{
  "schema_version": 1,
  "diagram_type": "architecture",
  "meta": {
    "title": "SGJ · WLAN und Microsoft-365-Freigabe",
    "quality_profile": "showcase",
    "viewBox": [
      1390,
      810
    ]
  },
  "components": [
    {
      "id": "wlan-client",
      "type": "frontend",
      "label": "WLAN-Gerät",
      "sublabel": "SSID SGJ · offen",
      "pos": [
        70,
        160
      ],
      "size": [
        220,
        72
      ]
    },
    {
      "id": "aruba-access",
      "type": "security",
      "label": "Aruba Instant",
      "sublabel": "VC 10.128.16.2 · .204",
      "pos": [
        70,
        380
      ],
      "size": [
        220,
        72
      ]
    },
    {
      "id": "sgj-uplinks",
      "type": "backend",
      "label": "DV2 / DV3 → Core",
      "sublabel": "lag1 · Native-VLAN 999",
      "pos": [
        70,
        620
      ],
      "size": [
        220,
        72
      ]
    },
    {
      "id": "udm-dhcp",
      "type": "security",
      "label": "UniFi UDM Pro",
      "sublabel": "VLAN 999 · DHCP / DNS",
      "pos": [
        400,
        620
      ],
      "size": [
        240,
        72
      ]
    },
    {
      "id": "onboarding-portal",
      "type": "backend",
      "label": "Onboarding-Portal",
      "sublabel": "CT128 · 10.222.40.52",
      "pos": [
        740,
        160
      ],
      "size": [
        240,
        72
      ]
    },
    {
      "id": "radius-service",
      "type": "security",
      "label": "RadiusDesk / RADIUS",
      "sublabel": "VM601 · 10.222.40.36",
      "pos": [
        740,
        380
      ],
      "size": [
        240,
        72
      ]
    },
    {
      "id": "m365-identity",
      "type": "external",
      "label": "Microsoft Entra ID",
      "sublabel": "SGJ-Tenant · Gruppen / MAC",
      "pos": [
        1120,
        160
      ],
      "size": [
        220,
        72
      ]
    }
  ],
  "boundaries": [
    {
      "kind": "region",
      "label": "Sportgymnasium Jena",
      "wraps": [
        "wlan-client",
        "aruba-access",
        "sgj-uplinks",
        "udm-dhcp"
      ],
      "pad": 35
    },
    {
      "kind": "region",
      "label": "Gemeinsame Lanstyle-Plattform",
      "wraps": [
        "onboarding-portal",
        "radius-service"
      ],
      "pad": 35
    },
    {
      "kind": "region",
      "label": "Microsoft 365",
      "wraps": [
        "m365-identity"
      ],
      "pad": 25
    }
  ],
  "connections": [
    {
      "id": "client-association",
      "from": "wlan-client",
      "to": "aruba-access",
      "label": "WLAN verbinden",
      "variant": "emphasis",
      "labelDy": 70
    },
    {
      "id": "vlan-transport",
      "from": "aruba-access",
      "to": "sgj-uplinks",
      "label": "VLAN-Transport",
      "labelDy": 70
    },
    {
      "id": "dhcp-network",
      "from": "sgj-uplinks",
      "to": "udm-dhcp",
      "label": "DHCP / Gateway"
    },
    {
      "id": "portal-registration",
      "from": "wlan-client",
      "to": "onboarding-portal",
      "label": "HTTPS · Registrierung",
      "variant": "emphasis"
    },
    {
      "id": "m365-login",
      "from": "onboarding-portal",
      "to": "m365-identity",
      "label": "M365-Anmeldung"
    },
    {
      "id": "radius-sync",
      "from": "onboarding-portal",
      "to": "radius-service",
      "label": "MAC / Profil sync",
      "labelDy": 70
    },
    {
      "id": "radius-auth",
      "from": "aruba-access",
      "to": "radius-service",
      "label": "MAC-PAP · RadSec :2083",
      "variant": "security"
    }
  ],
  "cards": [
    {
      "dot": "cyan",
      "title": "Netz und Management",
      "items": [
        "Start: VLAN 999 · 10.128.255.0/24 · Gateway .1",
        "AP-Verwaltung: VLAN 16; Switch-Verwaltung: VLAN 8",
        "RADIUS liefert Profil / VLAN; DHCP folgt der Zuweisung."
      ]
    },
    {
      "dot": "emerald",
      "title": "Stand 16.09.2026",
      "items": [
        "M365 speichert Geräte-MAC in extensionAttribute15.",
        "Gezielte Neuanmeldung: VLAN 10 und DHCP bestätigt.",
        "Benutzertest erfolgreich; weitere Rollen separat prüfen."
      ]
    },
    {
      "dot": "amber",
      "title": "CoA und Rückweg",
      "items": [
        "Portal .52 → Aruba: UDP 3799; Disconnect-ACK bestätigt.",
        "Automatischer Portal-CoA nach Reparatur noch nicht E2E geprüft.",
        "Prestate / Rückweg: zugehörige Changes und Runbook im Repository."
      ]
    }
  ]
}