Agents Should Never Hold Your Tokens: A PingFederate to Microsoft Graph Broker

Описание и применение

Брокер PingFederate обеспечивает безопасный доступ к Microsoft Graph, не выдавая токены агентам и ограничивая их только чтением конкретных данных.

Задача

Background jobs and AI agents need to query Microsoft Entra ID data but handing them Microsoft tokens or giving them app‑wide permissions risks credential leakage and over‑privileged access.

Результат

The broker architecture prevents agents from ever holding Microsoft tokens and limits them to specific read operations with scoped permissions, reducing credential leakage and over‑privileged access.

Рабочий процесс

• 1. User signs in via PingFederate and initiates a connection flow.
• 2. PingFederate authenticates the caller, performs OIDC login to Entra, and forwards the token response to the broker.
• 3. The broker stores encrypted delegated tokens, validates delegations, and exposes read‑only Graph endpoints.
• 4. The agent backend calls the broker with a PingFederate token and a delegation ID, never receiving a Microsoft token.
• 5. The broker performs the requested Graph call and returns the result to the agent.

Доказательства

Background jobs and AI agents increasingly need to answer questions like "who is in this group?" or "find users starting with Nick".

Источник

Hand the agent a Microsoft token. Now the agent (and its logs, prompts and tool outputs) can leak a credential that works against Graph.

Источник

Give the agent app‑wide permissions. Now it can read the whole directory, not just what a given user is willing to share.

Источник

This project takes a third path: a directory broker in front of Graph. Entra tokens stay on the backend. Agents receive directory data only.

Источник

It is a runnable Go starter for PingFederate 13.1, delegated Microsoft Graph access and background agents.

Источник

Only three read operations exist: directory.find_users, directory.find_groups, directory.list_group_members.

Источник