solo enterprise agentgateway · sts · multi-hop identity

Identity that survives the hop.

User → agent → tool crosses audiences and identity domains. AgentGateway validates the human once, then exchanges or elicits per backend so credentials never collapse into a single over-privileged token.

passthrough · impersonation · Entra OBO elicitation OAuth whoami claims proof
Run the demo ↓ All demos Elicitations Entra OBO

#The multi-hop problem

A corporate JWT is not a Graph token is not a GitHub PAT. Forwarding one bearer everywhere either breaks (wrong aud) or erases accountability (agent invisible).

#Impersonation vs delegation vs OBO

ModeToken shapeGoose demo
Passthrough Original Entra JWT; gateway validates only /identity/passthrough · whoami
Impersonation STS mint: same sub, new iss=STS, no act /identity/impersonate · whoami
Delegation STS mint: user sub + agent act Product STS + agentsts-adk; lab notes in harness
Entra OBO jwt-bearer → Graph-scoped token /graph-me · graph_me
Elicitation OAuth consent; STS stores third-party token /github-elicit + UI elicitations
Key distinction

Impersonation = act as the user (agent not in token). Delegation = act for the user with agent identity preserved (act). Entra OBO = Microsoft’s grant for a middle-tier app calling Graph as the user.

#Picture · three hops on goose

Same human subject, three different tokens at the tool. Point at the boxes when you present.

impersonation
User only
no act claim
delegation
User + agent
sub + act
Entra OBO
External domain
Graph aud
elicitation
OAuth store
3rd-party token

#Runnable demo

One script walks passthrough → impersonation claims comparison → Entra OBO Graph proof.

presenter
./scripts/test-identity-hops.sh           # full narration
./scripts/test-identity-hops.sh hops      # A+B only (no Graph)
./scripts/test-entra-obo.sh               # Entra OBO → Graph /me
./scripts/test-elicitation.sh             # OAuth elicit handshake
what whoami proves

Claims at the tool

identity-claims-mcp decodes the Authorization header it actually received — after gateway processing. Compare iss / act between hops.

token mint

One Entra JWT for hops + OBO

az account get-access-token \
  --resource api://0c00f6d2-5587-469d-9d35-7360d878fddc \
  --query accessToken -o tsv

Middle-tier app goose-solo-ui-backend (same as OBO demo).

Config

config/mcp-servers/identity-claims-mcp-server.yaml · config/backends/identity-*.yaml · config/routes/identity-hops-routes.yaml · config/policies/identity-hops-policies.yaml

#Endpoints

PathPortWhat it proves
/identity/passthrough30160Entra JWT at tool (no mint)
/identity/impersonate30160STS impersonation mint (no act)
/graph-me30160Entra OBO → Graph /me
/github-elicit30160Elicitation OAuth store
/mcp-secure31606JWT + tool RBAC only