blockdiag {
   span_width = 30
   User <-> Apache;
   Proxy <-> AAA;
   group {
   Apache <-> Proxy;
   group {
       orientation = portrait
       Apache <-> SSSD;
   }
   }
   User [numbered = 1, shape = actor, width = 60]
   Apache [numbered = 2, label = "Apache\nAuthenticates user"]
   SSSD [numbered = 3, label = "SSSD\nProvides user info"]
   Proxy [numbered = 4, label = "Proxy Transport\nRequest + Metadata"]
   AAA [numbered = 5, label = "App Server\nAAA"]
}