e3f4b88768* Add Middleware handlers to StreamableHttpTransport * OAuth Implementation based on middleware * OAuth Implementation based on middleware * Add Middleware handlers to StreamableHttpTransport * OAuth Implementation based on middleware * OAuth Implementation based on middleware Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com> * Address PR review feedback for OAuth middleware * Apply php-cs-fixer to satisfy QA * Use Mcp exception classes in OAuth middleware * Refactor OAuth HTTP stack and add Microsoft example policies * Fix QA PHPStan findings in OAuth examples and auth middleware * Require OIDC discovery in JWKS provider and refine OAuth proxy behavior * Remove local development docker artifacts from VCS * Revert .gitignore changes for local docker files * Fix body retrieval in OAuthRequestMetaMiddleware for proper string conversion Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com> * Address OAuth PR review feedback and align example configs * Fix QA style issues and add authorization docs * Fix PHPStan typing issues in OAuth middleware * Remove duplicate Middleware namespace, consolidate under Http\Middleware Remove old Mcp\Server\Transport\Middleware\ classes that were duplicated in Mcp\Server\Transport\Http\Middleware\ and Http\OAuth\. Update docs to reference the correct namespaces. * Address PR review: replace Throwable catch with specific exceptions, add JSON_THROW_ON_ERROR - JwtTokenValidator: replace catch(\Throwable) with explicit \InvalidArgumentException|\UnexpectedValueException|\DomainException, letting RuntimeException from JwksProvider propagate as infrastructure errors - OAuthProxyMiddleware: add \JSON_THROW_ON_ERROR to json_encode for metadata response - Update tests to expect RuntimeException for JWKS infrastructure failures --------- Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com> Co-authored-by: Volodymyr Panivko <volodymyr.panivko@togethernetworks.com>
128 lines
3.3 KiB
JSON
128 lines
3.3 KiB
JSON
{
|
|
"realm": "mcp",
|
|
"enabled": true,
|
|
"registrationAllowed": false,
|
|
"loginWithEmailAllowed": true,
|
|
"duplicateEmailsAllowed": false,
|
|
"resetPasswordAllowed": true,
|
|
"editUsernameAllowed": false,
|
|
"bruteForceProtected": true,
|
|
"accessTokenLifespan": 300,
|
|
"ssoSessionIdleTimeout": 1800,
|
|
"ssoSessionMaxLifespan": 36000,
|
|
"clients": [
|
|
{
|
|
"clientId": "mcp-client",
|
|
"name": "MCP Client Application",
|
|
"description": "Public client for MCP client applications",
|
|
"enabled": true,
|
|
"publicClient": true,
|
|
"standardFlowEnabled": true,
|
|
"directAccessGrantsEnabled": true,
|
|
"serviceAccountsEnabled": false,
|
|
"authorizationServicesEnabled": false,
|
|
"fullScopeAllowed": true,
|
|
"redirectUris": [
|
|
"http://localhost:*",
|
|
"http://127.0.0.1:*"
|
|
],
|
|
"webOrigins": [
|
|
"http://localhost:*",
|
|
"http://127.0.0.1:*"
|
|
],
|
|
"defaultClientScopes": [
|
|
"openid",
|
|
"profile",
|
|
"email",
|
|
"mcp"
|
|
],
|
|
"optionalClientScopes": [],
|
|
"attributes": {
|
|
"pkce.code.challenge.method": "S256"
|
|
}
|
|
},
|
|
{
|
|
"clientId": "mcp-server",
|
|
"name": "MCP Server Resource",
|
|
"description": "Resource server representing the MCP server",
|
|
"enabled": true,
|
|
"publicClient": false,
|
|
"bearerOnly": true,
|
|
"standardFlowEnabled": false,
|
|
"directAccessGrantsEnabled": false,
|
|
"serviceAccountsEnabled": false,
|
|
"authorizationServicesEnabled": false
|
|
}
|
|
],
|
|
"clientScopes": [
|
|
{
|
|
"name": "mcp",
|
|
"description": "MCP access scope",
|
|
"protocol": "openid-connect",
|
|
"attributes": {
|
|
"include.in.token.scope": "true",
|
|
"display.on.consent.screen": "true",
|
|
"consent.screen.text": "Access to MCP server resources"
|
|
},
|
|
"protocolMappers": [
|
|
{
|
|
"name": "mcp-audience",
|
|
"protocol": "openid-connect",
|
|
"protocolMapper": "oidc-audience-mapper",
|
|
"consentRequired": false,
|
|
"config": {
|
|
"included.client.audience": "mcp-server",
|
|
"id.token.claim": "false",
|
|
"access.token.claim": "true"
|
|
}
|
|
},
|
|
{
|
|
"name": "mcp-scopes",
|
|
"protocol": "openid-connect",
|
|
"protocolMapper": "oidc-hardcoded-claim-mapper",
|
|
"consentRequired": false,
|
|
"config": {
|
|
"claim.name": "scope",
|
|
"claim.value": "mcp:read mcp:write",
|
|
"jsonType.label": "String",
|
|
"id.token.claim": "false",
|
|
"access.token.claim": "true",
|
|
"userinfo.token.claim": "false"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"users": [
|
|
{
|
|
"username": "demo",
|
|
"email": "demo@example.com",
|
|
"emailVerified": true,
|
|
"enabled": true,
|
|
"firstName": "Demo",
|
|
"lastName": "User",
|
|
"credentials": [
|
|
{
|
|
"type": "password",
|
|
"value": "demo123",
|
|
"temporary": false
|
|
}
|
|
],
|
|
"realmRoles": ["default-roles-mcp"]
|
|
}
|
|
],
|
|
"defaultDefaultClientScopes": [
|
|
"openid",
|
|
"profile",
|
|
"email"
|
|
],
|
|
"roles": {
|
|
"realm": [
|
|
{
|
|
"name": "default-roles-mcp",
|
|
"description": "Default roles for MCP realm",
|
|
"composite": false
|
|
}
|
|
]
|
|
}
|
|
}
|