Skip to content

Commit 235531a

Browse files
IsaacEldridgeIsaacEldridge
authored
Merge pull request #576 from mulesoft/W-21164648-add-OAuth-OBO-and-In-Task-authentication-types-ie
W-21164648 add OAuth OBO and In-Task authentication types
2 parents 8198c2b + 95aca70 commit 235531a

1 file changed

Lines changed: 151 additions & 3 deletions

File tree

‎modules/ROOT/pages/af-project-files.adoc‎

Lines changed: 151 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -779,7 +779,7 @@ The `connections` element has these properties.
779779
|`spec` |Connection specification. Properties vary by connection kind. |Object |Object with spec properties (See <<spec-section,Spec>>) |Yes
780780
|`spec.url` |The URL for the connection endpoint. |String |Valid URL string |Yes (for agent and llm), No (for mcp)
781781
|`spec.authentication` |Authentication configuration for the connection. |Object |Authentication object (See <<authentication-types,Authentication types>>) |No
782-
|`spec.authentication.kind` |The type of authentication. |String |`basic`, `oauth2-client-credentials`, `apikey-client-credentials`, `apiKey` |Yes (when authentication is specified)
782+
|`spec.authentication.kind` |The type of authentication. |String |`basic`, `oauth2-client-credentials`, `apikey-client-credentials`, `apiKey`, `in-task-authorization-code`, and `oauth2-obo` |Yes (when authentication is specified)
783783
|`spec.authentication.username` |The username for basic authentication. |String |Any string value |Yes (for basic auth)
784784
|`spec.authentication.password` |The password for basic authentication. |String |Any string value |Yes (for basic auth)
785785
|`spec.authentication.headerName` |The name of the header in which to set the key. If not specified, 'Authorization' is set by default. |String |Any string value |No
@@ -864,7 +864,7 @@ Both agents and MCP servers support the same authentication types with custom he
864864
[source,yaml]
865865
----
866866
authentication:
867-
Kind: basic
867+
kind: basic
868868
username: "username"
869869
password: "password"
870870
----
@@ -879,6 +879,18 @@ kind: basic
879879
headerName: X-API-Authorization # Custom header instead of default "Authorization"
880880
----
881881

882+
The `basic` authentication has these properties.
883+
884+
[cols="1,2,1,2,1",options="header"]
885+
|===
886+
|Parameter |Description |Type |Valid Values |Required
887+
888+
|`kind` |Authentication type. |String |`basic` |Yes
889+
|`username` |The username for authentication. |String |Any string |Yes
890+
|`password` |The password for authentication. |String |Any string |Yes
891+
|`headerName` |The name of the header in which to set the credentials. If not specified, `Authorization` is used. |String |Any string |No
892+
|===
893+
882894
[[oauth-client-credentials]]
883895
==== OAuth 2.0 Client Credentials
884896

@@ -888,10 +900,29 @@ authentication:
888900
kind: oauth2-client-credentials
889901
clientId: "client_id"
890902
clientSecret: "client_secret"
891-
tokenUrl: "https://oauth.provider.com/token"
903+
token:
904+
url: "https://oauth.provider.com/token"
905+
bodyEncoding: form
906+
timeout: 300
892907
scopes: ["read", "write"] # Optional
893908
----
894909

910+
The `oauth2-client-credentials` authentication has these properties.
911+
912+
[cols="1,2,1,2,1",options="header"]
913+
|===
914+
|Parameter |Description |Type |Valid Values |Required
915+
916+
|`kind` |Authentication type. |String |`oauth2-client-credentials` |Yes
917+
|`clientId` |The client ID. |String |Any string |Yes
918+
|`clientSecret` |The client secret. |String |Any string |Yes
919+
|`token` |Configuration for fetching the token. |Object |Object with token properties |Yes
920+
|`token.url` |The URL of the token provider. |String |Valid URL |Yes
921+
|`token.timeout` |Time in seconds to wait for the service to return the token. |Number |Any number |No
922+
|`token.bodyEncoding` |The encoding format for the token request body. |String |`form`, `json` |No
923+
|`scopes` |An array of scopes to request. |Array |Array of scope strings |No
924+
|===
925+
895926
[[anypoint-client-credentials]]
896927
==== Anypoint Client Credentials
897928

