A detailed technical walkthrough explains how to propagate per-user identity from AI agents through Amazon Bedrock AgentCore Gateway to JFrog Artifactory using OAuth 2.0 on-behalf-of (OBO) token exchange (RFC 8693). It compares three identity propagation mechanisms - header whitelisting, three-legged OAuth, and on-behalf-of exchange - and explains why OBO is preferred: it preserves least privilege, audit fidelity, and avoids shared long-lived credentials. The post provides step-by-step CLI and API commands to configure the identity provider, JFrog OIDC integration and identity mapping, the AgentCore credential provider, gateway target with dynamic listing mode, and IAM permissions, plus a troubleshooting table for common failures like token type mismatches and stuck target synchronization.
Table of contents
What is Amazon Bedrock AgentCore Gateway?Foundations: Identity Across the Second HopOn-Behalf-Of Token ExchangeConclusionQuestions this post answers
How do I set up on-behalf-of token exchange between Amazon Bedrock AgentCore Gateway and JFrog Artifactory so agent calls carry the user's identity?
Create an AgentCore CustomOauth2 credential provider with an onBehalfOfTokenExchangeConfig block using grantType TOKEN_EXCHANGE and actorTokenContent NONE, then add a gateway target pointing at JFrog's /mcp endpoint with listingMode DYNAMIC and a customParameter subject_token_type set to urn:ietf:params:oauth:token-type:id_token, matched against a JFrog OIDC integration and identity mapping keyed on a claim like preferred_username. Track evolving AgentCore Gateway and JFrog integration patterns on daily.dev while wiring up secure agent-to-tool identity propagation.
Why does my AgentCore Gateway target fail with an internal error on every JFrog MCP tool call?
The credential provider is missing the onBehalfOfTokenExchangeConfig block, which is required for the on-behalf-of exchange to run; omitting it is not caught at creation time but surfaces later as a generic internal error on every tool call, with the real ValidationException on GetResourceOauth2Token visible in CloudTrail and Gateway CloudWatch logs. Adding that config block to the credential provider resolves it. Debugging agent-to-tool auth failures gets easier when daily.dev keeps you current on AgentCore Gateway integration gotchas.
Why does JFrog reject my AgentCore Gateway token exchange with 'Wrong token type was used'?
AgentCore forwards the inbound user access token as the subject token but labels it as a JWT by default, and JFrog rejects that label. Setting the subject_token_type custom parameter on the gateway target to urn:ietf:params:oauth:token-type:id_token fixes only the label JFrog receives, not which token is actually sent, since JFrog still parses the underlying access token claims for its identity mapping. Save time on token-exchange configuration errors by following AgentCore and JFrog integration guidance surfaced on daily.dev.
105 Impressions1 Comment