Authorization Code (3LO)

Entra-inbound · GitHub-outbound · AgentCore Gateway

1. Sign in with Microsoft Entra ID

Checking session…

Transcript

Query / response history, in browser memory only. Reload clears it. No tokens, URLs, session IDs, or headers are recorded.

    Safe token summary

    Derived, allowlisted fields only — never the raw token.

    present
    —
    type
    —
    issuer
    —
    audience
    —
    scopes
    —
    expiresAt
    —
    fingerprint
    —

    End-to-end sequence

    Entra ID to GitHub: complete 3LO authorization flow

    Inbound authentication and outbound authorization are separate OAuth flows. AgentCore validates the Entra identity, then manages GitHub consent and credentials without exposing either access token to the browser.

    Checking current session state…

    Entra ID to GitHub 3LO OAuth sequence A dynamic sequence diagram showing the user, 3LO UI, Microsoft Entra ID, AgentCore Gateway, outbound authorization, Token Vault, Consent Portal, GitHub OAuth, and GitHub MCP API across thirteen events. 1. Sign in with Entra ID idle 2. /authorize · code flow idle 3. Authorization code idle 4. Redeem code /token Entra JWT → server session idle 5. MCP tool call + Entra JWT idle 6. Check GitHub credential -32042 · authorization required idle 7. Open short-lived Consent Portal URL idle 8. Approve GitHub scopes Authorization code callback idle 9. Exchange and store GitHub token idle 10. Retry GitHub operation idle 11. Retrieve managed credential Attach token to target call idle 12. get_me / search_repositories idle 13. Sanitized GitHub result through Gateway and UI idle

    Scroll horizontally on smaller screens to follow every actor and message.

    Token boundary: the Entra JWT remains in the UI server session and the GitHub token remains in AgentCore Token Vault. The browser receives an opaque session cookie, the short-lived consent navigation, and the sanitized tool result — never either access token.

    3LO architecture & token flow

    Node state reflects this browser session's direct evidence. Internal AgentCore token nodes stay managed, never browser-observed.

    Security artifacts

    Presence and state of each security control — never the value. Tokens, headers, session IDs, and the authorization URL are shown as hidden, by state, or by a keyed hmac-sha256: fingerprint. Header NAMES only.

    Entra JWT
    —
    hidden
    Gateway bearer header
    —
    hidden
    MCP session ID
    —
    hidden
    Token Vault / GitHub token
    —
    hidden
    CSRF
    —
    hidden
    Server session
    —
    hidden
    Authorization URL
    —
    hidden
    Model reasoning
    —
    not applicable — direct MCP tool call