Problem
When an agent with AuthBridge is deployed, the client-registration sidecar registers the agent as a Keycloak client and creates an audience scope (agent-<ns>-<sa>-aud). This scope is added as a realm default, so newly created clients automatically include the agent's SPIFFE ID in their token audience.
However, existing clients (like the Kagenti UI's kagenti client do not retroactively inherit new realm default scopes. This means the UI cannot chat with AuthBridge-protected agents — the UI token's audience doesn't include the agent's SPIFFE ID, and AuthBridge rejects the request with:
Current workaround
The demo script explicitly adds the audience scope to the UI client after creating it. This requires the user to run the script, log out, and log back in.
Proposed solution
The sidecar should, as part of its registration flow:
- Create the agent's audience scope (already does this via realm default)
- Also add that scope to well-known platform clients (e.g., the UI client)
This way, every new AuthBridge agent automatically becomes reachable from the UI without manual Keycloak configuration.
Design considerations
- The UI client ID could be configurable (env var, default )
- The sidecar already has Keycloak admin credentials (from the ConfigMap)
- The operation is idempotent (adding a scope that's already assigned is a no-op)
- Users will still need to re-login (or wait for token refresh) after a new agent is deployed
Related
EOF
)
Problem
When an agent with AuthBridge is deployed, the
client-registrationsidecar registers the agent as a Keycloak client and creates an audience scope (agent-<ns>-<sa>-aud). This scope is added as a realm default, so newly created clients automatically include the agent's SPIFFE ID in their token audience.However, existing clients (like the Kagenti UI's
kagenticlient do not retroactively inherit new realm default scopes. This means the UI cannot chat with AuthBridge-protected agents — the UI token's audience doesn't include the agent's SPIFFE ID, and AuthBridge rejects the request with:Current workaround
The demo script explicitly adds the audience scope to the UI client after creating it. This requires the user to run the script, log out, and log back in.
Proposed solution
The sidecar should, as part of its registration flow:
This way, every new AuthBridge agent automatically becomes reachable from the UI without manual Keycloak configuration.
Design considerations
Related
EOF
)