接入你已有的 IdP 与网关

+-- Your own Linux environment (air-gap capable, no outbound callback) --------+
|                                                                              |
|   +------------+     OIDC federation    +------------------------------+     |
|   | Your IdP    |<----------------------| AgentPAM control plane        |     |
|   | Okta/Entra |   (consumes assertions only)  | /authorize /token  AS+STS |     |
|   +-----+------+                        | PDP  AuthZEN / COAZ       |     |
|         | human SSO (Tu)                | Credential broker  RFC 8693 |     |
|   +-----v------+   ext_authz / AS       | Audit sink                   |     |
|   | Your MCP    |<--------------------->| JWKS (independent HA)        |     |
|   | gateway    |   inject cred (Tup)    +------------------------------+     |
|   | (RS)       |                                                             |
|   +-----+------+                                                             |
|         | inject short-lived credential                                       |
|   +-----v------+                                                             |
|   | Sensitive  |  <- remote / internal, NOT a laptop                          |
|   | API/server |                                                             |
|   +------------+                                                             |
+------------------------------------------------------------------------------+
        ^ agent holds Ts (session token, DPoP, 5-15 min)
   +----+-----+
   | AI Agent |  managed workstation / VDI  (agent is on the endpoint,
   | Claude   |  but the MCP server is not)
   +----------+

# 1) the gateway publishes protected resource metadata (RFC 9728)
#    GET /.well-known/oauth-protected-resource ->
mcpAuthentication:
  issuer: https://agentpam.customer.internal       # points at us
  audiences: [ "https://mcp.customer.internal" ]   # * MANDATORY in agentgateway
  jwksUri: https://agentpam.customer.internal/.well-known/jwks.json

# 2) upstream credential injection: the gateway exchanges for Tup, the agent never sees it
backendAuth:
  oauthTokenExchange:
    path: /token                                   # * local YAML key is 'path', NOT tokenEndpointPath
    grantType: urn:ietf:params:oauth:grant-type:token-exchange

# Envoy ext_authz -> our PDP
http_filters:
- name: envoy.filters.http.ext_authz
  typed_config:
    grpc_service:
      envoy_grpc: { cluster_name: agentpam_pdp }   # points at our PDP
    with_request_body:                             # * pass body so we see MCP method/tool
      max_request_bytes: 8192
      allow_partial_message: true

--- our PDP interface (AuthZEN / COAZ-MCP compatible) ---
POST /pdp/evaluate
{
  "subject":  { "id": "u_dana", "type": "human" },        # the human
  "context":  { "agent": "agent_support_7f3a",            # agent, 2nd dimension (COAZ)
                "task": "task_88213" },
  "action":   { "name": "tools/call", "tool": "payments.refund" },
  "resource": { "server": "payments", "args": { "amount": 120 } }
}
-> 200 { "decision": true,
        "obligations": ["audit:high"],
        "headers": { "Authorization": "Bearer <Tup short-lived>" } }  # injected on allow