Enable the optional connections broker

Overview

The optional broker protects grants and resolves tokens in trusted infrastructure. A profile names the owner, provider, allowed agent handles and resources. Credential references point to host-resolved secrets; profiles and blueprints should not contain raw tokens.

Profiles describe permitted use, not secret values

A connection profile identifies its owner, provider, allowed agent handles and resource requirements. Its credential reference points to secret material resolved by trusted Host infrastructure. The profile can be inspected or versioned without making a token part of an agent prompt or blueprint. The optional broker protects grants and performs the actual token resolution.

Bootstrap protection remains infrastructure work

The broker needs its supported storage and data-protection configuration before it can protect user grants. Deploy its package/registration and key material deliberately; a Cloud Server editing an ordinary profile cannot install the assembly or manufacture the key ring. Read capability discovery before presenting connection controls in a console.

Enable and configure the connection broker

1. Register the contracts/client, host broker and appropriate data protection. Enable remote agents and Agent ID separately only when needed.
2. Create a connection profile with exact owner and allowed full handles, authority/client ID, resource base URLs/scopes and host credential reference.
3. Choose authorization code, OBO or application credentials deliberately. Use conditional profile writes; changes invalidate prior authorization/bindings.

using FabrCore.Host;
using FabrCore.Services.Connections;
using FabrCore.Services.RemoteAgents;

builder.AddFabrCoreServer(new FabrCoreServerOptions {
    AdditionalAssemblies = [typeof(ConnectionsExtensions).Assembly,
                            typeof(RemoteAgent).Assembly]
});
builder.Services.AddFabrCoreConnections(o => {
    o.Enabled = true;
    o.EntraAgentIdEnabled = false;
    o.ClientHandoffEnabled = false;
});
builder.Services.AddFabrCoreRemoteAgents(o => o.Enabled = true);

// Also configure the host's normal user authentication/authorization.
var app = builder.Build();
app.UseFabrCoreServer();
app.MapFabrCoreConnections();
app.Run();

{
  "FabrCore": {
    "DataProtection": {
      "ApplicationName": "my-cluster-production",
      "CertificatePath": "/run/secrets/fabrcore-protection.pfx"
    }
  }
}

var mail = new ConnectionProfile {
    Name = "mail-service",
    Enabled = true,
    Provider = "microsoft",
    Authentication = ConnectionAuthentication.ClientCredentials,
    Authority = $"https://login.microsoftonline.com/{tenantId}/v2.0",
    ClientId = appRegistrationClientId,
    CredentialReference = "mail-application",
    AllowedAgents = ["alice:mail-agent"],
    Resources = new() {
        ["graph"] = new() {
            BaseUrl = "https://graph.microsoft.com/v1.0/",
            Scopes = ["https://graph.microsoft.com/.default"]
        }
    }
};
await admin.SaveAsync("mail-service-principal", mail, "*");

Go deeper

Explore the related documentation.

• FabrCore Microsoft Integrations
• FabrCore Connections
• FabrCore Microsoft 365 Copilot
• FabrCore A2A
• Profiles and application credentials