a/v2 → introduce roles b/v2 → introduce roles
diff --git a/v1 b/v1
@@ -1,15 +1,15 @@
 @startuml
 skinparam handwritten true
-You -> slack.com: 1. I would like to access my files on Google Drive via your interface.
-slack.com -> You: 2. You should apply the "Authorization Code" from Google for me first.
-You -> account.google.com: 3. I would like to permit slack.com to access my files.
-account.google.com -> You: 4. Are you sure?
-You -> account.google.com: 5. [Y]
-account.google.com -> You: 6. Okay. Here is the "Authorization Code." Plz give it back to slack.com now.
-You -> slack.com: 7. You can do what I asked now. (With the Authorization Code which is just received from Google) 
+"You/Browser" -> slack.com: 1. I would like to access my files on Google Drive via your interface.
+slack.com -> "You/Browser": 2. You should apply the "Authorization Code" from Google for me first.
+"You/Browser" -> account.google.com: 3. I would like to permit slack.com to access my files.
+account.google.com -> "You/Browser": 4. Are you sure?
+"You/Browser" -> account.google.com: 5. [Y]
+account.google.com -> "You/Browser": 6. Okay. Here is the "Authorization Code." Plz give it back to slack.com now.
+"You/Browser" -> slack.com: 7. You can do what I asked now (with the Authorization Code which is just received from Google.) 
 slack.com -> account.google.com: 8. I would like to exchange the "Authorization Code" for the "Access Token."
 account.google.com -> slack.com: 9. Your Access Token here. 
 slack.com -> drive.google.com: 10. I would like to read files which belong to one of my customers. Here is the Access Token.
 drive.google.com -> slack.com: 11. Hmmm...the Access Token is vaild. Here is list of files you asked.
-slack.com -> You: 12. Grant succeed. You can see your files stored in Google Drive from my interface now!
+slack.com -> "You/Browser": 12. Grant succeed. You can see your files stored in Google Drive from my interface now!
 @enduml
diff --git a/v2 b/v2
@@ -1,15 +1,15 @@
 @startuml
 skinparam handwritten true
-ResourceOwner -> Client: 1. I would like to access my resources on Resource Server via your interface.
-Client -> ResourceOwner: 2. You should apply the "Authorization Code" from Authorization Server for me first.
-ResourceOwner -> AuthorizationServer: 3. I would like to permit the Client to access my resources.
-AuthorizationServer -> ResourceOwner: 4. Are you sure?
-ResourceOwner -> AuthorizationServer: 5. [Y]
-AuthorizationServer -> ResourceOwner: 6. Okay. Here is the "Authorization Code." Plz give it back to Client now.
-ResourceOwner -> Client: 7. You can do what I asked now. (With the Authorization Code which is just received from the Authorization Server) 
+"ResourceOwner/User-Agent" -> Client: 1. I would like to access my resources on Resource Server via your interface.
+Client -> "ResourceOwner/User-Agent": 2. You should apply the "Authorization Code" from Authorization Server for me first.
+"ResourceOwner/User-Agent" -> AuthorizationServer: 3. I would like to permit the Client to access my resources.
+AuthorizationServer -> "ResourceOwner/User-Agent": 4. Are you sure?
+"ResourceOwner/User-Agent" -> AuthorizationServer: 5. [Y]
+AuthorizationServer -> "ResourceOwner/User-Agent": 6. Okay. Here is the "Authorization Code." Plz give it back to Client now.
+"ResourceOwner/User-Agent" -> Client: 7. You can do what I asked now. (With the Authorization Code which is just received from the Authorization Server) 
 Client -> AuthorizationServer: 8. I would like to exchange the "Authorization Code" for the "Access Token."
 AuthorizationServer -> Client: 9. Your Access Token here. 
 Client -> ResourceServer: 10. I would like to access resources which belong to the Resource Owner. Here is the Access Token.
 ResourceServer -> Client: 11. Hmmm...the Access Token is vaild. Here are resources you asked.
-Client -> ResourceOwner: 12. Grant succeed. You can access your resources located in Resource Server from me now!
+Client -> "ResourceOwner/User-Agent": 12. Grant succeed. You can access your resources located in Resource Server from me now!
 @enduml
diff --git a/v3 b/v3
@@ -1,22 +1,15 @@
 @startuml
 skinparam handwritten true
-ResourceOwner -> Client: 1. (Click the botton.)
