Feat: Separate authorization server and resource server on client auth flow #416

0Itsuki0 · 2025-04-27T10:25:02Z

Conform to the new authentication protocol by separating authorization server and resource server.

add function to discover protected resource metadata
use the discovered authorization server url for the auth flow

Motivation and Context

Ensure the sdk functionality conforms to the protocol specification.

How Has This Been Tested?

npm test

Modifying Existing tests to make sure they all past
Add couple new tests for the authorization-related functions

Breaking Changes

Yes.

The functions arguments in auth.ts other than the auth() function requires authorization server url instead of resource server url.
The flow requires the server to implement OAuth 2.0 Protected Resource Metadata as specified in the authorization section of the protocol.

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Documentation update

Checklist

I have read the MCP Documentation
My code follows the repository's style guidelines
New and existing tests pass locally
I have added appropriate error handling
I have added or updated documentation as needed

Additional context

None.

authorization server url to avoid fetching Protected Resource Metadata every time

add function to discover protected resource metadata

QuantGeekDev · 2025-05-07T12:31:38Z

Looking quite good. Thanks for the blog post on this. I'm going to test this out

QuantGeekDev · 2025-05-07T12:39:10Z

Code also looks good

0Itsuki0 · 2025-05-07T20:15:26Z

Code also looks good

Thank you!

The spec seems to be still under construction, especially the toke validation parts. I am willing to add more if necessary but probably at a different branch would be better?

QuantGeekDev · 2025-05-11T18:09:14Z

@0Itsuki0 I built a mcp server with the latest draft of the spec - maybe we can try the client against this? I've been testing with my postman collection so far

0Itsuki0 · 2025-05-12T11:42:29Z

@0Itsuki0 I built a mcp server with the latest draft of the spec - maybe we can try the client against this? I've been testing with my postman collection so far

thank you for the server!

I will be happy to try it out and let you know how it goes!

QuantGeekDev · 2025-05-12T16:24:40Z

@0Itsuki0 Let me know if I can help with anything. I'm taking a look at the server aspect of the new auth spec

0Itsuki0 · 2025-05-17T23:25:10Z

@QuantGeekDev
Hey, I am currently testing out with the MCP server you have shared. I am getting an invalid_request Missing authorization header error while fetching the /.well-known/oauth-protected-resource endpoint. I don't think this endpoint should requires any authorization...
Am I missing anything?

pcarleton

Thanks for sending this! Apologies for the slow response.

I added a few comments. The most substantial was around including resource in the authorization url, which isn't in the spec (but might have been in an earlier draft).

other things were:

some extra log lines
RFC number fix
an import path

It looks like it also needs some merge conflict resolution.

I'm attempting to test this with the server supporting the new spec I've implemented in: #503 , but it will require an example client impl. I'll see about stacking a PR with the example on it

src/client/auth.ts

src/client/sse.ts

src/client/sse.test.ts

src/shared/auth.ts

src/client/auth.ts

src/client/auth.test.ts

src/client/auth.ts

Co-authored-by: Paul Carleton <[email protected]>

0Itsuki0 · 2025-05-20T06:04:40Z

@pcarleton
Thank you for the suggestions!
I have committed those changes as well as resolved the conflict!
Please take a look when you get some time.

pcarleton

thanks for the changes! one more thing

pcarleton · 2025-05-20T19:00:39Z

src/client/auth.ts

    authorizationCode?: string;
    scope?: string;
-  }): Promise<AuthResult> {
-  const metadata = await discoverOAuthMetadata(serverUrl);


hey sorry missed this on the first go through, but we'll want to change this to be backwards compatible. Not all servers will support the new metadata endpoint immediately, so we need to try the new metadata path, and if that doesn't bear fruit, fall back to calling discoverOAuthMetadata(serverUrl)

Got it!
Thank you for pointing it out!

pcarleton · 2025-05-21T13:55:27Z

(reviewed offline w/ @ihrpr , merging this one)

thanks again @0Itsuki0 !

jescalan · 2025-05-23T03:12:26Z

src/client/auth.ts

+    const resourceMetadata = await discoverOAuthProtectedResourceMetadata(
+      resourceMetadataUrl || serverUrl);
+
+    if (resourceMetadata.authorization_servers && resourceMetadata.authorization_servers.length > 0) {


It feels like we could possibly expose a better interface in this scenario - perhaps a function on the provider that would be called when there is more than one authorization server returned from the protected resource metadata that would pass in the array of servers and utilize the one returned from the function. Happy to PR this in if you feel like it makes sense!

