Feature Description
Add a plugin for the Token Broker
This feature introduces a generic mechanism for obtaining tokens outside of the Keycloak Token Exchange flow.
Once added, it provides three route types:
-
Passthrough — The agent supplies a token, and AuthBridge forwards it unchanged.
-
Token Exchange — The agent forwards an inbound token. AuthBridge exchanges it through Keycloak to obtain a new token from the same IdP but with a different audience.
Typical use case: MCP Gateway requiring a token with a modified audience.
-
Token Broker — The agent forwards an inbound token. AuthBridge obtains a new token from a third‑party IdP using a Kagenti TokenBroker.
Typical use case: Human‑in‑the‑loop OAuth flow where a user authenticates with a third‑party IdP to allow the agent to access external resources.
Proposed Solution
Token broker aligns with current plugin system
Want to contribute?
Additional Context
rossoctl/rossoctl#1435
Feature Description
Add a plugin for the Token Broker
This feature introduces a generic mechanism for obtaining tokens outside of the Keycloak Token Exchange flow.
Once added, it provides three route types:
Passthrough — The agent supplies a token, and AuthBridge forwards it unchanged.
Token Exchange — The agent forwards an inbound token. AuthBridge exchanges it through Keycloak to obtain a new token from the same IdP but with a different audience.
Typical use case: MCP Gateway requiring a token with a modified audience.
Token Broker — The agent forwards an inbound token. AuthBridge obtains a new token from a third‑party IdP using a Kagenti TokenBroker.
Typical use case: Human‑in‑the‑loop OAuth flow where a user authenticates with a third‑party IdP to allow the agent to access external resources.
Proposed Solution
Token broker aligns with current plugin system
Want to contribute?
Additional Context
rossoctl/rossoctl#1435