Exploring AAuth for Agent IAM
Agent Auth (AAuth – pronounced “AY-awth”) is an exploratory spec for agent identity and access management from Dick Hardt who authored OAuth 2.0 and co-author of OAuth 2.1.
Intro: Digging in to AAuth Flows
This set of resources is intended to help you understand the AAuth protocol in concrete detail. It is not a specification (see AAuth for the evolution of that). This is specificatlly a more detailed review of the spec with examples (as a result of me implementing this).
This section walks through various flows with detailed Header/Payload examples so the sequence diagrams from the AAuth exploratory draft are illustrated concretely.
The source code for this section can be found on GitHub: https://github.com/christian-posta/aauth-implementation
- Header Web Key (HWK) for Pseudonymous Access
- Json Web Keys (JWKS) for Identified Access / Agent Identity
- Identified Agent Authorization
- User Consent with Identified Access with Authorization
- Authorization Token Exchange
- Delegated Agent Identity
🎉 Full Working Demo with Keycloak and Agentgateway
This set of resources walks you through set up and evaluation of a realistic AAuth implementation with Identity Provider (Keycloak), Agentgateway, and libraries to support AAuth in multiple languages (Java, Python, Rust).
The source code for this section can be found in GitHub: https://github.com/christian-posta/aauth-full-demo
- AAuth with Keycloak and Agentgateway
- Agent Identity with JWKS
- Agent authorization (autonomous flow)
- Agent authorization (user consent)
- Token Exchange for Auth propagation (OBO)
- Apply policy with AgentGateway