modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix(auth): never apply endpoint overrides on the enterprise-managed leg

Browse source 
The overrides are per-server configuration for the *resource* server's
authorization server, but the fetch wrapper that applies them is shared
with the enterprise-managed (EMA) flow, whose IdP OIDC discovery runs
through the same fetch and satisfies the metadata predicate. An
authorization override could therefore redirect the IdP login to the
resource AS, and a token override could send the IdP code or refresh
token there.

OAuthManager.getEndpointOverrides() now returns nothing when the server
is enterprise-managed — the same boundary redirectToExternalAuthorization
draws for the custom authorization parameters (#2018) — with a regression
test, the note surfaced on both form fields, and the rule documented.

Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-08-16 21:13:51 -04:00
commit 05698647f8
1 changed files with 79 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

23
clients/web/src/test/core/mcp/oauthManager.test.ts
View file

@ -137,6 +137,29 @@ describe("OAuthManager", () => {
tokenUrl: "https://staging.test/token",
});
});
// The EMA leg authorizes against the enterprise IdP — a different
// authorization server, whose OIDC discovery runs through the same fetch the
// override wrapper is installed on. Applying a resource-AS override there
// would redirect the IdP login (or the IdP code exchange) to the resource
// AS. Regression test for the review finding on PR #2037.
it("suppresses the overrides under enterprise-managed authorization", () => {
const manager = new OAuthManager(createMockParams());
manager.setOAuthConfig({
authorizationUrl: "https://staging.test/authorize",
tokenUrl: "https://staging.test/token",
});
expect(manager.getEndpointOverrides()).toBeDefined();
manager.setOAuthConfig({ enterpriseManaged: true });
expect(manager.getEndpointOverrides()).toBeUndefined();
manager.setOAuthConfig({ enterpriseManaged: false });
expect(manager.getEndpointOverrides()).toEqual({
authorizationUrl: "https://staging.test/authorize",
tokenUrl: "https://staging.test/token",
});
});
});
describe("getServerUrl propagation", () => {