# 配置Agent身份并获取访问令牌 **场景描述** 在企业办公自动化场景中，AI Agent需要访问员工的Microsoft数据，以便自动处理邮件分类、文件整理等任务，这涉及到复杂的OAuth 2.0授权流程。 本示例展示如何通过AgentIdentity简化Agent访问Microsoft的开发复杂度，让开发者无需关心OAuth 2.0的底层细节。 **总体思路** 1. 为Agent创建工作负载身份。 2. 配置Microsoft OAuth2凭证。 3. 获取工作负载访问令牌。 4. 获取Microsoft访问令牌。 涉及的接口如下： - [创建工作负载身份](https://support.huaweicloud.com/api-agentidentity/CreateWorkloadIdentity.html) - [创建OAuth2凭证提供商](https://support.huaweicloud.com/api-agentidentity/CreateOauth2CredentialProvider.html) - [使用用户ID创建工作负载访问令牌（以用户身份操作）](https://support.huaweicloud.com/api-agentidentity/CreateWorkloadAccessTokenForUserId.html) - [从资源凭证提供商处获取OAuth 2.0令牌](https://support.huaweicloud.com/api-agentidentity/GetResourceOauth2Token.html) **步骤1：创建工作负载身份** URI：POST /v1/workload-identities API文档详情请参见：[创建工作负载身份](https://support.huaweicloud.com/api-agentidentity/CreateWorkloadIdentity.html) - 请求示例： ``` POST https://{endpoint}/v1/workload-identities { "name": "my_workload_identity", "allowed_resource_oauth2_return_urls": [ "https://example.com/oauth2/callback" ], "authorizer_type": "CUSTOM_JWT", "authorizer_configuration": { "custom_jwt": { "discovery_url": "https://example.com/.well-known/openid-configuration", "allowed_audience": ["example-audience"], "allowed_clients": ["example-client-id"], "allowed_scopes": ["read","write"], "custom_claims": [ { "inbound_token_claim_name": "tenant", "inbound_token_claim_value_type": "STRING", "authorizing_claim_match_value": { "claim_match_operator": "EQUALS", "claim_match_value": {"match_value_string": "acme"} } } ] } } } ``` - 响应示例： ``` { "workload_identity": { "workload_identity_id": "684a2c3e5f1b9d0e7a3c4f56", "name": "my_workload_identity", "urn": "agentIdentity:::workloadIdentity:workloadIdentityDirectory//", "authorizer_type": "CUSTOM_JWT", "api_key_secret": null, "allowed_resource_oauth2_return_urls": [ "https://example.com/oauth2/callback" ], "created_by": {"type": "SERVICE","identifier": "service.AgentRuntime"}, "created_at": "2025-12-01T08:00:00Z", "updated_at": "2025-12-01T08:00:00Z", "tags": null } } ``` **步骤2：创建Microsoft OAuth2凭证提供商** URI：POST /v1/oauth2-credential-providers API文档详情请参见：[创建OAuth2凭证提供商](https://support.huaweicloud.com/api-agentidentity/CreateOauth2CredentialProvider.html) - 请求示例： ``` POST https://{endpoint}/v1/oauth2-credential-providers { "name": "my_microsoft_oauthprovider", "credential_provider_vendor": "MicrosoftOauth2", "oauth2_provider_config_input": { "microsoft_oauth2_provider_config": { "client_id": "285634f5-5958-4f36-b171-168305215bce", "client_secret": "28365081388-oovo6094eg8opo187jn0mstj8s2cevku", "tenant_id": "285634f5-5958-4f36-b171-168305215bce" } } } ``` - 