feat: delegated OAuth access for workflow runs - #1585
Open
shaileshpadave wants to merge 2 commits into
Open
Conversation
Adds support for workflows that require a user to authorize access to an external provider (e.g. Microsoft) before running. The authorization is done once via an OAuth popup; the resulting refresh token is stored as a Conductor secret and reused on all subsequent runs — including scheduled ones. Backend: - DelegationRequirement model in WorkflowDef — declares which provider, scopes, and secret name a workflow needs - OAuthController: GET /api/oauth/authorize (returns auth URL) and GET /api/oauth/callback (exchanges code → refresh token, stores secret, closes popup via postMessage) - OAuthTokenService: builds Microsoft authorization URLs and handles the token exchange via the standard auth-code flow - application.properties: conductor.oauth.microsoft.* config keys UI (RunWorkflow page): - DelegatedAuthSection component — shows per-delegation Authorize/ Connected/Disconnect state, opens popup, listens for postMessage - RunWorkflow.tsx — renders DelegatedAuthSection when the selected workflow has requiredDelegations; disables Run until all are authorized - WorkflowDef type extended with requiredDelegations field
…rter task form
- Rename agentType constant "azure-foundry" → "microsoft-foundry" (A2AService,
AgentTaskMetadata, all UI badge/display/routing references)
- Add endpoint + credentialRef to AgentSummary DTO; populate both in
AzureFoundryAgentClient.listExternalAgents() so the global /agent/list scan
carries connection metadata per discovered agent
- AgentController: expose optional endpoint/credentialRef query params on GET /agent/list
to support on-demand Foundry agent listing
- AgentTaskForm: remove manual "Foundry project URL" and "Credential secret" inputs;
use global /agent/list filtered to microsoft-foundry type; selecting an agent
auto-populates agentUrl, credentialRef (as ${workflow.secrets.<name>}), and
rawConfig.assistantId in one shot
- AzureFoundryAgentClient: add resolveCredField() to handle both a secret-name lookup
and a pre-resolved JSON blob (when Conductor substitutes ${workflow.secrets.X} at
task execution time)
- agentMetadata: fix agentSourceIdentity to show rawConfig.assistantId (agent name)
for microsoft-foundry tasks instead of the project URL; fix resolveAgentSnapshot
to build snapshot locally for microsoft-foundry, preventing erroneous POST to
/a2a/agent-card with an agent name as the URL
- AgentDefinitions: update provider chips, icons, and colors for microsoft-foundry
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #1447.
Adds delegated OAuth access so workflows can require a user to authorize an external provider (e.g. Microsoft) before running. User clicks Authorize once, consents via popup, and the refresh token gets stored as a Conductor secret. All subsequent runs — including scheduled ones — just pick it up from there, no re-auth needed.
On the Run Workflow page, each required delegation shows as an Authorize / Connected / Disconnect row. The Run button stays disabled until everything is authorized.
Config needed: set
conductor.oauth.microsoft.{tenant-id,client-id,client-secret}and register{base-url}/api/oauth/callbackas a redirect URI in your Azure app registration.