itsuki added 6 commits April 27, 2025 19:01

add type and schema for protected resource metadata

b90d5ba

add private variable to keep track of

0ce2da8

authorization server url to avoid fetching Protected Resource Metadata every time

change auth flow to use authroization server and

3c69e5d

add function to discover protected resource metadata

add/modify tests for new added auth functions

9f6aa38

modify test to use the authorization server

bfabc37

remove unused variable

956094b

0Itsuki0 marked this pull request as ready for review April 27, 2025 10:25

0Itsuki0 force-pushed the auth-client branch from 5360e03 to 956094b Compare April 28, 2025 03:43

itsuki and others added 3 commits April 28, 2025 12:47

add resource parameter when building auth url

130b4fe

Change resource to use the protected resource metadata

d6772e0

Merge branch 'main' into auth-client

6316d4f

0Itsuki0 changed the title ~~Separate authorization server and resource server on client auth flow~~ Feat: Separate authorization server and resource server on client auth flow Apr 28, 2025

pcarleton mentioned this pull request May 16, 2025

feat: Add support for separate Authorization Server / Resource server in server flow (spec: DRAFT-2025-v2) #503

Merged

9 tasks

pcarleton requested changes May 19, 2025

View reviewed changes

0Itsuki0 and others added 9 commits May 20, 2025 14:51

resolve typo.

eb43c47

Co-authored-by: Paul Carleton <[email protected]>

Update src/client/sse.ts import.

4024554

Co-authored-by: Paul Carleton <[email protected]>

remove log.

6a63681

Co-authored-by: Paul Carleton <[email protected]>

Update section title.

ff65f81

Co-authored-by: Paul Carleton <[email protected]>

remove log.

c3cd5af

Co-authored-by: Paul Carleton <[email protected]>

remove resource parameter.

b2878fb

Co-authored-by: Paul Carleton <[email protected]>

remove resource parameter.

a3e2f71

Co-authored-by: Paul Carleton <[email protected]>

remove resource parameter.

ed06b11

Co-authored-by: Paul Carleton <[email protected]>

remove resource parameter.

42ee88b

Co-authored-by: Paul Carleton <[email protected]>

0Itsuki0 and others added 6 commits May 20, 2025 14:56

remove resource parameter.

2dac816

Co-authored-by: Paul Carleton <[email protected]>

remove resource parameter.

17b970e

Co-authored-by: Paul Carleton <[email protected]>

remove resource parameter.

68eaf7a

Co-authored-by: Paul Carleton <[email protected]>

remove resource parameter.

0a632bf

Co-authored-by: Paul Carleton <[email protected]>

remove resource parameter.

cfd572a

Co-authored-by: Paul Carleton <[email protected]>

Merge remote-tracking branch 'upstream/main' into auth-client

3ed83d3

0Itsuki0 requested a review from pcarleton May 20, 2025 06:04

pcarleton requested changes May 20, 2025

View reviewed changes

pcarleton mentioned this pull request May 20, 2025

feat: support manual entry of OAuth client information modelcontextprotocol/inspector#345

Open

9 tasks

0Itsuki0 requested a review from pcarleton May 21, 2025 00:09

pcarleton added 3 commits May 21, 2025 12:00

make backwards compatibile

421959e

Merge branch 'main' into auth-client

2bd1780

s/resourceServerUrl/serverUrl/g for backwards compat

7c12e61

pcarleton approved these changes May 21, 2025

View reviewed changes

fix test comment

7ce3f85

pcarleton merged commit 69dbfac into modelcontextprotocol:main May 21, 2025
2 checks passed

jescalan reviewed May 23, 2025

View reviewed changes

jescalan mentioned this pull request May 23, 2025

Upgrade mcp client to latest, add state to oauth provider geelen/mcp-remote#93

Open

Feat: Separate authorization server and resource server on client auth flow #416

Feat: Separate authorization server and resource server on client auth flow #416

Conversation

0Itsuki0 commented Apr 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation and Context

How Has This Been Tested?

Breaking Changes

Types of changes

Checklist

Additional context

Uh oh!

QuantGeekDev commented May 7, 2025

Uh oh!

QuantGeekDev commented May 7, 2025

Uh oh!

0Itsuki0 commented May 7, 2025

Uh oh!

QuantGeekDev commented May 11, 2025

Uh oh!

0Itsuki0 commented May 12, 2025

Uh oh!

QuantGeekDev commented May 12, 2025

Uh oh!

0Itsuki0 commented May 17, 2025

Uh oh!

pcarleton left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

0Itsuki0 commented May 20, 2025

Uh oh!

pcarleton left a comment

Choose a reason for hiding this comment

Uh oh!

pcarleton May 20, 2025

Choose a reason for hiding this comment

Uh oh!

0Itsuki0 May 21, 2025

Choose a reason for hiding this comment

Uh oh!

pcarleton commented May 21, 2025

Uh oh!

Uh oh!

jescalan May 23, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

0Itsuki0 commented Apr 27, 2025 •

edited

Loading