ServiceNow on-behalf-of token exchange with Bedrock AgentCore Gateway
aws ·
This AWS blog post details how to configure Amazon Bedrock AgentCore Gateway for on-behalf-of (OBO) token exchange with Microsoft Entra ID to securely connect AI agents to ServiceNow. The solution ensures that user identity is preserved throughout the request chain, allowing API calls to respect user-level access controls and maintain audit trails. By using the OBO flow, AgentCore Gateway exchanges an agent's JWT for a new token scoped to the ServiceNow API connector while retaining the original user's claims. The architecture involves configuring application registrations in Entra ID, setting up inbound OAuth integrations in ServiceNow, and defining outbound authentication within the gateway. This native support eliminates the need for custom Lambda interceptors, simplifying the implementation of secure, identity-preserving agent interactions with enterprise REST APIs.
aws