Onboarding a broker for your agent

This tutorial walks you through how to set up IBM Cloud single sign-on (SSO) and onboard a broker for your agent in Partner Center. The broker manages the lifecycle of your agent's service instances and connects your agent to the applications that developers are building. By completing this tutorial, you learn how to create a client ID for SSO, add redirect URLs, and register your broker.

This tutorial is one of six in a series that demonstrates how to onboard and publish an agent to the watsonx Orchestrate and IBM Cloud catalogs. It uses a fictitious company that's called Example Corp. As you complete the tutorial, adapt each step to fit your product's needs.

Before you begin

Before you can start onboarding your broker, complete the following steps.

  1. Register your agent.
  2. Define the product details of your agent.
  3. Build your broker. For an example of how to build your broker, see the Open Service Broker reference application and the IBM Cloud Open Service Broker API.

Broker tasks require a technical member of your team. If you need to invite a technical team member to complete this step, you can do so from the Brokers page in Partner Center by clicking Invite a team member in the notification.

Set up IBM Cloud SSO

Setting up IBM Cloud SSO creates a client ID that uniquely identifies your agent to IBM Cloud's identity provider. When a user tries to log in to your agent, instead of entering separate credentials, your agent redirects them to the IBM Cloud login page. IBM Cloud then issues tokens tied to your client ID and client secret, which your agent uses to grant the user access.

  1. In the IBM Cloud console, click the Navigation menu icon Navigation menu icon > Partner Center > My products.

  2. Select the agent that you're onboarding.

  3. From the Brokers page, click Create Client ID for SSO.

  4. For Owners, add any team members who can view and edit the client ID.

    You can't remove yourself from the list of owners.

  5. For Redirect URLs, click Add and enter the host URL that users are redirected to after a successful authorization, for example, https://examplecorp-agent.com/auth/callback.

  6. Click Next.

  7. Copy your client ID and secret and save them in a secure location.

    Your secret disappears automatically after 5 minutes and cannot be retrieved after you close this panel. If the secret is lost, you must create a new client ID.

  8. Click Done.

Add your broker

After you set up SSO, register your broker in Partner Center. The broker handles provisioning and deprovisioning requests from IBM Cloud on behalf of your agent.

  1. From the Brokers page, click Add broker.

  2. Enter a programmatic name for your broker, for example, example-corp-agent-broker. The name must be globally unique.

  3. Enter the URL at which your broker is reachable, for example, https://my-agent-broker.com.

  4. From the Authentication scheme list, select the scheme used to verify the identity of the client that interacts with the broker. For this tutorial, select Bearer CRN.

    Basic and bearer authentication schemes are deprecated. Use bearer CRN authentication instead.

  5. From the Type list, select the broker type. For this tutorial, select provision-through.

    Most service integrators use the provision-through model, where requests go through the resource controller to the service broker. In the provision-behind model, the request goes through the service integrator first, then to the resource controller.

  6. Click Save.

Next steps

You can now add a pricing plan for your agent.