You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@iggy.apache.org by "kparisa (via GitHub)" <gi...@apache.org> on 2025/05/10 08:46:24 UTC
[I] Integration with Google Agent2Agent Protocol [iggy]
kparisa opened a new issue, #1762:
URL: https://github.com/apache/iggy/issues/1762
Will be awesome to add Iggy into A2A protocol tooling like in this layer
https://google.github.io/A2A/topics/streaming-and-async/#example-asymmetric-key-flow-jwt-jwks
example: basically every agent can write telemetry data or other payload async into Iggy which then writes the data into sinks via Iggy's connector framework.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Integration with Google Agent2Agent Protocol [iggy]
Posted by "Tyooughtul (via GitHub)" <gi...@apache.org>.
Tyooughtul commented on issue #1762:
URL: https://github.com/apache/iggy/issues/1762#issuecomment-3791129275
> it sure is! [@Tyooughtul](https://github.com/Tyooughtul) assigned
>
> let us know on discord, in discussions on github or here what's your implementation idea before jumping straight into code.
Thanks for the assignment!
I've been looking at the A2A spec, especially the streaming/async parts. It seems like to make Iggy work as the pub/sub layer for A2A Agents, we'd need to handle the A2A identity layer somehow. From what I can see, A2A uses JWT/JWKS for authentication, while Iggy currently uses static secrets.
So I was thinking... maybe we could add JWKS support to Iggy? Here's what I'm considering:
- Extend the config to support a jwks_url
- Build a simple client to fetch public keys from an A2A Auth Server
- Update the JWT verification to use keys from JWKS instead of just static secrets
This way, A2A Agents could use their existing credentials to push data into Iggy. But I'm still exploring this - would love to hear your thoughts on whether this direction makes sense or if there's a better approach! Also, I'm planning to work on this in smaller chunks and send incremental PRs, so it's easier to review and we can discuss and adjust direction as we go.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Integration with Google Agent2Agent Protocol [iggy]
Posted by "spetz (via GitHub)" <gi...@apache.org>.
spetz commented on issue #1762:
URL: https://github.com/apache/iggy/issues/1762#issuecomment-3801491847
@Tyooughtul I think it's fine to change the `sub` claim to be of an arbitrary string type, keep in mind that HTTP transport is mostly used by Web UI, or maybe via some additional tooling or languages such as PHP which don't have an official client yet, hence as long as all the transport across existing SDKs which do implement this protocol are updated, IMHO it's fine to propose & implement such changes to our custom `JwtClaims` payload.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Integration with Google Agent2Agent Protocol [iggy]
Posted by "spetz (via GitHub)" <gi...@apache.org>.
spetz closed issue #1762: Integration with Google Agent2Agent Protocol
URL: https://github.com/apache/iggy/issues/1762
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Integration with Google Agent2Agent Protocol [iggy]
Posted by "hubcio (via GitHub)" <gi...@apache.org>.
hubcio commented on issue #1762:
URL: https://github.com/apache/iggy/issues/1762#issuecomment-3792093257
@kparisa @spetz any comments?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Integration with Google Agent2Agent Protocol [iggy]
Posted by "Tyooughtul (via GitHub)" <gi...@apache.org>.
Tyooughtul commented on issue #1762:
URL: https://github.com/apache/iggy/issues/1762#issuecomment-3794165701
@kparisa Thanks for the detailed feedback! I got it 🤔 - multiple issuers, caching with TTL, and lazy refresh on failure.
And yes, once this identity layer is in place, Iggy should be ready to serve as the async Pub/Sub layer for A2A agents.
I'll start with the config changes and send small PRs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Integration with Google Agent2Agent Protocol [iggy]
Posted by "kparisa (via GitHub)" <gi...@apache.org>.
kparisa commented on issue #1762:
URL: https://github.com/apache/iggy/issues/1762#issuecomment-3793976261
@Tyooughtul At high-level, it's in the right direction. Adding JWT auth to Iggy is anyways a good feature.
I'd recommend supporting multiple issuers. A2A ecosystems are often multi-tenant. You might have agents from Google Cloud (Google Identity) and agents from a partner (Okta/Auth0) interacting on the same bus.
So, instead of a single jwks_url, consider a list of trusted issuers in the config, each with its own jwks_url and an audience check.
Also, You cannot fetch the JWKS from the Auth Server on every incoming connection or message. So, we'd need to implement a Caching Strategy with a Time-to-Live (TTL) respecting the headers from the Auth Server. And If a token signature fails, Iggy should attempt a "lazy refresh" of the JWKS before rejecting the request, just in case the server rotated keys recently.
After this, we can use A2A's async/PubSub mode?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Integration with Google Agent2Agent Protocol [iggy]
Posted by "hubcio (via GitHub)" <gi...@apache.org>.
hubcio commented on issue #1762:
URL: https://github.com/apache/iggy/issues/1762#issuecomment-3790428636
it sure is! @Tyooughtul assigned
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Integration with Google Agent2Agent Protocol [iggy]
Posted by "Tyooughtul (via GitHub)" <gi...@apache.org>.
Tyooughtul commented on issue #1762:
URL: https://github.com/apache/iggy/issues/1762#issuecomment-3789874038
I'd like to volunteer to work on this A2A protocol integration for Iggy. Let me know if this is available! 😊
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Integration with Google Agent2Agent Protocol [iggy]
Posted by "Tyooughtul (via GitHub)" <gi...@apache.org>.
Tyooughtul commented on issue #1762:
URL: https://github.com/apache/iggy/issues/1762#issuecomment-3797843440
I’ve run into an identity mapping issue and I’d like to get your thoughts on:
Iggy’s internal JwtClaims expects the sub claim to be a u32 (our internal user ID), but external IdPs like Google/Okta return sub as a string (e.g. "google-oauth2|1076..."). This triggers a serde deserialization failure and the token gets rejected immediately.
Two solutions I’ve considered so far:
Require external tokens to include a custom claim (e.g. https://iggy.rs/uid) that holds the internal Iggy u32 user ID – we’d prioritize this claim during validation.
Maintain a lookup table in Iggy’s database that maps external subject strings to internal u32 user IDs, and resolve the ID via this table when validating tokens.
Wondering if you have a better approach or other ideas to solve this? Thanks!😊
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org