Give user agent two tokens: one for A and one for B (let's call it UB). Pass UA and UB to A. A passes its own token to B plus the UB token. B uses user info fro

Give user agent two tokens: one for A and one for B (let's call it UB). Pass UA and UB to A. A passes its own token to B plus the UB token. B uses user info from UB and roles from both UB and A's token. UB has a list of allowed intermediates (in this case, A) so user agent doesn't send it to every service. In my implementation there were various kinds of tokens, so UB couldn't be used by itself to invoke B directly. For our situation all this complexity turned out to be not worth it. :-/