modelcontextprotocol/ext-auth
Watch
1
0
Fork
You've already forked ext-auth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Format with prettier

Browse source
This commit is contained in:
Paul Carleton 2026-06-18 09:44:30 +01:00
commit e5eef546e4
No known key found for this signature in database
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
specification/stable/enterprise-managed-authorization.mdx
View file

@ -36,7 +36,7 @@ This profile is an application of the "Identity Assertion JWT Authorization Gran
The Identity Assertion JWT Authorization Grant follows three steps:
1. Single Sign-On to the MCP Client via OpenID Connect or SAML
1a. optionally exchange the SAML assertion for a Refresh Token
1a. optionally exchange the SAML assertion for a Refresh Token
2. Token Exchange ([RFC8693](https://datatracker.ietf.org/doc/html/rfc8693))
3. JWT Authorization Grant ([RFC7523](https://datatracker.ietf.org/doc/html/rfc7523))
@ -150,6 +150,7 @@ grant_type=urn:ietf:params:oauth:grant-type:token-exchange
```
If the client uses SAML for single sign-on to the IdP, see [Section 4.5](https://www.ietf.org/archive/id/draft-ietf-oauth-identity-assertion-authz-grant-04.html#section-4.5) for details on how the client can exchange the SAML assertion for a refresh token, then use the refresh token to request an ID-JAG.
### 4.1 Processing Rules
The IdP processes the request according to [Section 4.3.3 of draft-ietf-oauth-identity-assertion-authz-grant](https://www.ietf.org/archive/id/draft-ietf-oauth-identity-assertion-authz-grant-04.html#section-4.3.3). The IdP evaluates administrator-defined policies for the token exchange request and determines if the MCP Client should be granted access to act on behalf of the user for the target MCP Server and scopes.
@ -258,7 +259,6 @@ An MCP Client can determine that a Resource Authorization Server supports this p
In most enterprise deployments, the IdP policy will only allow users to sign in to pre-registered clients. The MCP client will likely need to be pre-registered with the enterprise IdP for single sign-on.
See [Section 5 of draft-ietf-oauth-identity-assertion-authz-grant](https://www.ietf.org/archive/id/draft-ietf-oauth-identity-assertion-authz-grant-04.html#section-5) for how the IdP determines the `client_id` value to include in the ID-JAG.
### 7.2 Scope of Enterprise Visibility and Policy Enforcement