36fcdff044## Summary This PR implements OIDC authentication support for admin users, specifically configured for Google Cloud Identity. The implementation includes: - Configurable OIDC authentication endpoints and validation - Google Cloud Identity integration for admin access - JWT token validation and user session management - Deployment configuration updates for OIDC provider settings Fixes #283
44 lines
2 KiB
Shell
44 lines
2 KiB
Shell
# MCP Registry Configuration
|
|
|
|
# Server configuration
|
|
MCP_REGISTRY_SERVER_ADDRESS=:8080
|
|
MCP_REGISTRY_VERSION=dev
|
|
MCP_REGISTRY_LOG_LEVEL=info
|
|
|
|
# Database configuration
|
|
# Supported types: postgresql, memory
|
|
MCP_REGISTRY_DATABASE_TYPE=postgresql
|
|
MCP_REGISTRY_DATABASE_URL=postgres://username:password@localhost:5432/mcp-registry
|
|
MCP_REGISTRY_DATABASE_NAME=mcp-registry
|
|
MCP_REGISTRY_COLLECTION_NAME=servers_v2
|
|
|
|
# Path or URL to import seed data (supports local files and HTTP URLs)
|
|
MCP_REGISTRY_SEED_FROM=data/seed.json
|
|
|
|
# GitHub OAuth configuration
|
|
# These creds are for local development with the 'MCP Registry Login (Local)' GitHub App
|
|
# They don't provide any real privileged access, hence why it's okay that they're here
|
|
# The staging and prod credentials client secrets are sensitive and are stored in encrypted form in ./deploy
|
|
MCP_REGISTRY_GITHUB_CLIENT_ID=Iv23licy3GSiM9Km5jtd
|
|
MCP_REGISTRY_GITHUB_CLIENT_SECRET=0e8db54879b02c29adef51795586f3c510a9341d
|
|
|
|
# JWT configuration
|
|
# This should be a 32-byte Ed25519 seed (not the full private key). Generate a new seed with: `openssl rand -hex 32`
|
|
MCP_REGISTRY_JWT_PRIVATE_KEY=bb2c6b424005acd5df47a9e2c87f446def86dd740c888ea3efb825b23f7ef47c
|
|
|
|
# Anonymous authentication for development/testing only
|
|
# When enabled, allows anyone to get tokens for publishing to io.modelcontextprotocol.anonymous/* namespace
|
|
# This should be disabled in prod
|
|
MCP_REGISTRY_ENABLE_ANONYMOUS_AUTH=false
|
|
|
|
# Google Cloud Identity OIDC configuration for admin access
|
|
# Enable OIDC authentication for @modelcontextprotocol.io admin accounts
|
|
MCP_REGISTRY_OIDC_ENABLED=false
|
|
# Example for Google Cloud Identity issuer
|
|
MCP_REGISTRY_OIDC_ISSUER=https://accounts.google.com
|
|
MCP_REGISTRY_OIDC_CLIENT_ID=1234.apps.googleusercontent.com
|
|
# Require @modelcontextprotocol.io Google Workspace domain
|
|
MCP_REGISTRY_OIDC_EXTRA_CLAIMS=[{"hd":"modelcontextprotocol.io"}]
|
|
# Grant admin permissions to OIDC-authenticated users
|
|
MCP_REGISTRY_OIDC_EDIT_PERMISSIONS=*
|
|
MCP_REGISTRY_OIDC_PUBLISH_PERMISSIONS=*
|