Repository navigation
fix(aauth): accept the Person Server's own auth token as the presented token; release 0.1.0 - #197
Merged
Merged
Conversation
…d token
An agent presents the auth token it holds for a resource until the resource
asks for another; the resource then names that auth token's jti as
presented_jti. The Person Server accepted only a person token there, so every
call after the first to one resource was refused ("not an aa-person+jwt").
It now also accepts an auth token it issued itself (its issuer, its dwk),
checked against the same expectation. A federated call still presents the
person token.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
It is pre-release; 1.0.0 came from the initial release's breaking-change footers and is yanked from PyPI. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
brightsparc
changed the title
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merged
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
An agent keeps presenting the auth token it holds for a resource until the resource asks for another. The resource then names that auth token's
jtiaspresented_jtiin its resource token, and the agent sends the auth token to its Person Server aspresented_token. The Person Server accepted only a person token there (aa-person+jwt), so every call after the first to one resource was refused with400 invalid_presented_token, "not an aa-person+jwt". The platform's egress works this way, so a trip's second and third bookings failed on staging.The change
PersonServeraccepts as the presented token either a person token or an auth token it issued itself: its own issuer, anddwkaauth-person.json, so not an Access Server's.PresentedExpectation: issuer,audthe resource (trailing slash aside), bound to the agent's key,jtithe resource'spresented_jti, and the samesub,mission_s256andtenant.This is what the data plane did before it adopted the library: it accepted any live token it had issued, checked against the same claims.
Tests
presented_jtidiffers) isinvalid_resource_token.invalid_presented_token.166 tests, coverage 90.3% (floor 88).
Release
introspection-aauthis pre-release, so this releases it as 0.1.0 (release-asinrelease-please-config.json, removed once 0.1.0 is out). The 1.0.0 that the first release cut from its breaking-change footers is deleted from PyPI and GitHub, and its changelog entry goes with it.🤖 Generated with Claude Code