Skip to content

Commit be70f2e

Browse files
RovinKYKRovinKYK
committed
Fix vale lint issues
1 parent c165a9e commit be70f2e

7 files changed

Lines changed: 23 additions & 17 deletions

File tree

‎.vale/styles/config/vocabularies/vocab/accept.txt‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,3 +76,7 @@ access_token
7676
expires_in
7777
refresh_token
7878
id_token
79+
subject_token
80+
actor_token
81+
actor_token_type
82+
api_base_path

‎en/asgardeo/docs/guides/authorization/delegation.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
{% set base_url = "https://api.asgardeo.io/t/<organization_name>" %}
2-
{% set base_url_sample = "https://api.asgardeo.io/t/bifrost" %}
1+
{% set base_url = "https://api.asgardeo.io/t/{organization_name}" %}
32

43
{% include "../../../../includes/guides/authorization/delegation.md" %}

‎en/identity-server/next/docs/guides/authorization/delegation.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
11
{% set base_url = "https://localhost:9443" %}
2-
{% set base_url_sample = "https://localhost:9443" %}
32

43
{% include "../../../../../includes/guides/authorization/delegation.md" %}

‎en/includes/guides/agentic-ai/ai-agents/agent-authentication.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -242,7 +242,7 @@ The flow proceeds as follows:
242242

243243
### Using token exchange for on-behalf-of delegation
244244

245-
When an agent obtains a token issued for the user, the [token exchange grant]({{base_path}}/guides/authentication/configure-token-exchange/) can add the agent as the acting party without any new user interaction. The agent presents the token it obtained through its own authentication flow as an `actor_token` alongside the user's token, and {{ product_name }} issues a token that carries the user in `sub` and the agent in the `act` claim. Successive exchanges nest the `act` claim, so a chain of agents remains traceable in a single token.
245+
When an agent receives a token issued for the user, the [token exchange grant]({{base_path}}/guides/authentication/configure-token-exchange/) can add the agent as the acting party without any new user interaction. The agent presents its own `actor_token` alongside the user's token, and {{ product_name }} issues a token that carries the user in `sub` and the agent in the `act` claim. Successive exchanges nest the `act` claim, so a chain of agents remains traceable in a single token.
246246

247247
For instructions, see [Token exchange for AI agents]({{base_path}}/guides/agentic-ai/ai-agents/token-exchange-for-agents/).
248248

‎en/includes/guides/agentic-ai/ai-agents/token-exchange-for-agents.md‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,9 @@
22
# Token Exchange for AI Agents
33
<!-- vale on -->
44

5-
This guide walks you through how an AI agent can act on behalf of a user by exchanging a token that the user already holds, using the [token exchange grant]({{base_path}}/guides/authentication/configure-token-exchange/), as defined in the [OAuth 2.0 Token Exchange specification (RFC 8693)](https://datatracker.ietf.org/doc/html/rfc8693). The issued token identifies the user in the `sub` claim and records the agent as the acting party in the `act` claim, so resource servers can see both identities in a single token.
5+
This guide walks you through how an AI agent can act on behalf of a user by exchanging a token that the user already holds. The flow uses the [token exchange grant]({{base_path}}/guides/authentication/configure-token-exchange/), as defined in the [OAuth 2.0 Token Exchange specification (RFC 8693)](https://datatracker.ietf.org/doc/html/rfc8693).
6+
7+
The issued token identifies the user in the `sub` claim and records the agent as the acting party in the `act` claim. A resource server can then see both identities in a single token.
68

