09d4bf41aa
## Motivation and Context An MCP server chooses the authorization server its users sign in to. It names one in `authorization_servers` in its Protected Resource Metadata, and states the scopes it wants in `scopes_supported` or in the `WWW-Authenticate` challenge. Nothing binds either choice to the server's own identity. No origin rule can settle this, because an authorization server is legitimately a different origin from the resource it protects. Validating that a token was issued for the intended audience is a responsibility the specification places on MCP servers rather than on clients, and there is no portable way for a client to perform it either: access tokens are frequently opaque, and an authorization server is not required to honor the `resource` parameter or to report an audience in the token response. Two things follow from that, and they are separate. The first is a judgement, and it belongs to whoever embeds this SDK, because an application often knows which providers its users deal with. `authorization_request_validator` is handed an `AuthorizationRequest` describing the authorization server, the scopes, the MCP server, and the RFC 8707 resource, and can refuse. It is one object rather than keyword arguments so that later revisions of the specification can add to it without changing the shape implementers wrote. It runs on all three grants, and on the authorization-code grant it runs before dynamic client registration, which is why scope resolution moved above `ensure_client_registered`: a refusal must not leave this client registered at an authorization server the host just rejected. The second is not a judgement and is enforced here rather than asked about. `refresh!` rediscovers the authorization server on every call, so the server named for a session can differ from the one the stored tokens came from. SEP-2352 already binds client credentials to their issuer, but that check passes when the issuer was never recorded and is deliberately skipped for a Client ID Metadata Document URL, which is portable across authorization servers. The issuer that minted the tokens is now recorded with them, and `refresh!` refuses to present them to a different one. The transport answers that refusal by running a full authorization, which brings the new authorization server to the validator above. Tokens stored before this carry no issuer and keep refreshing. The hook decides whether to proceed, not what to ask for. The scopes reach the authorization server unchanged either way, because the specification requires a client to treat the scopes in the challenge as authoritative for the operation, and narrowing them silently would break that. ## How Has This Been Tested? New tests in `test/mcp/client/oauth/flow_test.rb` assert what the validator receives, that a refusal raises before any registration request is sent and before the redirect handler runs, and that the `client_credentials` and `jwt-bearer` grants consult it too. Others cover the issuer recorded on authorization, the refusal to refresh against a different one, and that tokens stored without an issuer still refresh. A test in `test/mcp/client/oauth/http_oauth_test.rb` drives the two halves together: a stale issuer makes the refresh fail, the transport reauthorizes, and the validator sees the newly named authorization server while no refresh token is ever posted to it. Each of them fails with its half of this change removed. `bundle exec rake` (tests, RuboCop, and conformance baseline) passes. ## Breaking Changes Refreshing now fails when the authorization server named for a session differs from the one that issued the stored tokens, and the caller reauthorizes instead. Tokens stored before this change carry no recorded issuer and are unaffected until their next authorization. The validator itself is additive: it defaults to `nil`, and a provider that does not offer it authorizes as before.
26 lines
976 B
Ruby
26 lines
976 B
Ruby
# frozen_string_literal: true
|
|
|
|
require_relative "oauth/authorization_request"
|
|
require_relative "oauth/bounded_body"
|
|
require_relative "oauth/discovery"
|
|
require_relative "oauth/flow"
|
|
require_relative "oauth/in_memory_storage"
|
|
require_relative "oauth/pkce"
|
|
require_relative "oauth/storage_backed_provider"
|
|
require_relative "oauth/jwt_client_assertion"
|
|
require_relative "oauth/provider"
|
|
require_relative "oauth/client_credentials_provider"
|
|
require_relative "oauth/id_jag_token_exchange"
|
|
require_relative "oauth/cross_app_access_provider"
|
|
|
|
module MCP
|
|
class Client
|
|
# OAuth client support for the MCP Authorization spec (PRM discovery,
|
|
# Authorization Server metadata discovery, Dynamic Client Registration,
|
|
# OAuth 2.1 Authorization Code + PKCE, the client_credentials grant,
|
|
# and the SEP-990 Enterprise Managed Authorization jwt-bearer grant).
|
|
# https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization
|
|
module OAuth
|
|
end
|
|
end
|
|
end
|