2d43865b97`auth`, `oauthex`: implement Enterprise Managed Authorization (SEP-990) This PR implements Enterprise Managed Authorization (SEP-990) for the Go MCP SDK, enabling MCP Clients and Servers to leverage enterprise Identity Providers for seamless authorization without requiring users to authenticate separately to each MCP Server. Overview Enterprise Managed Authorization follows the Identity Assertion Authorization Grant specification (draft-ietf-oauth-identity-assertion-authz-grant), implementing a three-step flow: 1. **Single Sign-On (SSO)**: User authenticates to the MCP Client via enterprise IdP (Okta, Auth0, Azure AD, etc.) 2. **Token Exchange (RFC 8693)**: Client exchanges ID Token for Identity Assertion JWT Authorization Grant (ID-JAG) at the IdP 3. **JWT Bearer Grant (RFC 7523)**: Client exchanges ID-JAG for Access Token at the MCP Server This enables: - **For end users**: Single sign-on across MCP Clients and Servers—no manual connection/authorization per server - **For enterprise admins**: Centralized visibility and control over which MCP Servers can be used within the organization - **For MCP clients**: Automatic token acquisition without user interaction for each server Closes: [#628](https://github.com/modelcontextprotocol/go-sdk/issues/628) --------- Co-authored-by: Maciej Kisiel <mkisiel@google.com>
71 lines
2.5 KiB
Go
71 lines
2.5 KiB
Go
// Copyright 2026 The Go MCP SDK Authors. All rights reserved.
|
|
// Use of this source code is governed by an MIT-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
// This file contains shared utilities for OAuth handlers.
|
|
|
|
//go:build mcp_go_client_oauth
|
|
|
|
package auth
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"net/url"
|
|
"strings"
|
|
|
|
"github.com/modelcontextprotocol/go-sdk/oauthex"
|
|
)
|
|
|
|
// GetAuthServerMetadata fetches authorization server metadata for the given issuer URL.
|
|
// It tries standard well-known endpoints (OAuth 2.0 and OIDC) and returns the first successful result.
|
|
//
|
|
// Returns (nil, nil) when no metadata endpoints respond (404s), allowing callers to implement
|
|
// fallback logic. Returns an error for any non-client error (network failures, invalid JSON, etc.).
|
|
func GetAuthServerMetadata(ctx context.Context, issuerURL string, httpClient *http.Client) (*oauthex.AuthServerMeta, error) {
|
|
for _, metadataURL := range authorizationServerMetadataURLs(issuerURL) {
|
|
asm, err := oauthex.GetAuthServerMeta(ctx, metadataURL, issuerURL, httpClient)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if asm != nil {
|
|
return asm, nil
|
|
}
|
|
}
|
|
return nil, nil
|
|
}
|
|
|
|
// authorizationServerMetadataURLs returns a list of URLs to try when looking for
|
|
// authorization server metadata as mandated by the MCP specification:
|
|
// https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#authorization-server-metadata-discovery.
|
|
func authorizationServerMetadataURLs(issuerURL string) []string {
|
|
var urls []string
|
|
|
|
baseURL, err := url.Parse(issuerURL)
|
|
if err != nil {
|
|
return nil
|
|
}
|
|
|
|
if baseURL.Path == "" {
|
|
// "OAuth 2.0 Authorization Server Metadata".
|
|
baseURL.Path = "/.well-known/oauth-authorization-server"
|
|
urls = append(urls, baseURL.String())
|
|
// "OpenID Connect Discovery 1.0".
|
|
baseURL.Path = "/.well-known/openid-configuration"
|
|
urls = append(urls, baseURL.String())
|
|
return urls
|
|
}
|
|
|
|
originalPath := baseURL.Path
|
|
// "OAuth 2.0 Authorization Server Metadata with path insertion".
|
|
baseURL.Path = "/.well-known/oauth-authorization-server/" + strings.TrimLeft(originalPath, "/")
|
|
urls = append(urls, baseURL.String())
|
|
// "OpenID Connect Discovery 1.0 with path insertion".
|
|
baseURL.Path = "/.well-known/openid-configuration/" + strings.TrimLeft(originalPath, "/")
|
|
urls = append(urls, baseURL.String())
|
|
// "OpenID Connect Discovery 1.0 with path appending".
|
|
baseURL.Path = "/" + strings.Trim(originalPath, "/") + "/.well-known/openid-configuration"
|
|
urls = append(urls, baseURL.String())
|
|
|
|
return urls
|
|
}
|