Agent Identity features are divided into Inbound and Outbound based on the direction of the workflow. Agent Identity inbound authentication is a secure authentication service for your AI agent or other application. After your agent passes the authentication and authorization checks, it can call Agent Identity API operations to obtain a short-lived Workload Access Token.
Identity provider configuration
You can integrate Agent Identity directly with any external identity provider (IdP) that is compatible with OpenID Connect (OIDC). Your agent can then present to Agent Identity the JSON Web Token (JWT) that it obtained after authenticating with an external IdP to prove its identity. To connect to a wider range of external identity sources for inbound authentication, use a user pool.
A user pool supports the following external identity sources:
External Identity Providers: DingTalk, Lark, WeCom, and others.
Protocol-based Identity Providers: SAML 2.0, OIDC, and others.
Alibaba Cloud Identity Providers: IDaaS and others.
Inbound authentication methods
Agent Identity provides the following authentication methods to obtain a Workload Access Token:
OpenAPI signature verification: The default authentication mechanism used when you call protected Alibaba Cloud OpenAPI operations. The Credentials tool in Alibaba Cloud SDKs automatically determines which credential to use based on the deployment environment, such as a Security Token Service (STS) token or an AccessKey. If your agent is deployed on an Alibaba Cloud-managed agent runtime platform, such as Model Studio, you can use the platform to perform secure, keyless authentication.
JWT verification: Agent Identity accepts JWTs issued by trusted OIDC identity providers and verifies the signature, issuer, and audience of each token. A JWT is typically obtained when a user authenticates with their identity provider while signing in to an application.
The following table describes the API operations and inbound authentication methods for different business scenarios.
Business scenario | API operation | Inbound authentication method |
With user involvement |
| OpenAPI signature verification and JWT verification |
With user involvement |
| OpenAPI signature verification |
Without user involvement |
| OpenAPI signature verification |
When a user is involved, call GetWorkloadAccessTokenForJWT if you have a JWT issued by the user's identity provider. Call GetWorkloadAccessTokenForUserId if you have the user's ID.
OpenAPI signature verification is performed regardless of which API operation you call to obtain a Workload Access Token. You must ensure that Alibaba Cloud access credentials are available in the environment where your agent is deployed.
Inbound authorization
Inbound authorization is required when you call a GetWorkloadAccessToken* API operation of Agent Identity. You can create a custom permission policy for the runtime identity of your agent, such as a RAM role, and grant the required permissions to the identity.
The following example shows a custom permission policy:
{
"Statement": [
{
"Effect": "Allow",
"Action": [
"agentidentitydata:GetWorkloadAccessToken",
"agentidentitydata:GetWorkloadAccessTokenForJWT",
"agentidentitydata:GetWorkloadAccessTokenForUserId"
],
"Resource": "*"
}
],
"Version": "1"
}