modelcontextprotocol/conformance
Watch
1
0
Fork
You've already forked conformance
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

SEP-2352: authorization-server migration scenario (#286)

Browse source 
* Add SEP-2352 authorization-server migration scenario

SEP-2352 requires that client credentials are bound to the issuing
authorization server: when PRM authorization_servers changes to a new
issuer, clients MUST re-register and MUST NOT reuse the previous AS's
client credentials.

- Traceability yaml: 3 checks, 3 excluded (internal state / UI)
- New auth/authorization-server-migration scenario (draft suite): two
  auth servers; PRM flips from AS1 to AS2 after the first authenticated
  request; AS2 asserts it received a fresh /register and never saw AS1's
  client_id at /authorize or /token
- ConformanceOAuthProvider gains invalidateCredentials and bindIssuer so
  the everything-client can key credentials by issuer (passing example)
- everything-client adds an issuer-aware handler for this scenario that
  re-reads PRM on each 401 and rebinds before re-authorizing
- auth-test-reuse-credentials negative client + vitest case

* Drop application_type from DCR metadata (not in SDK OAuthClientMetadata type)

---------

Co-authored-by: Paul Carleton <paulc@anthropic.com>
This commit is contained in:
Den Delimarsky 2026-05-19 14:59:31 -07:00 • committed by GitHub
commit 1ef3cd34bd
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 387 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

17
src/seps/sep-2352.yaml Normal file
View file

@ -0,0 +1,17 @@
sep: 2352
spec_url: https://modelcontextprotocol.io/specification/draft/basic/authorization#authorization-server-binding
requirements:
- check: sep-2352-no-cross-as-credential-reuse
text: 'Clients MUST NOT assume that credentials valid for one authorization server will be accepted by another.'
url: https://modelcontextprotocol.io/specification/draft/basic/authorization#authorization-server-location
- check: sep-2352-no-reuse-on-as-change
text: 'When the authorization server changes (detected via updated protected resource metadata), clients MUST NOT reuse client credentials from a different authorization server.'
- check: sep-2352-reregister-on-as-change
text: 'When the authorization server changes (detected via updated protected resource metadata), clients MUST re-register with the new authorization server.'
- text: 'Clients MUST maintain separate registration state (client credentials, tokens) per authorization server.'
excluded: 'internal storage requirement; not directly observable on the wire'
- text: 'Clients that use pre-registered credentials, or persist client credentials obtained via Dynamic Client Registration, MUST associate those credentials with the specific authorization server that issued them, keyed by the authorization server issuer identifier.'
excluded: 'internal state-keying requirement; not protocol-observable'
- text: 'If the authorization server indicated by protected resource metadata no longer matches the one the credentials were registered with, clients SHOULD surface an error rather than silently attempting to use mismatched credentials.'
excluded: 'UI behavior; the negative half (do not send mismatched credentials) is covered by sep-2352-no-reuse-on-as-change'