DOCSEARCHbyAlgolia
Submit Docs

LumoAuth Documentation

website·Indexed 30 days ago

https://docs.lumoauth.dev

Authorization framework and API for autonomous agents, featuring the Agent Auth (AAuth) protocol, Just-in-Time (JIT) permissions, and an Agent Registry. Provides tools for cryptographic identities, proof-of-possession tokens, and RFC 8693 Token Exchange to secure delegated tokens. Includes SDKs and integration guides for CrewAI, LangChain, LangGraph, OpenAI Agents SDK, and Google ADK, as well as an Organization Admin API for managing organizational resources.

Tokens
119.1K
Snippets
534
Records
768
Agent score
48%

What's inside LumoAuth

  1. Overview of LumoAuth IAM Platform

    LumoAuth is a multi-organization identity and access management (IAM) platform that provides authentication, authorization, and identity management. It implements standard protocols including OAuth 2.0, OpenID Connect (OIDC), SAML 2.0, and SCIM 2.0. Key features include adaptive MFA, Zanzibar-style fine-grained authorization, and identity management for AI agents.

  2. Overview of SCIM 2.0 API

    LumoAuth implements the SCIM 2.0 standard (RFC 7643 and RFC 7644) for managing users and groups via HTTP and JSON. It supports standard User and Group resources and provides a REST API (GET, POST, PUT, PATCH, DELETE) on /Users and /Groups endpoints, including support for filtering, sorting, and pagination.

  3. Overview of LumoAuth supported authentication methods

    LumoAuth supports a variety of authentication methods that can be combined per organization. These include:

    • Email & Password: Standard credential-based login.
    • Magic Link & Email-First: Passwordless sign-in via emailed link.
    • Social Login: OAuth/OIDC login via providers like Google, GitHub, and Microsoft.
    • Multi-Factor Authentication (MFA): Second factors including TOTP, SMS, email, and backup codes.
    • Adaptive MFA: Risk-based, context-aware MFA to reduce friction.
    • Passkeys & WebAuthn: FIDO2 passwordless, phishing-resistant authentication.
    • Push Authentication: Mobile push notification approval.
    • Enterprise SSO: SAML 2.0, OIDC federation, and LDAP/Active Directory.
    • Device Authorization: RFC 8628 flow for input-constrained devices (CLI, IoT, Smart TVs).

  4. Overview of the Agent Auth (AAuth) Protocol

    AAuth is an authorization framework for autonomous agents acting on behalf of users and organizations. It extends OAuth 2.1 by providing agents and resources with cryptographic identities and binding tokens to keys (proof-of-possession). To ensure integrity and prevent replay attacks, every request is signed using RFC 9421 (HTTP Message Signatures), which covers the method, path, selected headers, and body digest.

  5. Overview of LumoAuth OAuth 2.0 API Endpoints

    LumoAuth implements OAuth 2.0 (RFC 6749) and OpenID Connect. All endpoints are organization-scoped using the {orgId} path parameter (e.g., a unique slug like acme-corp) to ensure isolation between environments.

    Available Endpoints

    • GET /orgs/{orgId}/api/v1/oauth/authorize: Starts the OAuth flow; redirects user to authenticate.
    • POST /orgs/{orgId}/api/v1/oauth/token: Exchanges codes for tokens, refreshes tokens, or uses client credentials.
    • POST /orgs/{orgId}/api/v1/oauth/introspect: Validates tokens and returns metadata (RFC 7662).
    • GET/POST /orgs/{orgId}/api/v1/oauth/userinfo: Returns authenticated user/agent information.
    • POST /orgs/{orgId}/api/v1/connect/register: Programmatically registers new OAuth clients (RFC 7591).

  6. Overview of Zanzibar Relationship-Based Authorization

    Zanzibar is an authorization model that stores access as relation tuples (object#relation@subject) rather than global roles. It is ideal for access driven by hierarchies (e.g., folders containing files) and relationships (e.g., teams owning projects). Unlike RBAC, which answers 'What can this user do?', Zanzibar answers 'Can this user do X to object Y?' by walking a relation graph based on schema rewrite rules.

  7. Overview of MCP Server Authorization with LumoAuth

    The Model Context Protocol (MCP) allows LLM hosts (like Claude, ChatGPT, or Cursor) to discover and call external tools. When an MCP server exposes sensitive resources, LumoAuth acts as the OAuth 2.1 authorization server to ensure only permitted clients and users can access those tools. LumoAuth manages the registration of MCP servers as protected resources and handles the issuance of access tokens.

  8. Overview of Client-Initiated Backchannel Authentication (CIBA)

    CIBA is a decoupled authentication flow where the client initiates a login, and the user authenticates out-of-band (e.g., via a mobile push notification) without a browser redirect or front-channel interaction. This is ideal for call centers, POS terminals, IoT, and high-value transaction approvals where the user is not on the device initiating the request.

  9. Compare LumoAuth authorization models

    LumoAuth provides three primary authorization models to handle different access control requirements:

    • RBAC (Role-Based Access Control): Best for simple access based on job titles. Users are assigned roles, and roles contain named permissions.
    • ABAC (Attribute-Based Access Control): Best for dynamic, context-aware decisions. Policies evaluate attributes of the subject, resource, action, and environment (e.g., time, IP).
    • Zanzibar / ReBAC (Relationship-Based Access Control): Best for hierarchical resources and sharing (e.g., folders, teams). Access is stored as relation tuples (e.g., document:readme#editor@user:alice).

    These models can be layered. For example, RBAC can gate a general capability while ABAC adds specific conditions (e.g., "editors can only edit during business hours").

  10. Use Resource Indicators to prevent token-confusion attacks

    Resource Indicators (RFC 8707) allow a client to specify which resource server(s) an access token is intended for. LumoAuth mints tokens where the aud (audience) claim matches these resources. This prevents a token issued for API A from being replayed against API B.

    Requirements:

    1. The resource indicator must be an absolute URI without fragments.
    2. The resource URI must be registered in the client's allowed audience URIs during registration; otherwise, the server returns an invalid_target error.

  11. Manage Agent Delegation with Chain of Agency

    When an agent acts on behalf of a user or another agent, LumoAuth uses Token Exchange (RFC 8693) to create a delegation token. This records the full call chain (e.g., "Search Tool -> Research Bot -> Alice"), ensuring every hop is signed and recorded in the audit log for accountability.

  12. Retrieve user identity via OIDC UserInfo endpoint

    The UserInfo endpoint returns identity claims about the authenticated user when called with a valid access token.
    curl https://your-domain.com/orgs/{orgId}/api/v1/oauth/userinfo \
  -H "Authorization: Bearer {access_token}"