响应示例： ``` { "credential_provider": { "credential_provider_id": "684a2c3e5f1b9d0e7a3c4f56", "name": "my_microsoft_oauthprovider", "urn": "agentIdentity:::oauth2CredentialProvider:tokenVault//", "credential_provider_vendor": "MicrosoftOauth2", "client_secret": { "secret_id": "285624f5-5958-4f36-b171-168303615bce", "secret_name": "test-secret" }, "callback_url": "https://agent-identity.cn-north-4.myhuaweicloud.com/v1/oauth2/callback/9c38be75-5973-4709-a211-7e2c438c250d", "created_at": "2025-12-01T08:00:00Z", "updated_at": "2025-12-01T08:00:00Z", "oauth2_provider_config_output": { "microsoft_oauth2_provider_config": { "oauth2_discovery": { "discovery_url": "https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration", "authorization_server_metadata": null }, "client_id": "285624f5-5958-4f36-b171-168303615bce" }, "google_oauth2_provider_config": null, "github_oauth2_provider_config": null, "custom_oauth2_provider_config": null }, "tags": null } } ``` 注：需在 Microsoft Entra ID 中完成配置，将回调地址添加为应用的 Redirect URI。 **步骤3：获取工作负载访问令牌** URI：POST /v1/workload-access-token-for-user-id API文档详情请参见：[使用用户ID创建工作负载访问令牌（以用户身份操作）](https://support.huaweicloud.com/api-agentidentity/CreateWorkloadAccessTokenForUserId.html) - 请求示例： ``` POST https://{endpoint}/v1/workload-access-token-for-user-id { "workload_name" : "my_workload_identity", "user_id" : "user-12345" } ``` - 响应示例： ``` { "workload_access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...", "expiration": "2025-12-31T23:59:59Z" } ``` 在三种获取工作负载访问令牌的方法中，/v1/workload-access-token（不带用户）签出的WAT不能用于USER_FEDERATION流程；USER_FEDERATION必须使用-for-user-id或-for-jwt。 **步骤4：获取Microsoft访问令牌** URI：POST /v1/oauth2/token API文档详情请参见：[从资源凭证提供商处获取OAuth 2.0令牌](https://support.huaweicloud.com/api-agentidentity/GetResourceOauth2Token.html) - 请求示例： ``` POST https://{endpoint}/v1/oauth2/token { "custom_state": "string", "force_authentication": false, "oauth2_flow": "USER_FEDERATION", "resource_credential_provider_name": "my_microsoft_oauthprovider", "scopes": ["openid", "email", "profile"], "workload_access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..." } ``` - 响应示例（首次调用，USER_FEDERATION）： ``` { "authorization_url": "https://{endpoint}/v1/oauth2/authorize?request_uri=urn%3Aietf%3Aparams%3Aoauth%3Arequest_uri%3A8f14e45f...", "session_status": "IN_PROGRESS", "session_uri": "urn:ietf:params:oauth:request_uri:abc123" } ``` Agent 收到首次响应后，将 authorization_url 提供给最终用户，用户在浏览器中打开该链接，登录 Microsoft 账号并同意授权。授权完成后，系统自动完成令牌交换。Agent 携带首次返回的 session_uri 和相同的工作负载访问令牌轮询本接口，待 session_status 变为 SUCCEEDED 后，即可获取 access_token。 - 请求示例（授权后调用，USER_FEDERATION）： ``` POST https://{endpoint}/v1/oauth2/token { "custom_state": "string", "force_authentication": false, "oauth2_flow": "USER_FEDERATION", "resource_credential_provider_name": "my_microsoft_oauthprovider", "workload_access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...", "session_uri": "urn:ietf:params:oauth:request_uri:abc123" } ``` - 响应示例（用户已完成授权）： ``` { "session_uri": "urn:ietf:params:oauth:request_uri:abc123", "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...", "expires_at": "2025-12-31T23:59:59Z" } ``` 可根据session_status判断流程状态：IN_PROGRESS表示等待用户授权，可间隔数秒后重新轮询；SUCCEEDED表示授权完成，使用access_token访问Microsoft服务；FAILED表示授权失败（如用户取消授权），需重新发起。Agent获取到访问令牌后，可在令牌有效期内使用该令牌访问Microsoft服务，例如调用 Microsoft Graph 查询邮件： ``` GET https://graph.microsoft.com/v1.0/me/messages Authorization: Bearer ```