Make RAR optional

By default, Vault requires an authorization details claim in OAuth JWTs used with the agent registry. If the JWT does not contain an authorization_details claim, Vault rejects the request with an error indicating that the claim is required.

While not recommended, you can make Rich Authorization Requests (RAR) optional during migrations or in cases where your identity provider does not support RAR.

When you make RAR optional, Vault uses standard ACL policies associated with the requesting entity to evaluate requests that omit the authorization_details claim. You can modify the RAR requirement at any time and the modified settings take effect on the next applicable request.

For more information about RAR enforcement modes and configuration options, refer to the RAR enforcement overview.

Assumptions

You have added at least one agent to the agent registery in Vault.
You have configured at least one OAuth server in Vault.
You have permission to modify OAuth resource server profiles and agent registration details in Vault.

Option 1: Modify the OAuth resource server profile

You can make RAR optional for all AI agents authorized by the OAuth resource server by setting the optional_authorization_details field to true on the OAuth resource server configuration:

Use vault write to call the /sys/config/oauth-resource-server/{profile_name} endpoint and update the optional_authorization_details field:

$ vault write /sys/config/oauth-resource-server/<profile_name> \
  optional_authorization_details=true

For example:

$ vault write /sys/config/oauth-resource-server/github-actions \
  optional_authorization_details=true

Key                               Value
---                               -----
actor_claim                       act.sub
audiences                         [https://github.com/my-org]
clock_skew_leeway                 0
config_id                         b2f5c891-3a7d-4e12-9f8a-1c6d4e7b2a03
enabled                           true
issuer_id                         https://token.actions.githubusercontent.com
jwks_uri                          https://token.actions.githubusercontent.com/.well-known/jwks
jwt_type                          access_token
local                             false
mount_accessor                    oauth-resource-server_root_b2f5c891-3a7d-4e12-9f8a-1c6d4e7b2a03
no_default_policy                 false
optional_authorization_details    true
profile_name                      github-actions
supported_algorithms              [RS256]
unique_id_claim                   jti
use_jwks                          true
user_claim                        sub

/sys/config/oauth-resource-server/{profile_name} returns the updated profile on success. Confirm that optional_authorization_details is true.

Make a POST call to /sys/config/oauth-resource-server/{profile_name} to update the optional_authorization_details field:

$ curl                                                \
  --request POST                                      \
  --header    "X-Vault-Token: ${VAULT_TOKEN}"         \
  --namespace "X-Vault-Namespace: ${VAULT_NAMESPACE}" \
  --data '{"optional_authorization_details": "true"}' \
  ${VAULT_ADDR}/v1/sys/config/oauth-resource-server/<profile_name>

For example:

$ curl                                                \
  --request POST                                      \
  --header    "X-Vault-Token: ${VAULT_TOKEN}"         \
  --namespace "X-Vault-Namespace: ${VAULT_NAMESPACE}" \
  --data '{"optional_authorization_details": "true"}' \
  ${VAULT_ADDR}/v1/sys/config/oauth-resource-server/github-actions

/sys/config/oauth-resource-server/{profile_name} returns 200 OK with the updated profile on success. Confirm that optional_authorization_details is true:

{
  "data": {
    "config_id": "b2f5c891-3a7d-4e12-9f8a-1c6d4e7b2a03",
    "profile_name": "github-actions",
    "issuer_id": "https://token.actions.githubusercontent.com",
    "mount_accessor": "oauth-resource-server_root_b2f5c891-3a7d-4e12-9f8a-1c6d4e7b2a03",
    "optional_authorization_details": true,
    "local": false,
    "use_jwks": true,
    "jwks_uri": "https://token.actions.githubusercontent.com/.well-known/jwks",
    "audiences": ["https://github.com/my-org"],
    "no_default_policy": false,
    "user_claim": "sub",
    "actor_claim": "act.sub",
    "unique_id_claim": "jti",
    "supported_algorithms": ["RS256"],
    "jwt_type": "access_token",
    "clock_skew_leeway": 0,
    "enabled": true
  }
}

Option 2: Modify the agent registration

You can make RAR optional for a specific agent by setting the optional_authorization_details field to true on the agent registry record.

Call the /agent-registry/registration/display-name/{display_name} endpoint to fetch the registration ID for the agent:

$ vault read /agent-registry/registration/display-name/<display_name> \
  | jq '.data.id'

For example:

$ vault read --format json /agent-registry/registration/display-name/bob \
  | jq '.data.id'

$ curl                                                                     \
  --request GET                                                            \
  --header    "X-Vault-Token: ${VAULT_TOKEN}"                              \
  --namespace "X-Vault-Namespace: ${VAULT_NAMESPACE}"                      \
  ${VAULT_ADDR}/v1/agent-registry/registration/display-name/{display_name} \
  | jq '.data.id'

For example:

$ curl                                                          \
  --request GET                                                 \
  --header    "X-Vault-Token: ${VAULT_TOKEN}"                   \
  --namespace "X-Vault-Namespace: ${VAULT_NAMESPACE}"           \
  ${VAULT_ADDR}/v1/agent-registry/registration/display-name/bob \
  | jq '.data.id'

Use the fetched ID and the /agent-registry/registration/id/{registration_id} endpoint to update the optional_authorization_details field:

$ vault write /agent-registry/registration/id/<registration_id> \
  optional_authorization_details=true

For example:

$ vault write /agent-registry/registration/id/00000000-0000-0000-0000-000000000000 \
  optional_authorization_details=true

$ curl                                                \
  --request POST                                      \
  --header    "X-Vault-Token: ${VAULT_TOKEN}"         \
  --namespace "X-Vault-Namespace: ${VAULT_NAMESPACE}" \
  --data '{"optional_authorization_details": "true"}' \
  ${VAULT_ADDR}/v1/agent-registry/registration/id/<registration_id>

For example:

$ curl                                                \
  --request POST                                      \
  --header    "X-Vault-Token: ${VAULT_TOKEN}"         \
  --namespace "X-Vault-Namespace: ${VAULT_NAMESPACE}" \
  --data '{"optional_authorization_details": "true"}' \
  ${VAULT_ADDR}/v1/agent-registry/registration/id/00000000-0000-0000-0000-000000000000