Amazon Bedrock AgentCore IdentityのOn-Behalf-Of（OBO）トークン交換機能を実際に試して理解を深めてみた

{"error":{"code":"InvalidAuthenticationToken","message":"Access token validation failure. Invalid audience.", ...}}
HTTP 401

{"jsonrpc":"2.0","error":{"code":-32001,"message":"Claim 'iss' value mismatch with configuration."}}
HTTP 401

res = httpx.post(
    f"https://login.microsoftonline.com/{TENANT_ID}/oauth2/v2.0/token",
    data={
        "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
        "client_id": CLIENT_ID,
        "client_secret": CLIENT_SECRET,  # シークレットをどこかで管理して読み込む
        "assertion": user_token,          # 受け取ったユーザーのトークンをそのまま渡す
        "scope": "https://graph.microsoft.com/User.Read",
        "requested_token_use": "on_behalf_of",
    },
)
graph_token = res.json()["access_token"]

@requires_access_token(
    provider_name="entra-obo-provider",
    auth_flow="ON_BEHALF_OF_TOKEN_EXCHANGE",
    scopes=["https://graph.microsoft.com/User.Read"],
)
async def call_graph_me(*, access_token: str) -> dict:
    ...  # access_token は Graph 宛てに交換済み

"oauthCredentialProvider": {
  "providerArn": "arn:aws:bedrock-agentcore:...:oauth2credentialprovider/entra-obo-provider",
  "scopes": ["https://graph.microsoft.com/User.Read"],
  "grantType": "TOKEN_EXCHANGE"
}

APP_ID=<クライアントID>
TENANT_ID=<テナントID>

USER_TOKEN=$(az account get-access-token \
  --scope "api://${APP_ID}/access_as_user" --query accessToken -o tsv)

echo "${USER_TOKEN}" | uv run decode.py aud iss scp azp name

{
 "aud": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
 "iss": "https://login.microsoftonline.com/yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy/v2.0",
 "scp": "access_as_user",
 "azp": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
 "name": "神野 雄大"
}

curl -s -w "\nHTTP %{http_code}\n" https://graph.microsoft.com/v1.0/me \
  -H "Authorization: Bearer ${USER_TOKEN}"

read -s SECRET   # ポータルで控えたシークレットの値を貼り付ける

aws bedrock-agentcore-control create-oauth2-credential-provider \
  --name entra-obo-provider \
  --credential-provider-vendor MicrosoftOauth2 \
  --oauth2-provider-config-input "{\"microsoftOauth2ProviderConfig\":{
    \"clientId\":\"${APP_ID}\",\"clientSecret\":\"${SECRET}\",\"tenantId\":\"${TENANT_ID}\"}}"
unset SECRET

agentcore create --project-name OboDemo --no-agent --skip-git
cd OboDemo
agentcore add agent --name obo_agent --type create --language Python \
  --framework Strands --model-provider Bedrock --memory none \
  --authorizer-type CUSTOM_JWT \
  --discovery-url "https://login.microsoftonline.com/${TENANT_ID}/v2.0/.well-known/openid-configuration" \
  --allowed-audience "${APP_ID}"

@requires_access_token(
    provider_name="entra-obo-provider",
    auth_flow="ON_BEHALF_OF_TOKEN_EXCHANGE",
    scopes=["https://graph.microsoft.com/User.Read"],
)
async def call_graph_me(*, access_token: str) -> dict:
    ...  # access_token は Graph 宛てに交換済み

cd app/obo_agent && uv lock && cd ../..

ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
echo "[{\"name\":\"default\",\"account\":\"${ACCOUNT_ID}\",\"region\":\"us-east-1\"}]" \
  > agentcore/aws-targets.json
agentcore deploy -y

ROLE_NAME=$(aws cloudformation describe-stacks --stack-name AgentCore-OboDemo-default \
  --query "Stacks[0].Outputs[?contains(OutputKey,'RoleArn')].OutputValue" --output text | cut -d/ -f2)
SECRET_ARN=$(aws bedrock-agentcore-control get-oauth2-credential-provider \
  --name entra-obo-provider --query clientSecretArn.secretArn --output text)
BASE="arn:aws:bedrock-agentcore:us-east-1:${ACCOUNT_ID}"

aws iam put-role-policy --role-name "${ROLE_NAME}" --policy-name entra-obo --policy-document "{
  \"Version\": \"2012-10-17\",
  \"Statement\": [
    {\"Effect\": \"Allow\", \"Action\": \"bedrock-agentcore:GetResourceOauth2Token\",
     \"Resource\": [
       \"${BASE}:token-vault/default\",
       \"${BASE}:token-vault/default/oauth2credentialprovider/entra-obo-provider\",
       \"${BASE}:workload-identity-directory/default\",
       \"${BASE}:workload-identity-directory/default/workload-identity/*\"]},
    {\"Effect\": \"Allow\", \"Action\": \"secretsmanager:GetSecretValue\", \"Resource\": \"${SECRET_ARN}\"}
  ]
}"

RUNTIME_ARN=$(aws cloudformation describe-stacks --stack-name AgentCore-OboDemo-default \
  --query "Stacks[0].Outputs[?contains(OutputKey,'RuntimeArn')].OutputValue" --output text)
ENCODED=$(uv run python -c "import urllib.parse,sys;print(urllib.parse.quote(sys.argv[1],safe=''))" "${RUNTIME_ARN}")
USER_TOKEN=$(az account get-access-token \
  --scope "api://${APP_ID}/access_as_user" --query accessToken -o tsv)

curl -s -X POST \
  "https://bedrock-agentcore.us-east-1.amazonaws.com/runtimes/${ENCODED}/invocations?qualifier=DEFAULT" \
  -H "Authorization: Bearer ${USER_TOKEN}" \
  -H "Content-Type: application/json" \
  -H "X-Amzn-Bedrock-AgentCore-Runtime-Session-Id: $(uuidgen)-$(uuidgen)" \
  -d '{"prompt": "私は誰ですか？"}'

