Identity as a Service:Agent identity security with AgentRun

3.1 Deploy the function

1. Log on to the Function Compute (FC) console.

2. In the left-side navigation pane, select Function Management > Functions.

3. Select the Web Function tab and click Create Web Function.

4. For runtime environment, select Custom Runtime > Java > Java 17.

5. For Code Upload Method, select Use Sample Code. Leave other settings at their defaults.

6. Finish creating the function.

3.2 Configure JWT authentication

Configure JWT authentication for the function's HTTP trigger. This ensures that only callers with an access token issued by IDaaS can access the enterprise service.

1. On the IDaaS instance console, click the Enterprise Service node you created by following the Agent Identity Security Configuration Guide.

2. Under General, copy the OIDC Discovery Endpoint. Open it in a browser and copy the JWKS endpoint, which is the value of the jwks_uri field.

3. Open the JWKS endpoint in your browser and copy the entire response.

4. In the Function Compute (FC) console, find the function in the Functions list and click Configure in the Actions column.

5. On the Function Details tab, click the Trigger in the Function Topology. For Authentication Method, select JWT Authentication.

6. Paste the response from the JWKS endpoint into the JWKS field.

7. In the JWT Token Configuration section, set Parameter Name to Authorization.

8. Finish the configuration.

AgentRun

1. Package and compress the agent sample code

   Run the following commands in your terminal:

   cd idaas-java-agent-id-demo
   mvn clean package
   cd ../
   zip -r idaas-java-agent-id-demo.zip idaas-java-agent-id-demo/

2. Create an execution role

   1. Log on to the Resource Access Management (RAM) console.

   2. In the navigation pane, select Identities > Roles.

   3. Click Create Role. For Principal Type, select Cloud Service. For Principal Name, select Function Compute (FC).

   4. Set the role name to sample-fc-role.

3. Create the agent

   1. Log on to the Function Compute (FC) console.

   2. In the left-side navigation pane, select FunctionAI > AgentRun.

   3. When prompted for role authorization, click Authorize. This is only required the first time.

   4. Click Create Agent and select Create from Code.

   5. For Code Source, select Upload Code Package. For Runtime, select Java 17.

   6. Upload the compressed idaas-java-agent-id-demo.zip file.

   7. Enter the following startup command:

      java -Dcloud_idaas_config_path=classpath:cloud_idaas_config_for_agent_run.json -jar idaas-java-agent-id-demo/target/idaas-java-agent-id-demo-1.0.jar

   8. Enter 9002 for the startup port.

   9. Configure the environment variables.

      Parameter	Description	Source
      IDAAS_CLIENT_SECRET	The agent's client secret credential. Required for Client Secret authentication.	Find it under the General section of the agent node created in the Agent Identity Security Configuration Guide.
      ENV_PRIVATE_KEY	The agent's private key. Required for public/private key authentication.	This is the private key corresponding to the public key you uploaded when creating the public/private key credential for the agent node, as described in the Agent Identity Security Configuration Guide.
      JWKS_ENDPOINT	The IDaaS JWKS endpoint.	The format is https://xxx.aliyunidaas.com/api/v2/iauths_system/oauth2/jwks. Replace xxx with the corresponding value from the issuer field in the SDK configuration file from Step 2: Configure the IDaaS SDK.
      AGENT_AUDIENCE	The agent's audience.	Find it under the General section of the agent node created in the Agent Identity Security Configuration Guide.
      AGENT_SCOPE	The agent's scope.	Find it under the Permission Configuration section of the agent node created in the Agent Identity Security Configuration Guide.
      ACCESS_IDENTITY	The agent identity mode: Machine (machine identity) or Human (user identity).	This example uses Machine (machine identity), which is suitable for scenarios where the agent operates independently. Downstream services recognize the agent's machine identity.
      LLM_API_KEY_IDENTIFIER	The large language model API key identifier.	Find it in the Large Language Model (LLM) node created in the Agent Identity Security Configuration Guide.
      EXTERNAL_SERVER_API_KEY_IDENTIFIER	The third-party service API key identifier.	Find it in the External Service node created in the Agent Identity Security Configuration Guide.
      ENTERPRISE_SERVICE_SCOPE	The enterprise service access scope (audience|scope).	Use the format "audience|scope". Be sure to include the double quotes. In the Enterprise Service node created in the Agent Identity Security Configuration Guide, find the audience under General and the Permission Identifier under Permission Configuration.
      EXTERNAL_SERVER_URL	The third-party service endpoint.	The Amap MCP Server HTTP endpoint. You can find it in the Amap MCP within the Model Studio platform.
      ENTERPRISE_SERVICE_URL	The enterprise service endpoint.	As described in 3.2 Configure JWT authentication, on the Function Details tab, click the Trigger in the Function Topology to view the Internet Endpoint.

