kong-azure-obo-demo Architecture Overview

kong-azure-obo-demo Architecture Overview An architecture diagram generated by Archify. User · Browser · Architecture component User Browser Entra ID · IdP (middle-tier App / API App) · Architecture component Entra ID IdP (middle-tier App / API App) Route① / · openid-connect (auth code flow, no OBO) · Kong Gateway 3.16 (Postgres backed) Route① / openid-connect (auth code flow, no OBO) Route② /mcp/customers · openid-connect (OBO) + ai-mcp-proxy (ACL) · Kong Gateway 3.16 (Postgres backed) Route② /mcp/customers openid-connect (OBO) + ai-mcp-proxy (ACL) Route③ /llm · ai-proxy-advanced · Kong Gateway 3.16 (Postgres backed) Route③ /llm ai-proxy-advanced chat-ui · Next.js + Vercel AI SDK · kong-internal network (not externally reachable) chat-ui Next.js + Vercel AI SDK demo-api · Bun/TypeScript (Customer Inquiry / Details) · kong-internal network (not externally reachable) demo-api Bun/TypeScript (Customer Inquiry / Details) Azure OpenAI · Architecture component Azure OpenAI ① Login (auth code flow) Authenticate, issue token X-User-Name/Email, Authorization: Bearer ② tools/call (re-sends Bearer token) ③ OBO token exchange (token_exchange) ④ Fetch real data after ACL pass ⑤ LLM call (model: kong-demo-llm) Inject Azure credentials Kong Gateway 3.16 (Postgres backed) kong-internal network (not externally reachable) Legend Frontend Backend Cloud Security External

Route①

  • • Browser ⇄ Next.js path
  • • openid-connect only handles the auth code flow and session cookie issuance (no OBO)

Route②

  • • Next.js agent (server-side) ⇄ demo-api path
  • • openid-connect exchanges the token via OBO (token_exchange)
  • • ai-mcp-proxy evaluates the ACL before relaying as an MCP-converted tool call

Route③

  • • Next.js agent ⇄ Azure OpenAI path
  • • ai-proxy-advanced injects Azure-specific credentials and endpoint details (unrelated to OBO)