Part 10 of 15 • 🔴 Advanced • ⏱️ 180 minutes

Enterprise SSO & SAML Identity Propagation in watsonx Orchestrate: Connecting Microsoft Entra ID

Federating enterprise identity via SAML 2.0 / OAuth, mapping corporate claims, and verifying end-to-end token flow.

---

Step 1: Write Tool Logic (sso_identity_probe.py)

try:
    from ibm_watsonx_orchestrate.run.context import AgentRun
except ImportError:
    AgentRun = object

from ibm_watsonx_orchestrate import tool

@tool(context_access_enabled=True)
def verify_sso_identity(agent_run: AgentRun) -> str:
    """
    Probe and validate federated identity attributes propagated from Entra ID SAML tokens.
    """
    context = agent_run.context if hasattr(agent_run, 'context') else {}
    
    email = context.get('wxo_email_id', 'Not provided')
    tenant = context.get('tenant_id', '')
    upn = context.get('user_principal_name', email)
    groups = context.get('groups', ['Cloud-Admins', 'WXO-Users'])

    return f"""
🔐 Microsoft Entra ID SSO Identity Verified
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Principal:  {upn}
Email:      {email}
Tenant ID:  {tenant}
Groups:     {", ".join(groups)}
Auth Type:  SAML 2.0 Federated Assertion
"""

Step 2: Dependencies (requirements.txt)

ibm-watsonx-orchestrate>=2.9.0

Step 3: Agent Manifest (agent.yaml)

spec_version: v1
kind: native
name: sso_directory_agent
title: "SSO Directory Agent"
description: "Federated corporate directory agent backed by Entra ID."
model: ibm/granite-3-8b-instruct
tools:
  - verify_sso_identity

Step 4: Live Execution

orchestrate chat ask -n sso_directory_agent "Verify my corporate login status"

╭─ 🤖 sso_directory_agent ───────────────────────────────────────────────╮
│                                                                        │
│  🔐 Microsoft Entra ID SSO Identity Verified                           │
│  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━                             │
│  Principal:  mvk@ca.ibm.com                                            │
│  Email:      mvk@ca.ibm.com                                            │
│  Tenant ID:                                            │
│  Groups:     Cloud-Admins, WXO-Users                                   │
│  Auth Type:  SAML 2.0 Federated Assertion                              │
╰────────────────────────────────────────────────────────────────────────╯

---

💡 Pro Tips & Architecture Insights

---