Skip to content

Add Gateway Interceptor for passing tenant ID#4

Open
GaneshThiyagarajan wants to merge 1 commit intoaws-samples:mainfrom
GaneshThiyagarajan:interceptor-tenant-isolation
Open

Add Gateway Interceptor for passing tenant ID#4
GaneshThiyagarajan wants to merge 1 commit intoaws-samples:mainfrom
GaneshThiyagarajan:interceptor-tenant-isolation

Conversation

@GaneshThiyagarajan
Copy link
Copy Markdown

Issue #, if available:

Description of changes:

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

kb_gateway_url,
headers={
"Authorization": f"{access_token}",
"X-Tenant-ID": tenant_id
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The access_token already has the tenant id, so lets not add the tenant_id in the headers.

auth_header = headers.get('authorization', '') or headers.get('Authorization', '')

# Extract Tenant Id from custom header for propagation
tenant_id = headers.get('X-Tenant-ID', '')
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we get this tenant id from the access token which is in the Authorization header

if "params" in extended_body and "arguments" in extended_body["params"]:
# Add custom header to arguments for downstream processing
extended_body["params"]["arguments"]["tenant_id"] = tenant_id

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have kb-mcp-handler and log-mcp-handler tools(lambda) which uses tenant_id. So this tenant_id will be available as a part of lambda handler event?

# Add custom header to arguments for downstream processing
extended_body["params"]["arguments"]["tenant_id"] = tenant_id

# Return transformed request without passing the original authorization header
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you also add/move this assume role code from log-mcp-handler, to here. Then send the generated credentials as a arguments so that log-mcp-handler tool can directly use the generated credentials.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants