Agents Should Never Hold Your Tokens: A PingFederate to Microsoft Graph Broker

说明与用途

PingFederate 中介代理安全地为代理访问 Microsoft Graph，保持 Entra 令牌在后端，仅限代理执行只读目录查询。

问题

Background jobs and AI agents need to query Microsoft Entra ID data but handing them Microsoft tokens or giving them app‑wide permissions risks credential leakage and over‑privileged access.

结果

The broker architecture prevents agents from ever holding Microsoft tokens and limits them to specific read operations with scoped permissions, reducing credential leakage and over‑privileged access.

工作流

• 1. User signs in via PingFederate and initiates a connection flow.
• 2. PingFederate authenticates the caller, performs OIDC login to Entra, and forwards the token response to the broker.
• 3. The broker stores encrypted delegated tokens, validates delegations, and exposes read‑only Graph endpoints.
• 4. The agent backend calls the broker with a PingFederate token and a delegation ID, never receiving a Microsoft token.
• 5. The broker performs the requested Graph call and returns the result to the agent.

证据

Background jobs and AI agents increasingly need to answer questions like "who is in this group?" or "find users starting with Nick".

来源

Hand the agent a Microsoft token. Now the agent (and its logs, prompts and tool outputs) can leak a credential that works against Graph.

来源

Give the agent app‑wide permissions. Now it can read the whole directory, not just what a given user is willing to share.

来源

This project takes a third path: a directory broker in front of Graph. Entra tokens stay on the backend. Agents receive directory data only.

来源

It is a runnable Go starter for PingFederate 13.1, delegated Microsoft Graph access and background agents.

来源

Only three read operations exist: directory.find_users, directory.find_groups, directory.list_group_members.

来源