-Client -> ResourceOwner: 2. HTTP 302: Redirect to the "Get Authorization Code" API with parameters: scope=[Asked scope]&redirect_uri=[Client's callback] 
-ResourceOwner -> AuthorizationServer: 3. Call Get Authorization Code API with parameters listed above.
-AuthorizationServer -> ResourceOwner: 4. Whould you like to permit [Asked scope] for [Client]?
-ResourceOwner -> AuthorizationServer: 5. [Y]
-AuthorizationServer -> ResourceOwner: 6. HTTP 302: Redirect to the [Client's callback URL] with parameters: code=[Authorization Code]
-ResourceOwner -> Client: 7. Request [Client's callback URL] with parameters listed above.
-
-Client -> AuthorizationServer: 8. I would like to exchange the "Authorization Code" for the "Access Token."
-Call "POST Access Token" API with parameters: 
-code=[Authorization Code]&
-client_id=your_client_id&
-client_secret=your_client_secret&
-redirect_uri=https://oauth2.example.com/code&
-grant_type=authorization_code
-AuthorizationServer -> Client: 9. Your Access Token here. 
-Client -> ResourceServer: 10. I would like to access resources which belong to the Resource Owner. Here is the Access Token.
-ResourceServer -> Client: 11. The Access Token LGTM. Now you can access files.
-Client -> ResourceOwner: 12. Grant succeed. You can access your resources located in Resource Server from me now!
+"ResourceOwner/User-Agent" -> Client: 1. (Start the procedure by calling the client specific request.)
+Client -> "ResourceOwner/User-Agent": 2. HTTP 302: Redirect to the "Authorization Code Request" URL with parameters:\n scope=[specific_scope]&redirect_uri=[client_callback]&client_id=[client_id]&response_type=code&state=foobar
+"ResourceOwner/User-Agent" -> AuthorizationServer: 3. Call "Authorization Request" URL with parameters listed above.
+AuthorizationServer -> "ResourceOwner/User-Agent": 4. Whould you like to permit [specific_scope] for [client]?
+"ResourceOwner/User-Agent" -> AuthorizationServer: 5. [Y]
+AuthorizationServer -> "ResourceOwner/User-Agent": 6. HTTP 302: Redirect to the [client_callback] URL with parameters: code=[authorization_code]&state=foobar
+"ResourceOwner/User-Agent" -> Client: 7. Call [client_callback] URL with parameters listed above.
+Client -> AuthorizationServer: 8. Call "Access Token Request" URL with parameters:\n code=[authorization_code]&client_id=[client_id]&client_secret=[client_secret]&grant_type=authorization_code
+AuthorizationServer -> Client: 9. HTTP 200 with the [access_token]
+Client -> ResourceServer: 10. Call rsource specific API with the header: {Authorization: Bearer [access_token]}
+ResourceServer -> Client: 11. HTTP 200 with protected resources
+Client -> "ResourceOwner/User-Agent": 12. (Show grant succeed and protected resources.)
 @enduml
diff --git a/v3 b/v3
@@ -0,0 +1,22 @@
+@startuml
+skinparam handwritten true
+ResourceOwner -> Client: 1. (Click the botton.)
+Client -> ResourceOwner: 2. HTTP 302: Redirect to the "Get Authorization Code" API with parameters: scope=[Asked scope]&redirect_uri=[Client's callback] 
+ResourceOwner -> AuthorizationServer: 3. Call Get Authorization Code API with parameters listed above.
+AuthorizationServer -> ResourceOwner: 4. Whould you like to permit [Asked scope] for [Client]?
+ResourceOwner -> AuthorizationServer: 5. [Y]
+AuthorizationServer -> ResourceOwner: 6. HTTP 302: Redirect to the [Client's callback URL] with parameters: code=[Authorization Code]
+ResourceOwner -> Client: 7. Request [Client's callback URL] with parameters listed above.
+
+Client -> AuthorizationServer: 8. I would like to exchange the "Authorization Code" for the "Access Token."
+Call "POST Access Token" API with parameters: 
+code=[Authorization Code]&
+client_id=your_client_id&
+client_secret=your_client_secret&
+redirect_uri=https://oauth2.example.com/code&
+grant_type=authorization_code
+AuthorizationServer -> Client: 9. Your Access Token here. 
