[Server] feat: relax StrictOidcDiscoveryMetadataPolicy and add Dynamic Client Registration middleware (RFC 7591) (#269)
* feat: relax OIDC discovery policy and add Dynamic Client Registration middleware (RFC 7591) - Add LenientOidcDiscoveryMetadataPolicy for providers that omit code_challenge_methods_supported (e.g. FusionAuth, Microsoft Entra ID) - Keep StrictOidcDiscoveryMetadataPolicy RFC-aligned - Add ClientRegistrationMiddleware handling POST /register and enriching /.well-known/oauth-authorization-server with registration_endpoint - Update Microsoft example to use built-in LenientOidcDiscoveryMetadataPolicy * fix: move metadata policy note under server.php in Files section Address review comment: the LenientOidcDiscoveryMetadataPolicy bullet was a behavioral note, not a file entry. Inline it into the server.php description to keep the Files list consistent. * fix: address Copilot review comments on ClientRegistrationMiddleware - Decode JSON with assoc=true for registrar data so nested objects are associative arrays, not stdClass instances - Add Cache-Control: no-store to all error responses (400), not just the success response (201) - Rewind response body stream before returning unmodified response when metadata is not valid JSON, preventing empty body on read * fix: harden ClientRegistrationMiddleware and improve test coverage - Revert spurious .gitignore trailing newline - Use JSON_THROW_ON_ERROR consistently in enrichAuthServerMetadata() - Add comment clarifying the second json_decode in handleRegistration() - Assert Cache-Control: no-store on registrar exception error response - Add test for non-object JSON body in metadata enrichment path - Extract createPlainTextHandler helper for non-JSON response tests * fix: reject JSON array bodies in metadata enrichment Treat JSON list arrays (e.g. [] or ["..."]) as invalid metadata in enrichAuthServerMetadata() to prevent corrupting the response shape by adding registration_endpoint to a non-object. * fix: add RFC 7591 error codes, Content-Type validation, and docblock safety warning Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Christopher Hertel <mail@christopher-hertel.de> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
simon chrzanowski
GitHub
parent
5d57b685a2
commit
863cfc1e78
4 changed files with 963 additions and 110 deletions
|
|
@ -1,38 +0,0 @@
|
|||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
/*
|
||||
* This file is part of the official PHP MCP SDK.
|
||||
*
|
||||
* A collaboration between Symfony and the PHP Foundation.
|
||||
*
|
||||
* For the full copyright and license information, please view the LICENSE
|
||||
* file that was distributed with this source code.
|
||||
*/
|
||||
|
||||
namespace Mcp\Example\Server\OAuthMicrosoft;
|
||||
|
||||
use Mcp\Server\Transport\Http\OAuth\OidcDiscoveryMetadataPolicyInterface;
|
||||
|
||||
/**
|
||||
* Lenient metadata policy for Microsoft discovery quirks.
|
||||
*
|
||||
* `code_challenge_methods_supported` is optional in this policy.
|
||||
*
|
||||
* @author Volodymyr Panivko <sveneld300@gmail.com>
|
||||
*/
|
||||
final class MicrosoftOidcMetadataPolicy implements OidcDiscoveryMetadataPolicyInterface
|
||||
{
|
||||
public function isValid(mixed $metadata): bool
|
||||
{
|
||||
return \is_array($metadata)
|
||||
&& isset($metadata['authorization_endpoint'], $metadata['token_endpoint'], $metadata['jwks_uri'])
|
||||
&& \is_string($metadata['authorization_endpoint'])
|
||||
&& '' !== trim($metadata['authorization_endpoint'])
|
||||
&& \is_string($metadata['token_endpoint'])
|
||||
&& '' !== trim($metadata['token_endpoint'])
|
||||
&& \is_string($metadata['jwks_uri'])
|
||||
&& '' !== trim($metadata['jwks_uri']);
|
||||
}
|
||||
}
|
||||
|
|
@ -148,9 +148,8 @@ curl -X POST http://localhost:8000/mcp \
|
|||
- `Dockerfile` - PHP-FPM container
|
||||
- `nginx/default.conf` - Nginx configuration
|
||||
- `env.example` - Environment variables template
|
||||
- `server.php` - MCP server with OAuth middleware
|
||||
- `server.php` - MCP server with OAuth middleware (uses built-in `LenientOidcDiscoveryMetadataPolicy` for metadata validation)
|
||||
- `MicrosoftJwtTokenValidator.php` - Example-specific validator for Graph/non-Graph tokens
|
||||
- `MicrosoftOidcMetadataPolicy.php` - Lenient metadata validation policy
|
||||
- `McpElements.php` - MCP tools including Graph API integration
|
||||
|
||||
## Environment Variables
|
||||
|
|
@ -198,8 +197,10 @@ Microsoft's JWKS endpoint is public. Ensure your container can reach:
|
|||
|
||||
### `code_challenge_methods_supported` missing in discovery metadata
|
||||
|
||||
This example configures `OidcDiscovery` with `MicrosoftOidcMetadataPolicy`, so this
|
||||
field can be missing or malformed and will not fail discovery.
|
||||
The default `StrictOidcDiscoveryMetadataPolicy` requires `code_challenge_methods_supported`.
|
||||
Microsoft Entra ID omits this field despite supporting PKCE with S256.
