AWS官方教你用Bedrock AgentCore Gateway和Okta实现OBO token交换，解决多租户跨身份认证的痛点，有代码有示例。
Amazon Bedrock AgentCore与AgentCore Gateway支持多租户架构，并通过拦截器实现细粒度访问控制。本文展示了如何针对Okta设置完整的on-behalf-of（OBO）令牌交换流程，包括每个跳转的JWT声明转换。示例说明了受众绑定（audience binding）如何提供跨租户的纵深防御。
Implement on-behalf-of token exchange for multi-tenant agents with Amazon Bedrock AgentCore Gateway
Building multi-tenant agents with Amazon Bedrock AgentCore and Apply fine-grained access control with Bedrock AgentCore Gateway interceptors establish the conceptual foundation for on-behalf-of (OBO) token exchange in agentic systems. This post is the implementation guide. It walks through a complete multi-tenant OBO setup against Okta, shows the JSON Web Token (JWT) claim transformations on each hop, and demonstrates how audience binding produces defense in depth that scales across tenants.