Merge pull request #81 from Alan-Cha/main

Fetch SVID as CLIENT_ID

Author: mrsabath

a2a/slack_researcher/README.md

@@ -10,33 +10,29 @@ The Slack Researcher Agent is designed to perform research tasks across Slack ch
 
 ### Configuration Variables
 
-| Variable Name | Description | Required? | Default Value | 
-|---------------|-------------|-----------|---------------| 
-| LLM_API_BASE | The URL for OpenAI compatible API | Yes | `http://localhost:11434/v1` | 
+| Variable Name | Description | Required? | Default Value |
+|---------------|-------------|-----------|---------------|
+| LLM_API_BASE | The URL for OpenAI compatible API | Yes | `http://localhost:11434/v1` |
 | LLM_API_KEY | The API key for OpenAI compatible API | No |  `my_api_key` |
-| TASK_MODEL_ID | The ID of the LLM | Yes | `granite3.3:8b` | 
-| EXTRA_HEADERS | Extra headers for the OpenAI API, e.g. {"MY_HEADER": "my_value"} | No | `{}` | 
-| MODEL_TEMPERATURE | The temperature for the model | Yes | `0` | 
-| MAX_PLAN_STEPS | The maximum number of plan steps | Yes | `6` | 
-| MCP_URL | Endpoint where the Slack MCP server can be found | No |  "" | 
+| TASK_MODEL_ID | The ID of the LLM | Yes | `granite3.3:8b` |
+| EXTRA_HEADERS | Extra headers for the OpenAI API, e.g. {"MY_HEADER": "my_value"} | No | `{}` |
+| MODEL_TEMPERATURE | The temperature for the model | Yes | `0` |
+| MAX_PLAN_STEPS | The maximum number of plan steps | Yes | `6` |
+| MCP_URL | Endpoint where the Slack MCP server can be found | No |  "" |
 | SERVICE_PORT | Port on which the service will run | Yes | `8000` |
 | LOG_LEVEL | Application log level | No | DEBUG |
 | JWKS_URL | Endpoint to obtain JWKS for token validation. Enables token validation | No | - |
 | ISSUER | Expected `iss` value of incoming bearer tokens | No | - |
-| AUDIENCE | Expected `aud` value of incoming bearer tokens | No | - |
 | TOKEN_URL | Endpoint to perform token exchange. Required for token exchange. | No | - |
-| CLIENT_ID | Client ID to authenticate to auth server with. Required for token exchange. | No | - |
+| CLIENT_ID | Client ID to authenticate to auth server with. Required for token exchange. Expected `aud` value of incoming bearer tokens | No | - |
 | CLIENT_SECRET | Client secret to authenticate to auth server with. Required for token exchange. | No | - |
-| TARGET_AUDIENCE | Audience of token exchanged token | No | - |
 | TARGET_SCOPES | Requested scopes of token exchanged token | No | - |
 
 > **Note on Authorization configuration**
-> By default, no token validation is performed. To enable token validation, set `JWKS_URL`. 
-> If `ISSUER` is additionally set, the `iss` claim will be checked to equal this value. 
-> If `AUDIENCE` is additionally set, the `aud` claim will be checked to equal this value. 
-> If all of `TOKEN_URL`, `CLIENT_ID`, and `CLIENT_SECRET` are set in addition, token exchange will be performed using Bearer tokens from incoming requests, to send to the MCP endpoint. 
-> In addition to `TOKEN_URL`, `CLIENT_ID`, `CLIENT_SECRET`, which trigger token exchange, `TARGET_AUDIENCE` and `TARGET_SCOPES` can be optionally configured as the values of `audience` and `scope` in the token exchange request, respectively. 
-
+> By default, no token validation is performed. To enable token validation, set `JWKS_URL`.
+> If `ISSUER` is additionally set, the `iss` claim will be checked to equal this value.
+> If all of `TOKEN_URL`, `CLIENT_ID`, and `CLIENT_SECRET` are set in addition, token exchange will be performed using Bearer tokens from incoming requests, to send to the MCP endpoint.
+> In addition to `TOKEN_URL`, `CLIENT_ID`, `CLIENT_SECRET`, which trigger token exchange, `TARGET_SCOPES` can be optionally configured to be the `scope` in the token exchange request.
 
 ## Running in Kagenti
 When deploying in the Kagenti UI - You will need to attach 3 environments to the agent deployment:
@@ -47,4 +43,4 @@ When deploying in the Kagenti UI - You will need to attach 3 environments to the
 2. `mcp-slack` - This provides the value of the slack MCP server (`MCP_URL`)
 3. `slack-researcher` - This provides the remainder of the necessary configuration settings
 
-NOTE if you are connecting to a tool that is OAuth-secured, you MUST set the `JWKS_URL` variable or the token will not be passed to the tool. 
+NOTE if you are connecting to a tool that is OAuth-secured, you MUST set the `JWKS_URL` variable or the token will not be passed to the tool.

a2a/slack_researcher/a2a_agent.py

@@ -166,7 +166,6 @@ async def execute(self, context: RequestContext, event_queue: EventQueue):
 
                 headers = await auth_headers(
                     user_token, 
-                    target_audience=settings.TARGET_AUDIENCE, 
                     target_scopes=settings.TARGET_SCOPES
                 )
 

a2a/slack_researcher/pyproject.toml

@@ -10,6 +10,7 @@ dependencies = [
     "a2a-sdk>=0.2.16",
     "python-keycloak>=5.5.1",
     "authlib>=1.6.0",
+    "PyJWT>=2.10.1",
 ]
 
