When gateway handles a request, some information about that request is stored in the session data of the user. This document describes the various flows within Stepup, in what parts of the code the flows are implemented and what the implementation stores and reads from the user session.
This flow happens when a user is asked to verify his second factor token, the service provider in this diagram can be any (external) service provider, or SelfService when the "Test a token" button is used.
This flow happens when users register their token in SelfService and when this token is verified in RA. So the service provider in this diagram is always SelfService or RA.
