Skip to content

datarobot_genai.dragent.inbound_token

inbound_token

Where the caller's IdP access token arrives.

One definition, two consumers -- frontends/claim_validation.py validates the token's aud, plugins/okta_a2a_auth.py exchanges it. If they read different headers, a token could skip validation and still be exchanged. Not configurable: the gateway picks the header it forwards, so naming another one would just receive nothing.

Only x-datarobot-external-access-token carries an IdP token. The gateway populates it with the external token it has already validated, so a value there is an IdP token by construction. authorization carries DataRobot's own credentials instead -- an opaque API token, or a DataRobot-issued JWT that decodes perfectly well and has nothing to do with the caller's IdP -- so it is never read here.

find_idp_token 

find_idp_token(headers: Mapping[str, str]) -> str | None

Return the caller's IdP access token, or None.

Needs only case-insensitive get -- Starlette Headers and NAT context headers both qualify. Reads only OAUTH_ACCESS_TOKEN_HEADER and returns it whatever its shape, since that header carries nothing else; see the module docstring for why authorization is never consulted.

Source code in datarobot_genai/dragent/inbound_token.py 
49
50
51
52
53
54
55
56
57
58
59
60
def find_idp_token(headers: Mapping[str, str]) -> str | None:
    """Return the caller's IdP access token, or ``None``.

    Needs only case-insensitive ``get`` -- Starlette ``Headers`` and NAT context headers both
    qualify.  Reads only ``OAUTH_ACCESS_TOKEN_HEADER`` and returns it whatever its shape, since
    that header carries nothing else; see the module docstring for why ``authorization`` is
    never consulted.
    """
    raw = headers.get(OAUTH_ACCESS_TOKEN_HEADER)
    if not raw:
        return None
    return _without_bearer(raw) or raw.strip() or None  # gateway sends it bare