modelcontextprotocol/ext-auth
Watch
1
0
Fork
You've already forked ext-auth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Format with prettier

Browse source
This commit is contained in:
Paul Carleton 2026-06-18 09:44:30 +01:00
commit e5eef546e4
No known key found for this signature in database
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
specification/stable/enterprise-managed-authorization.mdx
View file

@ -150,6 +150,7 @@ grant_type=urn:ietf:params:oauth:grant-type:token-exchange
```
If the client uses SAML for single sign-on to the IdP, see [Section 4.5](https://www.ietf.org/archive/id/draft-ietf-oauth-identity-assertion-authz-grant-04.html#section-4.5) for details on how the client can exchange the SAML assertion for a refresh token, then use the refresh token to request an ID-JAG.
### 4.1 Processing Rules
The IdP processes the request according to [Section 4.3.3 of draft-ietf-oauth-identity-assertion-authz-grant](https://www.ietf.org/archive/id/draft-ietf-oauth-identity-assertion-authz-grant-04.html#section-4.3.3). The IdP evaluates administrator-defined policies for the token exchange request and determines if the MCP Client should be granted access to act on behalf of the user for the target MCP Server and scopes.
@ -258,7 +259,6 @@ An MCP Client can determine that a Resource Authorization Server supports this p
In most enterprise deployments, the IdP policy will only allow users to sign in to pre-registered clients. The MCP client will likely need to be pre-registered with the enterprise IdP for single sign-on.
See [Section 5 of draft-ietf-oauth-identity-assertion-authz-grant](https://www.ietf.org/archive/id/draft-ietf-oauth-identity-assertion-authz-grant-04.html#section-5) for how the IdP determines the `client_id` value to include in the ID-JAG.
### 7.2 Scope of Enterprise Visibility and Policy Enforcement