79
!!! note "Agent friendly delegation mechanism"
810
- This flow does **not use redirects** and needs **no new user interaction**.
@@ -93,15 +95,15 @@ The request contains the following delegation parameters:
9395
<th>Description</th>
9496
</tr>
9597
<tr>
96-
<td>subject_token</td>
98+
<td><code>subject_token</code></td>
9799
<td>A JWT token that identifies the user on whose behalf the agent acts.</td>
98100
</tr>
99101
<tr>
100-
<td>actor_token</td>
102+
<td><code>actor_token</code></td>
101103
<td>A JWT token issued by {{ product_name }} for the agent.</td>
102104
</tr>
103105
<tr>
104-
<td>actor_token_type</td>
106+
<td><code>actor_token_type</code></td>
105107
<td>Should be <code>urn:ietf:params:oauth:token-type:access_token</code> or
106108
<code>urn:ietf:params:oauth:token-type:jwt</code>.</td>
107109
</tr>
@@ -140,6 +142,6 @@ When an agent hands a task to another agent, the second agent exchanges the dele
140142
}
141143
```
142144

143-
The most recent agent appears at the top level of the chain. {{ product_name }} carries the existing chain forward unchanged when the request presents no actor token, so an agent that re-exchanges a token it received can't alter the chain behind it.
145+
The most recent agent appears at the top level of the chain. When the request presents no actor token, {{ product_name }} carries the existing chain forward unchanged. An agent that re-exchanges a token it received can't alter the chain behind it.
144146

145147
To learn more about the delegation model and the `act` claim, see [Delegation]({{base_path}}/guides/authorization/delegation/).

‎en/includes/guides/authentication/configure-token-exchange.md‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,9 @@ To register a trusted token issuer:
119119

120120
You can use the following properties to customize how token exchange occurs for identities with local user accounts.
121121

122+
<!-- vale WSO2-IAM.TooWordy = NO -->
122123
##### Prioritize local account attributes
124+
<!-- vale WSO2-IAM.TooWordy = YES -->
123125

124126
After enabling this configuration, {{ product_name }} includes the local user profile information in the exchanged token if the federated identity has a linked local user account. Otherwise, {{ product_name }} returns the profile information received directly from the federated identity.
125127

@@ -136,7 +138,7 @@ To prioritize linked local account attributes:
136138

137139
##### Implicit account linking
138140

139-
You can use implicit account linking capability in the registered trusted token issuer to automatically create an account link between a local user account in {{ product_name }} and a federated identity during token exchange.
141+
You can use implicit account linking in the registered trusted token issuer to create an account link automatically. The link connects a local user account in {{ product_name }} with a federated identity during token exchange.
140142

141143
You can configure lookup attributes to search for a matching local user account. If the system finds a matching account, {{ product_name }} automatically links the local user account to the federated identity.
142144

@@ -183,7 +185,7 @@ You can configure implicit account linking using the
183185

184186
Follow the steps given below.
185187

186-
1. Obtain the JWT token received from the third-party token issuer.
188+
1. Get the JWT token received from the third-party token issuer.
187189
2. Execute the following cURL command to exchange the federated token for an {{ product_name }} token.
188190

189191
``` bash
@@ -240,7 +242,7 @@ To configure the subject token application:
240242

241243
Follow the steps given below.
242244

243-
1. Obtain a JWT access token for the subject token application.
245+
1. Get a JWT access token for the subject token application.
244246
2. Execute the following cURL command to exchange the token for a new {{ product_name }} token.
245247

246248
``` bash

‎en/includes/guides/authorization/delegation.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Delegation
22

3-
Delegation lets an application obtain a token for a user while preserving the identity of the party that acts on the user's behalf. {{ product_name }} implements delegation with the [token exchange grant]({{base_path}}/guides/authentication/configure-token-exchange/), as defined in the [OAuth 2.0 Token Exchange specification (RFC 8693)](https://datatracker.ietf.org/doc/html/rfc8693){:target="_blank"}.
3+
Delegation lets an application get a token for a user while preserving the identity of the party that acts on the user's behalf. {{ product_name }} implements delegation with the [token exchange grant]({{base_path}}/guides/authentication/configure-token-exchange/), as defined in the [OAuth 2.0 Token Exchange specification (RFC 8693)](https://datatracker.ietf.org/doc/html/rfc8693){:target="_blank"}.
44

55
The exchanged token identifies the user in the `sub` claim and the acting party in the `act` claim. When a delegated token is exchanged again, {{ product_name }} nests the previous `act` claim under the new one, so a single token carries the full delegation chain.
66

@@ -10,9 +10,9 @@ Before you request a delegated token:
1010

1111
- Enable the token exchange grant for the application that requests the token, as described in [Enable token exchange in your app]({{base_path}}/guides/authentication/configure-token-exchange/#enable-token-exchange-in-your-app).
1212

13-
- Obtain the subject token, as described in [Token exchange flows]({{base_path}}/guides/authentication/configure-token-exchange/#token-exchange-flows). The subject token identifies the user on whose behalf the new token is issued.
13+
- Get the subject token, as described in [Token exchange flows]({{base_path}}/guides/authentication/configure-token-exchange/#token-exchange-flows). The subject token identifies the user on whose behalf the new token is issued.
1414

15-
- Obtain a JWT token for the acting user from {{ product_name }}. This is the actor token.
15+
- Get a JWT token for the acting user from {{ product_name }}. This is the actor token.
1616

1717
To request a delegated token, send both tokens to the token endpoint.
1818

@@ -35,11 +35,11 @@ The request contains the following delegation parameters:
3535

3636
<table>
3737
<tr>
38-
<td>actor_token</td>
38+
<td><code>actor_token</code></td>
3939
<td>A JWT token issued by {{ product_name }} for the acting user.</td>
4040
</tr>
4141
<tr>
42-
<td>actor_token_type</td>
42+
<td><code>actor_token_type</code></td>
4343
<td>Should be <code>urn:ietf:params:oauth:token-type:access_token</code> or
4444
<code>urn:ietf:params:oauth:token-type:jwt</code>.</td>
4545
</tr>

0 commit comments

Comments
 (0)