{"result": "あなたは**神野 雄大**さんです。\n\nメールアドレスは `user@example.onmicrosoft.com` として登録されています。\n\n何かお手伝いできることはございますか?\n"}

GRAPH_TOKEN=$(az account get-access-token --resource-type ms-graph --query accessToken -o tsv)

curl -s -w "\nHTTP %{http_code}\n" -X POST \
  "https://bedrock-agentcore.us-east-1.amazonaws.com/runtimes/${ENCODED}/invocations?qualifier=DEFAULT" \
  -H "Authorization: Bearer ${GRAPH_TOKEN}" \
  -H "Content-Type: application/json" \
  -H "X-Amzn-Bedrock-AgentCore-Runtime-Session-Id: $(uuidgen)-$(uuidgen)" \
  -d '{"prompt": "私は誰ですか？"}'

{"jsonrpc":"2.0","error":{"code":-32001,"message":"Claim 'iss' value mismatch with configuration."}}
HTTP 401

aws bedrock-agentcore-control create-workload-identity --name obo-local-test

WAT=$(aws bedrock-agentcore get-workload-access-token-for-jwt \
  --workload-name obo-local-test --user-token "${USER_TOKEN}" \
  --query workloadAccessToken --output text)

OBO_TOKEN=$(aws bedrock-agentcore get-resource-oauth2-token \
  --resource-credential-provider-name entra-obo-provider \
  --oauth2-flow ON_BEHALF_OF_TOKEN_EXCHANGE \
  --scopes "https://graph.microsoft.com/User.Read" \
  --workload-identity-token "${WAT}" --query accessToken --output text)

echo "${OBO_TOKEN}" | uv run decode.py aud scp appid app_displayname name

{
 "aud": "https://graph.microsoft.com",
 "scp": "User.Read profile openid email",
 "appid": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
 "app_displayname": "agentcore-obo-agent-portal",
 "name": "神野 雄大"
}

GATEWAY_ID=$(aws bedrock-agentcore-control create-gateway --name obo-gateway \
  --role-arn "arn:aws:iam::${ACCOUNT_ID}:role/obo-gateway-role" \
  --protocol-type MCP --authorizer-type CUSTOM_JWT \
  --authorizer-configuration "{\"customJWTAuthorizer\":{
    \"discoveryUrl\":\"https://login.microsoftonline.com/${TENANT_ID}/v2.0/.well-known/openid-configuration\",
    \"allowedAudience\":[\"${APP_ID}\"]}}" \
  --query gatewayId --output text)

PROVIDER_ARN=$(aws bedrock-agentcore-control get-oauth2-credential-provider \
  --name entra-obo-provider --query credentialProviderArn --output text)
SCHEMA=$(uv run python -c "import json;print(json.dumps(open('graph-me.json').read()))")

aws bedrock-agentcore-control create-gateway-target --gateway-identifier "${GATEWAY_ID}" --name graph \
  --target-configuration "{\"mcp\":{\"openApiSchema\":{\"inlinePayload\":${SCHEMA}}}}" \
  --credential-provider-configurations "[{
    \"credentialProviderType\": \"OAUTH\",
    \"credentialProvider\": {\"oauthCredentialProvider\": {
      \"providerArn\": \"${PROVIDER_ARN}\",
      \"scopes\": [\"https://graph.microsoft.com/User.Read\"],
      \"grantType\": \"TOKEN_EXCHANGE\"}}}]"

GATEWAY_URL=$(aws bedrock-agentcore-control get-gateway --gateway-identifier "${GATEWAY_ID}" \
  --query gatewayUrl --output text)

curl -s -X POST "${GATEWAY_URL}" -H "Authorization: Bearer ${USER_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

curl -s -X POST "${GATEWAY_URL}" -H "Authorization: Bearer ${USER_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"graph___getMyProfile","arguments":{"$select":"displayName,userPrincipalName"}}}'

{"jsonrpc":"2.0","id":2,"result":{"isError":false,"content":[{"type":"text","text":"{...\"displayName\":\"神野 雄大\",\"userPrincipalName\":\"user@example.onmicrosoft.com\"}"}]}}

{"jsonrpc":"2.0","id":0,"error":{"code":-32002,"message":"insufficient_scope - The request requires higher privileges than provided by the access token."}}
HTTP 403

TARGET_ID=$(aws bedrock-agentcore-control list-gateway-targets --gateway-identifier "${GATEWAY_ID}" \
  --query "items[0].targetId" --output text)
aws bedrock-agentcore-control delete-gateway-target --gateway-identifier "${GATEWAY_ID}" --target-id "${TARGET_ID}"
aws bedrock-agentcore-control delete-gateway --gateway-identifier "${GATEWAY_ID}"
aws iam delete-role-policy --role-name obo-gateway-role --policy-name obo-gateway
aws iam delete-role --role-name obo-gateway-role

aws iam delete-role-policy --role-name "${ROLE_NAME}" --policy-name entra-obo
aws cloudformation delete-stack --stack-name AgentCore-OboDemo-default
aws bedrock-agentcore-control delete-oauth2-credential-provider --name entra-obo-provider
aws bedrock-agentcore-control delete-workload-identity --name obo-local-test

az ad app delete --id "${APP_ID}"