Two roles
Identity provider and resource server
Turn on XAA as an identity provider, as a resource server or both, with two separate switches.
Solutions / AI agents
Cross App Access (XAA) with ID-JAG
When an MCP client needs to reach another enterprise application for a user, the usual answer is another consent screen and another token the identity team cannot see. Cross App Access moves that decision to the identity provider. WebFrolic supports it with the Identity Assertion JWT Authorization Grant (ID-JAG), both as the identity provider that issues the assertion and as the resource server that accepts it.
Available now in WebFrolic.
Why it matters
Consent sprawl is invisible to the identity team.
Every app-to-app connection made through user consent is a grant that IT did not approve and cannot easily list or revoke. With XAA, the enterprise identity provider makes the decision, applies policy and records it in one place.
Administrator control
Applications and scopes
Choose which applications are available for XAA, and for each one, the scopes an MCP client can request.
Discoverable
Published to MCP clients
As the identity provider, WebFrolic publishes the XAA-assigned applications and their available scopes, so clients do not have to guess.
The building blocks
How the pieces fit.
Identity provider
ID-JAG issuance
A requesting client exchanges the user’s identity assertion at WebFrolic for an ID-JAG aimed at one target application.
Explore ↗Resource server
ID-JAG acceptance
As the target, WebFrolic validates an ID-JAG from a trusted identity provider and issues its own access token, limited to the allowed scopes.
Explore ↗Authorization
Scopes open to XAA
As a resource server, a scope attribute marks which scopes other applications can reach through Cross App Access. Scopes without the mark are never offered.
Explore ↗Choosing
XAA or Connections?
Where the target application trusts WebFrolic, XAA replaces per-user consent. Where it does not, use Connections and the user consents once per application.
Explore ↗Enable the roles
In Configuration → General → Advanced, turn on XAA as an identity provider, as a resource server, or both.
Open resource scopes
As a resource server, mark the scopes that are available for Cross App Access by other applications.
Assign applications
Choose the applications available for XAA. For each one, select the scopes an MCP client can request.
Let clients discover
WebFrolic publishes the assigned applications and their scopes to the MCP client, which requests an ID-JAG for the one it needs.
Before rollout
Questions worth answering.
Settle these first and the rollout is mostly configuration.
- List the application pairs where an MCP client needs to act across apps for a user.
- Decide whether WebFrolic is the identity provider, the resource server or both in each pair.
- Keep the scopes offered for XAA narrower than the scopes a person could grant by consent.
- Decide whether issued tokens must be DPoP-bound.
- Check that ID-JAG requests appear in the audit trail with the user, the client and the target application.
Related capabilities
Explore what connects to this.
These capabilities are usually configured together.
Evaluate with your scenario
Start with a concrete workflow.
Share the identities, resource boundary and decision you want to test. The walkthrough can focus on the relevant behavior rather than a generic feature tour.