@@ -903,6 +934,17 @@ authentication:
903934
clientSecret: "client_secret"
904935
----
905936

937+
The `apikey-client-credentials` authentication has these properties.
938+
939+
[cols="1,2,1,2,1",options="header"]
940+
|===
941+
|Parameter |Description |Type |Valid Values |Required
942+
943+
|`kind` |Authentication type. |String |`apikey-client-credentials` |Yes
944+
|`clientId` |The client ID. |Object |Object with `value` and optional `name` (default header name is `client_id`) |Yes
945+
|`clientSecret` |The client secret. |Object |Object with `value` and optional `name` (default header name is `client_secret`) |Yes
946+
|===
947+
906948
[[api-key]]
907949
==== API Key Authentication
908950

@@ -924,6 +966,112 @@ authentication:
924966
headerName: X-Custom-Auth-Token # Custom header name
925967
----
926968

969+
The `apiKey` authentication has these properties.
970+
971+
[cols="1,2,1,2,1",options="header"]
972+
|===
973+
|Parameter |Description |Type |Valid Values |Required
974+
975+
|`kind` |Authentication type. |String |`apiKey` |Yes
976+
|`apiKey` |The value of the API key. |String |Any string |Yes
977+
|`headerName` |The name of the header in which to set the key. If not specified, `Authorization` is used. |String |Any string |No
978+
|===
979+
980+
[[in-task-auth]]
981+
==== In-Task Authorization Code
982+
983+
Use `in-task authorization code` when the connection needs secondary credentials obtained during a task using the OAuth 2.0 Authorization Code flow. OAuth2 tokens are extracted from message data and injected into the `Authorization` header for upstream calls. This supports step-up or in-task authentication (for example, when a user must re-authenticate for a sensitive action). For more information about the associated policy, see xref:gateway::policies-outbound-a2a-intask-authorization-code.adoc[].
984+
985+
[source,yaml]
986+
----
987+
authentication:
988+
kind: in-task-authorization-code
989+
secondaryAuthProvider: providerName
990+
authorizationEndpoint: https://oauth.provider.com/authorize
991+
tokenEndpoint: https://oauth.provider.com/token
992+
scopes: Read
993+
redirectUri: https://oauth.provider.com/callback
994+
responseType: code
995+
tokenAudience: https://api.example.com/agents/my-agent
996+
codeChallengeMethod: S256
997+
bodyEncoding: form
998+
challengeResponseStatusCode: 200 #Optional, Status code for challenge response. Default: 200.
999+
tokenTimeout: 300 #Optional. Timeout in seconds for token requests. Default: 300.
1000+
----
1001+
1002+
The `in-task-authorization-code` authentication has these properties.
1003+
1004+
[cols="1,2,1,2,1",options="header"]
1005+
|===
1006+
|Parameter |Description |Type |Valid Values |Required
1007+
1008+
|`kind` |Authentication type. |String |`in-task-authorization-code` |Yes
1009+
|`authorizationEndpoint` |OAuth2 authorization endpoint URL. Used to generate the authentication challenge. |String |Valid URL |Yes
1010+
|`tokenEndpoint` |OAuth2 token endpoint URL. Used to generate the authentication challenge. |String |Valid URL |Yes
1011+
|`scopes` |OAuth2 scopes required for step-up authentication. |String |Space- or comma-separated scope list (for example, `openid profile email`) |Yes
1012+
|`redirectUri` |OAuth2 redirect URI the client uses in the authorization flow. |String |Valid URI |Yes
1013+
|`secondaryAuthProvider` |Name of the IdP (for example, `okta`, `auth0`). Informational only, for the authentication card. |String |Any string |No
1014+
|`responseType` |OAuth2 response type. |String |Typically `code`. Default: `code` |No