+Client -> ResourceServer: 10. I would like to access resources which belong to the Resource Owner. Here is the Access Token.
+ResourceServer -> Client: 11. The Access Token LGTM. Now you can access files.
+Client -> ResourceOwner: 12. Grant succeed. You can access your resources located in Resource Server from me now!
+@enduml
diff --git a/v1 b/v1
@@ -10,6 +10,6 @@ You -> slack.com: 7. You can do what I asked now. (With the Authorization Code w
 slack.com -> account.google.com: 8. I would like to exchange the "Authorization Code" for the "Access Token."
 account.google.com -> slack.com: 9. Your Access Token here. 
 slack.com -> drive.google.com: 10. I would like to read files which belong to one of my customers. Here is the Access Token.
-drive.google.com -> slack.com: 11. The Access Token LGTM. Now you can access files.
+drive.google.com -> slack.com: 11. Hmmm...the Access Token is vaild. Here is list of files you asked.
 slack.com -> You: 12. Grant succeed. You can see your files stored in Google Drive from my interface now!
 @enduml
diff --git a/v2 b/v2
@@ -10,6 +10,6 @@ ResourceOwner -> Client: 7. You can do what I asked now. (With the Authorization
 Client -> AuthorizationServer: 8. I would like to exchange the "Authorization Code" for the "Access Token."
 AuthorizationServer -> Client: 9. Your Access Token here. 
 Client -> ResourceServer: 10. I would like to access resources which belong to the Resource Owner. Here is the Access Token.
-ResourceServer -> Client: 11. The Access Token LGTM. Now you can access files.
+ResourceServer -> Client: 11. Hmmm...the Access Token is vaild. Here are resources you asked.
 Client -> ResourceOwner: 12. Grant succeed. You can access your resources located in Resource Server from me now!
 @enduml
diff --git a/v1 b/v1
@@ -0,0 +1,15 @@
+@startuml
+skinparam handwritten true
+You -> slack.com: 1. I would like to access my files on Google Drive via your interface.
+slack.com -> You: 2. You should apply the "Authorization Code" from Google for me first.
+You -> account.google.com: 3. I would like to permit slack.com to access my files.
+account.google.com -> You: 4. Are you sure?
+You -> account.google.com: 5. [Y]
+account.google.com -> You: 6. Okay. Here is the "Authorization Code." Plz give it back to slack.com now.
+You -> slack.com: 7. You can do what I asked now. (With the Authorization Code which is just received from Google) 
+slack.com -> account.google.com: 8. I would like to exchange the "Authorization Code" for the "Access Token."
+account.google.com -> slack.com: 9. Your Access Token here. 
+slack.com -> drive.google.com: 10. I would like to read files which belong to one of my customers. Here is the Access Token.
+drive.google.com -> slack.com: 11. The Access Token LGTM. Now you can access files.
+slack.com -> You: 12. Grant succeed. You can see your files stored in Google Drive from my interface now!
+@enduml
diff --git a/v2 b/v2
@@ -0,0 +1,15 @@
+@startuml
+skinparam handwritten true
+ResourceOwner -> Client: 1. I would like to access my resources on Resource Server via your interface.
+Client -> ResourceOwner: 2. You should apply the "Authorization Code" from Authorization Server for me first.
+ResourceOwner -> AuthorizationServer: 3. I would like to permit the Client to access my resources.
+AuthorizationServer -> ResourceOwner: 4. Are you sure?
+ResourceOwner -> AuthorizationServer: 5. [Y]
+AuthorizationServer -> ResourceOwner: 6. Okay. Here is the "Authorization Code." Plz give it back to Client now.
+ResourceOwner -> Client: 7. You can do what I asked now. (With the Authorization Code which is just received from the Authorization Server) 
+Client -> AuthorizationServer: 8. I would like to exchange the "Authorization Code" for the "Access Token."
+AuthorizationServer -> Client: 9. Your Access Token here. 
+Client -> ResourceServer: 10. I would like to access resources which belong to the Resource Owner. Here is the Access Token.
+ResourceServer -> Client: 11. The Access Token LGTM. Now you can access files.
+Client -> ResourceOwner: 12. Grant succeed. You can access your resources located in Resource Server from me now!
+@enduml