-
Notifications
You must be signed in to change notification settings - Fork 103
OAuth 2.0 authorization flow #194
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
|
Thanks so much @sveneld to working on this - I'll give it a proper read and test the next days! Do you think we could also bring a test setup into the repo maybe on top of keycloak or fusionauth docker containers in combination with some fixtures? even if microsoft and okta/auth0 are basically the most important ones i like those local test setups for being a bit more flexible and independent or what do you think? |
Nyholm
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Wow, thank you for working on this.
| * | ||
| * @author Volodymyr Panivko <sveneld300@gmail.com> | ||
| */ | ||
| class OAuth2HttpTransport extends StreamableHttpTransport |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is tightly coupled to StreamableHttpTransport. What do you think about making it a part of StreamableHttpTransport instead?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
+1 on this too. Auth is a fundamental part of the StreamableHttpTransport
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ok, I will add it to StreamableHttpTransport
|
Another thought that I just had since I was a bit surprised not to see any 3rd party lib - did you consider using a ready-made package or explicitly tried to avoid it? |
I can make in examples implementation with docker compose for using keycloak
I try to avoid using 3rd party lib for less dependency. If you have any suggestion about 3rd party lib for OAuth implementation which can be used in lib write it and I will look it. |
Motivation and Context
This pull request is a draft implementation of oAuth authorization. Its purpose is to outline the general approach, structure, and integration points for further discussion and iteration. At this stage, it is not intended to be a final solution, but rather a starting point for aligning on the overall direction.
How Has This Been Tested?
I attempted to test the Microsoft oAuth authorization flow using
npx @modelcontextprotocol/inspector.However, due to a known authorization bug in the MCP Inspector, the authorization process cannot be completed successfully at the moment. This issue prevents full end-to-end testing via the Inspector (see modelcontextprotocol/inspector#927).
Breaking Changes
No breaking changes are introduced. Existing functionality remains unaffected, and no updates to user code or configuration are required.
Types of changes
Checklist
Additional context
This pull request is intentionally a draft and is primarily meant to facilitate discussion around the oAuth authorization approach and architecture. The implementation may change significantly based on feedback before moving toward a final version.