1015+
|`codeChallengeMethod` |PKCE code challenge method. |String |Typically `S256`. Default: `S256` |No
1016+
|`tokenAudience` |Intended recipient of the token (for example, `agent1` or API URL). |String |Any string |No
1017+
|`bodyEncoding` |Encoding for the token request body. |String |`form`, `json`. Default: `form` |No
1018+
|`tokenTimeout` |Timeout in seconds for token requests. |Integer |Positive integer. Default: 300 |No
1019+
|`challengeResponseStatusCode` |HTTP status code returned for auth-required challenge responses. Typically 200 for JSON-RPC compatibility. |Integer |HTTP status code. Default: 200 |No
1020+
|===
1021+
1022+
1023+
[[obo-credential-injection]]
1024+
==== OAuth 2.0 OBO Credential Injection
1025+
1026+
This authentication type supports OAuth 2.0 Token Exchange and Microsoft Entra ID On-Behalf-Of protocols. For more information about the associated policy, see xref:gateway::policies-outbound-oauth-obo.adoc[].
1027+
1028+
Using OAuth 2.0 Token Exchange:
1029+
1030+
[source,yaml]
1031+
----
1032+
authentication:
1033+
kind: oauth2-obo
1034+
flow: oauth2-token-exchange
1035+
tokenEndpoint: https://oauth.provider.com/token
1036+
clientId: clientId
1037+
clientSecret: clientSecret
1038+
targetType: audience
1039+
targetValue: https://api.example.com/agents/my-agent
1040+
scope: Read #optional, OAuth 2.0 scope to request. Required for Microsoft Entra OBO (for example, api://downstream-client-id/.default). Optional for OAuth 2.0 Token Exchange (RFC 8693).
1041+
timeout: 5000 #optional, Timeout for token exchange requests in milliseconds. Default: 10000.
1042+
----
1043+
1044+
Using Microsoft Entra ID On-Behalf-Of:
1045+
1046+
[source,yaml]
1047+
----
1048+
authentication:
1049+
kind: oauth2-obo
1050+
flow: microsoft-entra-obo
1051+
tokenEndpoint: https://oauth.provider.com/token
1052+
clientId: clientId
1053+
clientSecret: clientSecret
1054+
scope: api://downstream-client-id/.default
1055+
timeout: 5000 #optional, Timeout for token exchange requests in milliseconds. Default: 10000.
1056+
----
1057+
1058+
The `oauth2-obo` authentication has these properties.
1059+
1060+
[cols="1,2,1,2,1",options="header"]
1061+
|===
1062+
|Parameter |Description |Type |Valid Values |Required
1063+
1064+
|`kind` |Authentication type. |String |`oauth2-obo` |Yes
1065+
|`flow` |Token exchange flow type. |String |`oauth2-token-exchange`, `microsoft-entra-obo` |Yes
1066+
|`clientId` |OAuth2 client ID for token exchange. |String |Any string |Yes
1067+
|`clientSecret` |OAuth2 client secret for token exchange. |String |Any string |Yes
1068+
|`tokenEndpoint` |OAuth2 token endpoint URL for token exchange. |String |Valid URL |Yes
1069+
|`targetType` |Parameter type for specifying the target service (audience for logical name, resource for physical URI). Used for OAuth 2.0 Token Exchange. |String |`audience`, `resource`. Default: `audience` |No
1070+
|`targetValue` |Target audience URI or resource URI for the exchanged token. Required for OAuth 2.0 Token Exchange. |String |Valid URI |Required when using `oauth2-token-exchange` with a target
1071+
|`scope` |OAuth scope to request. Required for Microsoft Entra OBO (e.g. `api://downstream-client-id/.default`). Optional for OAuth 2.0 Token Exchange. |String |Any string |Required for `microsoft-entra-obo`
1072+
|`timeout` |Timeout for token exchange requests in milliseconds. |Integer |Positive integer. Default: 10000 |No
1073+
|===
1074+
9271075
[[exchange-json-file-element]]
9281076
== exchange.json File Element
9291077

0 commit comments

Comments
 (0)