 [tool.ruff]

a2a/slack_researcher/slack_researcher/auth.py

@@ -42,19 +42,20 @@ def __init__(self):
         self.jwks_url = settings.JWKS_URI
 
         self.claims_options = {}
-        if settings.AUDIENCE is None:
-            logger.debug(f"AUDIENCE env var not set. No audience check will be performed. ")
+
+        if settings.CLIENT_ID is None:
+            logger.debug(f"CLIENT_ID is not set. No audience check will be performed. ")
         else:
-            self.claims_options["aud"] = {"essential": True, "value": settings.AUDIENCE}
+            self.claims_options["aud"] = {"essential": True, "value": settings.CLIENT_ID}
         if settings.ISSUER is None:
-            logger.debug(f"ISSUER env var no set. No issuer check will be performed")
+            logger.debug(f"ISSUER env var not set. No issuer check will be performed")
         else:
             self.claims_options["iss"] = {"essential": True, "value": settings.ISSUER}
 
     async def get_jwks(self):
         logger.debug(f"Fetching JWKS from {self.jwks_url}")
         jwks = None
-        try: 
+        try:
             async with httpx.AsyncClient() as client:
                 response = await client.get(self.jwks_url)
                 response.raise_for_status()
@@ -81,7 +82,7 @@ async def authenticate(self, conn):
         if conn.scope.get("path") == "/.well-known/agent.json":
             logger.debug("Bypassing authentication for public agent card path")
             return None
-        
+
         # extract token
         token = await self.get_token(conn)
         if token is None:
@@ -90,7 +91,7 @@ async def authenticate(self, conn):
         # fetch jwks
         jwks = await self.get_jwks()
 
-        try: 
+        try:
             # decode and validate claims
             claims = jwt.decode(s=token, key=jwks, claims_options=self.claims_options)
             claims.validate()
@@ -140,7 +141,7 @@ async def exchange(self, subject_token: str, audience: str = None, scope: str =
         # make token endpoint call
         logger.debug('Performing token exchange')
         async with httpx.AsyncClient() as client:
-            try: 
+            try:
                 response = await client.post(self.token_url, data=data, headers=headers)
                 response.raise_for_status() # raise exception if Http status error
                 token_data = response.json()
@@ -163,7 +164,7 @@ async def auth_headers(access_token, target_audience = None, target_scopes = Non
         access_token = await token_exchanger.exchange(access_token, audience=target_audience, scope=target_scopes)
     except AuthenticationError as e:
         logging.error(f"Error performing token exchange - returning empty headers: {e}")
-        return headers # 
+        return headers #
     except Exception as e:
         logging.debug(f"Error creating token exchanger - will passthrough token")
 

a2a/slack_researcher/slack_researcher/config.py

@@ -1,20 +1,46 @@
 import json
 import logging
 import os
-import sys
+import jwt
 from pydantic_settings import BaseSettings
 from pydantic import model_validator
 from pydantic import Field
 from typing import Literal, Optional
 
+def get_client_id() -> str:
+    """
+    Read the SVID JWT from file and extract the client ID from the "sub" claim.
+    """
+    # Read SVID JWT from file to get client ID
+    jwt_file_path = "/opt/jwt_svid.token"
+    
+    content = None
+    try:
+        with open(jwt_file_path, "r") as file:
+            content = file.read()
+    except FileNotFoundError:
+        raise Exception(f"SVID JWT file {jwt_file_path} not found.")
+
+    if content is None or content.strip() == "":
+        raise Exception(f"No content in SVID JWT file {jwt_file_path}.")
+
+    try:
+        decoded = jwt.decode(content, options={"verify_signature": False})
+    except jwt.DecodeError:
+        raise ValueError(f"Failed to decode SVID JWT file {jwt_file_path}.")
+
+    try:
+        return decoded["sub"]
+    except KeyError:
+        raise KeyError('SVID JWT is missing required "sub" claim.')
 
 class Settings(BaseSettings):
     # static path for client secret file
     secret_file_path: str = "/shared/secret.txt"
 
     LOG_LEVEL: Literal['DEBUG', 'INFO', 'WARNING', 'ERROR', 'CRITICAL'] = Field(
         os.getenv("LOG_LEVEL", "DEBUG"),
-        description="Application log level",       
+        description="Application log level",
     )
     TASK_MODEL_ID: str = Field(
         os.getenv("TASK_MODEL_ID", "granite3.3:8b"),
@@ -48,28 +74,20 @@ class Settings(BaseSettings):
         os.getenv("JWKS_URI", None),
         description="Endpoint to obtain JWKS from auth server"
     )
-    AUDIENCE: Optional[str] = Field(
-        os.getenv("AUDIENCE", None),
-        description="Expected audience value during resource validation"
-    )
 
     # auth variables for token exchange
     TOKEN_URL: Optional[str] = Field(
         os.getenv("TOKEN_URL", None),
         description="Token endpoint to obtain new access tokens"
     )
     CLIENT_ID: Optional[str] = Field(
-        os.getenv("CLIENT_ID", None),
+        get_client_id(),
         description="Client ID to authenticate to OAuth server"
     )
     CLIENT_SECRET: Optional[str] = Field(
         None,
         description="Client secret to authenticate to OAuth server"
     )
-    TARGET_AUDIENCE: Optional[str] = Field(
-        os.getenv("TARGET_AUDIENCE", None),
-        description="Target audience to request during token exchange"
-    )
     TARGET_SCOPES: Optional[str] = Field(
         os.getenv("TARGET_SCOPES", None),
         description="Target scopes to request during token exchange"
@@ -98,4 +116,4 @@ def validate_extra_headers(self) -> "Settings":
 
         return self
 
-settings = Settings()  # type: ignore[call-arg]
+settings = Settings()  # type: ignore[call-arg]