Add tutorial: OpenAI Workload Identity integration with Agent ID - #6281
Open
sajitha-tj wants to merge 3 commits into
Open
Add tutorial: OpenAI Workload Identity integration with Agent ID#6281sajitha-tj wants to merge 3 commits into
sajitha-tj wants to merge 3 commits into
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (3)
📝 WalkthroughWalkthroughChangesThe documentation adds an OpenAI workload identity federation tutorial across Asgardeo and Identity Server versions, wires it into navigation, and updates Claude authentication examples and endpoint placeholders. Agent authentication documentation
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@en/identity-server/7.2.0/docs/tutorials/agent-id-claude-authentication.md`:
- Line 2: Update api_base_path in
en/identity-server/7.2.0/docs/tutorials/agent-id-claude-authentication.md:2,
en/identity-server/7.3.0/docs/tutorials/agent-id-claude-authentication.md:2, and
en/identity-server/next/docs/tutorials/agent-id-claude-authentication.md:2 to
use the complete HTTPS placeholder https://<your-domain>.
In `@en/includes/tutorials/agent-id-openai-authentication.md`:
- Around line 147-183: Update token_provider to support Python 3.9 by importing
Optional and replacing the str | None annotation for cached_token with
Optional[str]. Replace the scopes list default with None, annotate it
appropriately, and initialize the scopes list inside token_provider when no
value is provided.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro
Run ID: 198de691-2796-489f-8912-25c8b8062b8e
📒 Files selected for processing (17)
en/asgardeo/docs/tutorials/agent-id-openai-authentication.mden/asgardeo/docs/tutorials/index.mden/asgardeo/mkdocs.ymlen/identity-server/7.2.0/docs/tutorials/agent-id-claude-authentication.mden/identity-server/7.2.0/docs/tutorials/agent-id-openai-authentication.mden/identity-server/7.2.0/docs/tutorials/index.mden/identity-server/7.2.0/mkdocs.ymlen/identity-server/7.3.0/docs/tutorials/agent-id-claude-authentication.mden/identity-server/7.3.0/docs/tutorials/agent-id-openai-authentication.mden/identity-server/7.3.0/docs/tutorials/index.mden/identity-server/7.3.0/mkdocs.ymlen/identity-server/next/docs/tutorials/agent-id-claude-authentication.mden/identity-server/next/docs/tutorials/agent-id-openai-authentication.mden/identity-server/next/docs/tutorials/index.mden/identity-server/next/mkdocs.ymlen/includes/tutorials/agent-id-claude-authentication.mden/includes/tutorials/agent-id-openai-authentication.md
| @@ -1,4 +1,4 @@ | |||
| {% set product_name = "WSO2 Identity Server" %} | |||
| {% set api_base_path = "https://localhost:9443" %} | |||
| {% set api_base_path = "<your-domain>" %} | |||
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Use a complete HTTPS URL for api_base_path.
The shared tutorial uses this value for Python base_url and OAuth/JWKS endpoint construction. The current hostname-only placeholder generates invalid URLs; use https://<your-domain> in every Identity Server wrapper.
en/identity-server/7.2.0/docs/tutorials/agent-id-claude-authentication.md#L2-L2: change the placeholder tohttps://<your-domain>.en/identity-server/7.3.0/docs/tutorials/agent-id-claude-authentication.md#L2-L2: change the placeholder tohttps://<your-domain>.en/identity-server/next/docs/tutorials/agent-id-claude-authentication.md#L2-L2: change the placeholder tohttps://<your-domain>.
Proposed fix
-{% set api_base_path = "<your-domain>" %}
+{% set api_base_path = "https://<your-domain>" %}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| {% set api_base_path = "<your-domain>" %} | |
| {% set api_base_path = "https://<your-domain>" %} |
📍 Affects 3 files
en/identity-server/7.2.0/docs/tutorials/agent-id-claude-authentication.md#L2-L2(this comment)en/identity-server/7.3.0/docs/tutorials/agent-id-claude-authentication.md#L2-L2en/identity-server/next/docs/tutorials/agent-id-claude-authentication.md#L2-L2
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@en/identity-server/7.2.0/docs/tutorials/agent-id-claude-authentication.md` at
line 2, Update api_base_path in
en/identity-server/7.2.0/docs/tutorials/agent-id-claude-authentication.md:2,
en/identity-server/7.3.0/docs/tutorials/agent-id-claude-authentication.md:2, and
en/identity-server/next/docs/tutorials/agent-id-claude-authentication.md:2 to
use the complete HTTPS placeholder https://<your-domain>.
Comment on lines
+147
to
+183
| import asyncio | ||
| import time | ||
| from asgardeo import AsgardeoConfig | ||
| from asgardeo_ai import AgentAuthManager, AgentConfig | ||
| from openai import OpenAI | ||
| from openai.auth import SubjectTokenProvider | ||
|
|
||
| # {{product_name}} configuration | ||
| config = AsgardeoConfig( | ||
| base_url="{{ api_base_path }}", | ||
| client_id="<your-client-id>", | ||
| client_secret="<your-client-secret>", | ||
| redirect_uri="<your-redirect-uri>", | ||
| ) | ||
|
|
||
| # Agent credentials | ||
| agent_config = AgentConfig( | ||
| agent_id="<your-agent-id>", | ||
| agent_secret="<your-agent-secret>", | ||
| ) | ||
|
|
||
| def token_provider( | ||
| identity_provider_config: AsgardeoConfig, | ||
| agent_cfg: AgentConfig, | ||
| scopes=["openid", "profile"] | ||
| ) -> SubjectTokenProvider: | ||
| """ | ||
| Provide JWT access token from {{product_name}} to OpenAI WIF. | ||
|
|
||
| It caches the token and refreshes automatically when expired. | ||
| The OpenAI SDK calls this function whenever it needs a | ||
| new token for the WIF exchange. | ||
| """ | ||
|
|
||
| EXPIRY_BUFFER_SECONDS = 60 | ||
| cached_token : str | None = None | ||
| token_expiry : float = 0 |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Fix Python 3.9 compatibility and mutable default argument.