   10. For the execution role, select the sample-fc-role that you created earlier.

   11. Click Start Deployment.

   12. After the deployment is complete, click Details on the agent card. In the left-side navigation pane, select Versions & Grayscale, and then click Create Endpoint.

5.1 Configure the frontend UI

Modify the frontend/config.js file in the agent sample code:

window.APP_CONFIG = {
  API_URL: 'http://localhost:9002/openai/v1/chat/completions',
  IDAAS_AUTHORIZE_ENDPOINT: 'https://xxx.aliyunidaas.com/login/app/common/oauth2/authorize',
  IDAAS_LOGOUT_ENDPOINT: 'https://xxx.aliyunidaas.com/login/app/common/oauth2/logout',
  CLIENT_ID: '{client_id}',
  SCOPE: 'https://agentserver.example.com|agent.access',
};

5.2 Start the frontend UI

Run the following commands in your terminal (Node.js is required):

cd frontend
npx http-server -p 9001

5.3 Configure the client application

1. Go to the IDaaS EIAM console.

2. In the left-side navigation pane, click Application Management > M2M Application.

3. Locate the Client node created in the Agent Identity Security Configuration Guide and click Manage in the Actions column.

4. Click the Sign-In tab. In the Grant Types section, select the Implicit Mode checkbox.

5. For Implicit Mode Parameters, set Return Type to token.

6. For Redirect URIs, enter the startup URL of the frontend UI: http://127.0.0.1:9001/.

7. Click Show Advanced Settings and for the logout callback URL, enter the frontend UI startup URL: http://127.0.0.1:9001/.

8. Finish the configuration.

Modify the IDaaS SDK configuration

Modify src/main/resources/cloud_idaas_config_for_agent_run.json by adding openApiEndpoint and modifying authnConfiguration, leaving the other fields unchanged:

{
    "idaasInstanceId": "idaas_xxx",      
    "clientId": "app_xxx",               
    "issuer":"https://xxx/api/v2/iauths_system/oauth2",               
    "tokenEndpoint": "https://xxx/api/v2/iauths_system/oauth2/token",
    "scope": "api.example.com|read:file",
    "openApiEndpoint":"eiam.[region_id].aliyuncs.com",
    "developerApiEndpoint":"eiam-developerapi.[region_id].aliyuncs.com",
    "authnConfiguration": {
      "identityType": "CLIENT",
      "authnMethod": "PLUGIN",
      "pluginName": "alibabacloudPluginCredentialProvider"
  }
}

For detailed instructions, see Environment preparation.

Configure the execution role

The AgentRun execution role must have permission to call the IDaaS GenerateOauthToken OpenAPI. An example permission policy is as follows:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "eiam:GenerateOauthToken",
      "Resource": [
        "acs:eiam:{regionId}:{accountId}:instance/{InstanceId}/application/{ApplicationId}"
      ]
    }
  ]
}

Replace {regionId}, {accountId}, {InstanceId}, and {ApplicationId} with your region ID, Alibaba Cloud account ID, IDaaS instance ID, and agent ID.

To create a permission policy and grant it to an execution role, see Alibaba Cloud OpenAPI authentication.

When deploying a service in AgentRun, you must modify the SDK configuration and configure the execution role as described above. All other steps in the deployment process remain the same.