modelcontextprotocol/php-sdk
Watch
1
0
Fork
You've already forked php-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(adr): scope OAuth to resource server, not authorization server (#382)

Browse source 
Record ADR 0001: the MCP server is an OAuth 2.1 Resource Server that MAY
delegate to an upstream authorization server, and will NOT issue tokens or
act as an Identity Provider. Gives a single citable ruling to decline the
recurring "native authorization server" PRs (e.g. #373).

Also remove the surface signal that invites them: reframe the
OAuthProxyMiddleware class docblock to lead with its delegation intent and
state explicit non-goals (never mints/signs/stores/rotates tokens), and add
a "Scope" section to docs/authorization.md describing the three OAuth roles
and what the SDK does not do.

No behavior change — docblock, docs, and ADR only.
This commit is contained in:
Antoine Bluchet 2026-07-06 00:37:19 +02:00 • committed by GitHub
commit 1587ac5bd2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 138 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

19
src/Server/Transport/Http/Middleware/OAuthProxyMiddleware.php
View file

@ -26,15 +26,20 @@ use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;
/**
* Proxies OAuth authorization requests to an upstream authorization server.
* Delegates OAuth flows to an upstream authorization server so you do NOT have to build one.
*
* This middleware implements the OAuth proxy pattern for MCP servers that
* delegate authorization to third-party OAuth providers (Microsoft, Keycloak, etc.).
* This middleware exists precisely so the MCP server does not become an authorization server:
* it forwards the OAuth endpoints to your existing upstream Identity Provider (Microsoft Entra
* ID, Keycloak, Auth0, Okta, league/oauth2-server, etc.) instead of issuing tokens itself.
*
* It handles:
* - /authorize: Redirects to the upstream authorization server
* - /token: Proxies token requests to the upstream token endpoint
* - /.well-known/oauth-authorization-server: Serves authorization server metadata
* It delegates:
* - /authorize: Redirects the user agent to the upstream authorization endpoint
* - /token: Proxies the token request to the upstream token endpoint and returns its response
* - /.well-known/oauth-authorization-server: Serves metadata pointing at this delegating proxy
*
* Non-goals: this middleware never issues, mints, signs, stores, or rotates tokens, and the SDK
* is not an OAuth authorization server / Identity Provider. See
* adr/0001-oauth-authorization-server-out-of-scope.md.
*
* @author Volodymyr Panivko <sveneld300@gmail.com>
*/