|
||||
This example uses the built-in `LenientOidcDiscoveryMetadataPolicy` which accepts missing
|
||||
`code_challenge_methods_supported` (defaults to S256 downstream).
|
||||
|
||||
### Graph API errors
|
||||
|
||||
|
|
|
|||
|
|
@ -16,7 +16,6 @@ require_once dirname(__DIR__).'/bootstrap.php';
|
|||
use Http\Discovery\Psr17Factory;
|
||||
use Laminas\HttpHandlerRunner\Emitter\SapiEmitter;
|
||||
use Mcp\Example\Server\OAuthMicrosoft\MicrosoftJwtTokenValidator;
|
||||
use Mcp\Example\Server\OAuthMicrosoft\MicrosoftOidcMetadataPolicy;
|
||||
use Mcp\Server;
|
||||
use Mcp\Server\Session\FileSessionStore;
|
||||
use Mcp\Server\Transport\Http\Middleware\AuthorizationMiddleware;
|
||||
|
|
@ -25,6 +24,7 @@ use Mcp\Server\Transport\Http\Middleware\OAuthRequestMetaMiddleware;
|
|||
use Mcp\Server\Transport\Http\Middleware\ProtectedResourceMetadataMiddleware;
|
||||
use Mcp\Server\Transport\Http\OAuth\JwksProvider;
|
||||
use Mcp\Server\Transport\Http\OAuth\JwtTokenValidator;
|
||||
use Mcp\Server\Transport\Http\OAuth\LenientOidcDiscoveryMetadataPolicy;
|
||||
use Mcp\Server\Transport\Http\OAuth\OidcDiscovery;
|
||||
use Mcp\Server\Transport\Http\OAuth\ProtectedResourceMetadata;
|
||||
use Mcp\Server\Transport\StreamableHttpTransport;
|
||||
|
|
@ -37,7 +37,7 @@ $issuerV1 = "https://sts.windows.net/{$tenantId}/";
|
|||
$localBaseUrl = 'http://localhost:8000';
|
||||
|
||||
$discovery = new OidcDiscovery(
|
||||
metadataPolicy: new MicrosoftOidcMetadataPolicy(),
|
||||
metadataPolicy: new LenientOidcDiscoveryMetadataPolicy(),
|
||||
);
|
||||
|
||||
$jwtTokenValidator = new JwtTokenValidator(
|
||||
|
|
|
|||
|
|
@ -1,64 +0,0 @@
|
|||
<?php
|
||||
|
||||
/*
|
||||
* This file is part of the official PHP MCP SDK.
|
||||
*
|
||||
* A collaboration between Symfony and the PHP Foundation.
|
||||
*
|
||||
* For the full copyright and license information, please view the LICENSE
|
||||
* file that was distributed with this source code.
|
||||
*/
|
||||
|
||||
namespace Mcp\Example\Server\OAuthMicrosoft\Tests\Unit;
|
||||
|
||||
use Mcp\Example\Server\OAuthMicrosoft\MicrosoftOidcMetadataPolicy;
|
||||
use PHPUnit\Framework\Attributes\TestDox;
|
||||
use PHPUnit\Framework\TestCase;
|
||||
|
||||
/**
|
||||
* Tests MicrosoftOidcMetadataPolicy validation behavior.
|
||||
*
|
||||
* @author Volodymyr Panivko <sveneld300@gmail.com>
|
||||
*/
|
||||
class MicrosoftOidcMetadataPolicyTest extends TestCase
|
||||
{
|
||||
#[TestDox('metadata without code challenge methods is accepted')]
|
||||
public function testMissingCodeChallengeMethodsIsAccepted(): void
|
||||
{
|
||||
$policy = new MicrosoftOidcMetadataPolicy();
|
||||
$metadata = [
|
||||
'authorization_endpoint' => 'https://auth.example.com/authorize',
|
||||
'token_endpoint' => 'https://auth.example.com/token',
|
||||
'jwks_uri' => 'https://auth.example.com/jwks',
|
||||
];
|
||||
|
||||
$this->assertTrue($policy->isValid($metadata));
|
||||
}
|
||||
|
||||
#[TestDox('malformed code challenge methods are ignored for validity')]
|
||||
public function testMalformedCodeChallengeMethodsSupportedIsAccepted(): void
|
||||
{
|
||||
$policy = new MicrosoftOidcMetadataPolicy();
|
||||
$metadata = [
|
||||
'authorization_endpoint' => 'https://auth.example.com/authorize',
|
||||
'token_endpoint' => 'https://auth.example.com/token',
|
||||
'jwks_uri' => 'https://auth.example.com/jwks',
|
||||
'code_challenge_methods_supported' => 'S256',
|
||||
];
|
||||
|
||||
$this->assertTrue($policy->isValid($metadata));
|
||||
}
|
||||
|
||||
#[TestDox('required endpoint fields still enforce validity')]
|
||||
public function testIsValidRequiresCoreEndpoints(): void
|
||||
{
|
||||
$policy = new MicrosoftOidcMetadataPolicy();
|
||||
$metadata = [
|
||||
'authorization_endpoint' => 'https://auth.example.com/authorize',
|
||||
// token_endpoint missing
|
||||
'jwks_uri' => 'https://auth.example.com/jwks',
|
||||
];
|
||||
|
||||
$this->assertFalse($policy->isValid($metadata));
|
||||
}
|
||||
}
|
||||
Loading…
Reference in a new issue