863cfc1e78* feat: relax OIDC discovery policy and add Dynamic Client Registration middleware (RFC 7591) - Add LenientOidcDiscoveryMetadataPolicy for providers that omit code_challenge_methods_supported (e.g. FusionAuth, Microsoft Entra ID) - Keep StrictOidcDiscoveryMetadataPolicy RFC-aligned - Add ClientRegistrationMiddleware handling POST /register and enriching /.well-known/oauth-authorization-server with registration_endpoint - Update Microsoft example to use built-in LenientOidcDiscoveryMetadataPolicy * fix: move metadata policy note under server.php in Files section Address review comment: the LenientOidcDiscoveryMetadataPolicy bullet was a behavioral note, not a file entry. Inline it into the server.php description to keep the Files list consistent. * fix: address Copilot review comments on ClientRegistrationMiddleware - Decode JSON with assoc=true for registrar data so nested objects are associative arrays, not stdClass instances - Add Cache-Control: no-store to all error responses (400), not just the success response (201) - Rewind response body stream before returning unmodified response when metadata is not valid JSON, preventing empty body on read * fix: harden ClientRegistrationMiddleware and improve test coverage - Revert spurious .gitignore trailing newline - Use JSON_THROW_ON_ERROR consistently in enrichAuthServerMetadata() - Add comment clarifying the second json_decode in handleRegistration() - Assert Cache-Control: no-store on registrar exception error response - Add test for non-object JSON body in metadata enrichment path - Extract createPlainTextHandler helper for non-JSON response tests * fix: reject JSON array bodies in metadata enrichment Treat JSON list arrays (e.g. [] or ["..."]) as invalid metadata in enrichAuthServerMetadata() to prevent corrupting the response shape by adding registration_endpoint to a non-object. * fix: add RFC 7591 error codes, Content-Type validation, and docblock safety warning Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Christopher Hertel <mail@christopher-hertel.de> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
91 lines
3.1 KiB
PHP
91 lines
3.1 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
/*
|
|
* This file is part of the official PHP MCP SDK.
|
|
*
|
|
* A collaboration between Symfony and the PHP Foundation.
|
|
*
|
|
* For the full copyright and license information, please view the LICENSE
|
|
* file that was distributed with this source code.
|
|
*/
|
|
|
|
require_once dirname(__DIR__).'/bootstrap.php';
|
|
|
|
use Http\Discovery\Psr17Factory;
|
|
use Laminas\HttpHandlerRunner\Emitter\SapiEmitter;
|
|
use Mcp\Example\Server\OAuthMicrosoft\MicrosoftJwtTokenValidator;
|
|
use Mcp\Server;
|
|
use Mcp\Server\Session\FileSessionStore;
|
|
use Mcp\Server\Transport\Http\Middleware\AuthorizationMiddleware;
|
|
use Mcp\Server\Transport\Http\Middleware\OAuthProxyMiddleware;
|
|
use Mcp\Server\Transport\Http\Middleware\OAuthRequestMetaMiddleware;
|
|
use Mcp\Server\Transport\Http\Middleware\ProtectedResourceMetadataMiddleware;
|
|
use Mcp\Server\Transport\Http\OAuth\JwksProvider;
|
|
use Mcp\Server\Transport\Http\OAuth\JwtTokenValidator;
|
|
use Mcp\Server\Transport\Http\OAuth\LenientOidcDiscoveryMetadataPolicy;
|
|
use Mcp\Server\Transport\Http\OAuth\OidcDiscovery;
|
|
use Mcp\Server\Transport\Http\OAuth\ProtectedResourceMetadata;
|
|
use Mcp\Server\Transport\StreamableHttpTransport;
|
|
|
|
$tenantId = getenv('AZURE_TENANT_ID') ?: throw new RuntimeException('AZURE_TENANT_ID environment variable is required');
|
|
$clientId = getenv('AZURE_CLIENT_ID') ?: throw new RuntimeException('AZURE_CLIENT_ID environment variable is required');
|
|
|
|
$issuerV2 = "https://login.microsoftonline.com/{$tenantId}/v2.0";
|
|
$issuerV1 = "https://sts.windows.net/{$tenantId}/";
|
|
$localBaseUrl = 'http://localhost:8000';
|
|
|
|
$discovery = new OidcDiscovery(
|
|
metadataPolicy: new LenientOidcDiscoveryMetadataPolicy(),
|
|
);
|
|
|
|
$jwtTokenValidator = new JwtTokenValidator(
|
|
issuer: [$issuerV2, $issuerV1],
|
|
audience: $clientId,
|
|
jwksProvider: new JwksProvider($discovery),
|
|
jwksUri: 'https://login.microsoftonline.com/common/discovery/v2.0/keys',
|
|
scopeClaim: 'scp',
|
|
);
|
|
|
|
$validator = new MicrosoftJwtTokenValidator($jwtTokenValidator);
|
|
|
|
$protectedResourceMetadata = new ProtectedResourceMetadata(
|
|
authorizationServers: [$localBaseUrl],
|
|
scopesSupported: ['openid', 'profile', 'email'],
|
|
resourceName: 'OAuth Microsoft Example MCP Server',
|
|
resourceDocumentation: $localBaseUrl,
|
|
);
|
|
|
|
$metadataMiddleware = new ProtectedResourceMetadataMiddleware($protectedResourceMetadata);
|
|
|
|
$clientSecret = getenv('AZURE_CLIENT_SECRET') ?: null;
|
|
|
|
$oauthProxyMiddleware = new OAuthProxyMiddleware(
|
|
upstreamIssuer: $issuerV2,
|
|
localBaseUrl: $localBaseUrl,
|
|
discovery: $discovery,
|
|
clientSecret: $clientSecret,
|
|
);
|
|
|
|
$authMiddleware = new AuthorizationMiddleware(
|
|
$validator,
|
|
$protectedResourceMetadata,
|
|
);
|
|
|
|
$server = Server::builder()
|
|
->setServerInfo('OAuth Microsoft Example', '1.0.0')
|
|
->setLogger(logger())
|
|
->setSession(new FileSessionStore(__DIR__.'/sessions'))
|
|
->setDiscovery(__DIR__)
|
|
->build();
|
|
|
|
$transport = new StreamableHttpTransport(
|
|
(new Psr17Factory())->createServerRequestFromGlobals(),
|
|
logger: logger(),
|
|
middleware: [$oauthProxyMiddleware, $metadataMiddleware, $authMiddleware, new OAuthRequestMetaMiddleware()],
|
|
);
|
|
|
|
$response = $server->run($transport);
|
|
|
|
(new SapiEmitter())->emit($response);
|