Skip to content

feat: enhance auth server discovery with OAuth2 and OIDC metadata support #677

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
localden merged 1 commit into from
Jun 17, 2025
Merged

feat: enhance auth server discovery with OAuth2 and OIDC metadata support #677

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 16 additions & 10 deletions docs/specification/draft/basic/authorization.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,9 +50,12 @@ while maintaining simplicity:
1. MCP servers **MUST** implement OAuth 2.0 Protected Resource Metadata ([RFC9728](https://datatracker.ietf.org/doc/html/rfc9728)).
MCP clients **MUST** use OAuth 2.0 Protected Resource Metadata for authorization server discovery.

1. MCP authorization servers **MUST** provide OAuth 2.0 Authorization
Server Metadata ([RFC8414](https://datatracker.ietf.org/doc/html/rfc8414)).
MCP clients **MUST** use the OAuth 2.0 Authorization Server Metadata.
1. MCP authorization servers **MUST** provide at least one of the following discovery mechanisms:

- OAuth 2.0 Authorization Server Metadata ([RFC8414](https://datatracker.ietf.org/doc/html/rfc8414))
- [OpenID Connect Discovery 1.0](https://openid.net/specs/openid-connect-discovery-1_0-final.html)

MCP clients **MUST** support both discovery mechanisms to obtain the information required to interact with the authorization server.

### Roles

Expand Down Expand Up @@ -91,11 +94,6 @@ as described in [RFC9728 Section 5.1 "WWW-Authenticate Response"](https://datatr

MCP clients **MUST** be able to parse `WWW-Authenticate` headers and respond appropriately to `HTTP 401 Unauthorized` responses from the MCP server.

#### Server Metadata Discovery

MCP clients **MUST** follow the OAuth 2.0 Authorization Server Metadata [RFC8414](https://datatracker.ietf.org/doc/html/rfc8414)
specification to obtain the information required to interact with the authorization server.

#### Sequence Diagram

The following diagram outlines an example flow:
Expand All @@ -114,7 +112,11 @@ sequenceDiagram
M-->>C: Resource metadata with authorization server URL
Note over C: Validate RS metadata,<br />build AS metadata URL

C->>A: GET /.well-known/oauth-authorization-server
alt OAuth 2.0 Authorization Server Metadata
C->>A: GET /.well-known/oauth-authorization-server
else OpenID Connect Discovery
C->>A: GET /.well-known/openid-configuration
end
A-->>C: Authorization server metadata

Note over C,A: OAuth 2.1 authorization flow happens here
Expand Down Expand Up @@ -170,7 +172,11 @@ sequenceDiagram

Note over C: Parse metadata and extract authorization server(s)<br/>Client determines AS to use

C->>A: GET /.well-known/oauth-authorization-server
alt OAuth 2.0 Authorization Server Metadata
C->>A: GET /.well-known/oauth-authorization-server
else OpenID Connect Discovery
C->>A: GET /.well-known/openid-configuration
end
A->>C: Authorization server metadata response

alt Dynamic client registration
Expand Down