- The
str | Noneunion type syntax requires Python 3.10+ (PEP 604), but the prerequisites state Python 3.9+. Using this in Python 3.9 will cause aSyntaxError. Please useOptional[str]from thetypingmodule instead. - Avoid using mutable objects (like lists) as default arguments in Python. Because the default object is evaluated once and shared across all calls, it can lead to unexpected behavior. Use
Noneinstead and initialize the list inside the function.
💡 Proposed fixes
import asyncio
import time
+from typing import Optional
from asgardeo import AsgardeoConfig
from asgardeo_ai import AgentAuthManager, AgentConfig
from openai import OpenAI
from openai.auth import SubjectTokenProvider
# ... [snip] ...
def token_provider(
identity_provider_config: AsgardeoConfig,
agent_cfg: AgentConfig,
- scopes=["openid", "profile"]
+ scopes=None
) -> SubjectTokenProvider:
"""
Provide JWT access token from {{product_name}} to OpenAI WIF.
It caches the token and refreshes automatically when expired.
The OpenAI SDK calls this function whenever it needs a
new token for the WIF exchange.
"""
+ if scopes is None:
+ scopes = ["openid", "profile"]
EXPIRY_BUFFER_SECONDS = 60
- cached_token : str | None = None
+ cached_token : Optional[str] = None
token_expiry : float = 0📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| import asyncio | |
| import time | |
| from asgardeo import AsgardeoConfig | |
| from asgardeo_ai import AgentAuthManager, AgentConfig | |
| from openai import OpenAI | |
| from openai.auth import SubjectTokenProvider | |
| # {{product_name}} configuration | |
| config = AsgardeoConfig( | |
| base_url="{{ api_base_path }}", | |
| client_id="<your-client-id>", | |
| client_secret="<your-client-secret>", | |
| redirect_uri="<your-redirect-uri>", | |
| ) | |
| # Agent credentials | |
| agent_config = AgentConfig( | |
| agent_id="<your-agent-id>", | |
| agent_secret="<your-agent-secret>", | |
| ) | |
| def token_provider( | |
| identity_provider_config: AsgardeoConfig, | |
| agent_cfg: AgentConfig, | |
| scopes=["openid", "profile"] | |
| ) -> SubjectTokenProvider: | |
| """ | |
| Provide JWT access token from {{product_name}} to OpenAI WIF. | |
| It caches the token and refreshes automatically when expired. | |
| The OpenAI SDK calls this function whenever it needs a | |
| new token for the WIF exchange. | |
| """ | |
| EXPIRY_BUFFER_SECONDS = 60 | |
| cached_token : str | None = None | |
| token_expiry : float = 0 | |
| import asyncio | |
| import time | |
| from typing import Optional | |
| from asgardeo import AsgardeoConfig | |
| from asgardeo_ai import AgentAuthManager, AgentConfig | |
| from openai import OpenAI | |
| from openai.auth import SubjectTokenProvider | |
| # {{product_name}} configuration | |
| config = AsgardeoConfig( | |
| base_url="{{ api_base_path }}", | |
| client_id="<your-client-id>", | |
| client_secret="<your-client-secret>", | |
| redirect_uri="<your-redirect-uri>", | |
| ) | |
| # Agent credentials | |
| agent_config = AgentConfig( | |
| agent_id="<your-agent-id>", | |
| agent_secret="<your-agent-secret>", | |
| ) | |
| def token_provider( | |
| identity_provider_config: AsgardeoConfig, | |
| agent_cfg: AgentConfig, | |
| scopes=None | |
| ) -> SubjectTokenProvider: | |
| """ | |
| Provide JWT access token from {{product_name}} to OpenAI WIF. | |
| It caches the token and refreshes automatically when expired. | |
| The OpenAI SDK calls this function whenever it needs a | |
| new token for the WIF exchange. | |
| """ | |
| if scopes is None: | |
| scopes = ["openid", "profile"] | |
| EXPIRY_BUFFER_SECONDS = 60 | |
| cached_token : Optional[str] = None | |
| token_expiry : float = 0 |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@en/includes/tutorials/agent-id-openai-authentication.md` around lines 147 -
183, Update token_provider to support Python 3.9 by importing Optional and
replacing the str | None annotation for cached_token with Optional[str]. Replace
the scopes list default with None, annotate it appropriately, and initialize the
scopes list inside token_provider when no value is provided.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Adding a step by step tutorial that describes how to integrate OpenAI Workload Identity Federation (WIF) with Agent ID and use that to call OpenAI APIs. Also fixed some issues in the Claude WIF integration tutorial.
Related Issues
Test environment
Security checks