From e9019f39cb59f542ff88714c69cec0d3f9e8964d Mon Sep 17 00:00:00 2001 From: Pranav RK Date: Mon, 24 Nov 2025 11:51:36 +0530 Subject: [PATCH 01/10] feat: add token exchange flow - Adds the Token Exchange (RFC 8693) for Enterprise-Managed Authorization --- oauthex/token_exchange.go | 267 +++++++++++++++++++++++++++++++++ oauthex/token_exchange_test.go | 220 +++++++++++++++++++++++++++ 2 files changed, 487 insertions(+) create mode 100644 oauthex/token_exchange.go create mode 100644 oauthex/token_exchange_test.go diff --git a/oauthex/token_exchange.go b/oauthex/token_exchange.go new file mode 100644 index 00000000..fb162d0b --- /dev/null +++ b/oauthex/token_exchange.go @@ -0,0 +1,267 @@ +// Copyright 2025 The Go MCP SDK Authors. All rights reserved. +// Use of this source code is governed by an MIT-style +// license that can be found in the LICENSE file. + +// This file implements Token Exchange (RFC 8693) for Enterprise Managed Authorization. +// See https://datatracker.ietf.org/doc/html/rfc8693 + +//go:build mcp_go_client_oauth + +package oauthex + +import ( + "context" + "encoding/json" + "fmt" + "io" + "net/http" + "net/url" + "strings" +) + +// Token type identifiers defined by RFC 8693 and SEP-990. +const ( + // TokenTypeIDToken is the URN for OpenID Connect ID Tokens. + TokenTypeIDToken = "urn:ietf:params:oauth:token-type:id_token" + + // TokenTypeSAML2 is the URN for SAML 2.0 assertions. + TokenTypeSAML2 = "urn:ietf:params:oauth:token-type:saml2" + + // TokenTypeIDJAG is the URN for Identity Assertion JWT Authorization Grants. + // This is the token type returned by IdP during token exchange for SEP-990. + TokenTypeIDJAG = "urn:ietf:params:oauth:token-type:id-jag" + + // GrantTypeTokenExchange is the grant type for RFC 8693 token exchange. + GrantTypeTokenExchange = "urn:ietf:params:oauth:grant-type:token-exchange" +) + +// TokenExchangeRequest represents a Token Exchange request per RFC 8693. +// This is used for Enterprise Managed Authorization (SEP-990) where an MCP Client +// exchanges an ID Token from an enterprise IdP for an ID-JAG that can be used +// to obtain an access token from an MCP Server's authorization server. +type TokenExchangeRequest struct { + // RequestedTokenType indicates the type of security token being requested. + // For SEP-990, this MUST be TokenTypeIDJAG. + RequestedTokenType string + + // Audience is the logical name of the target service where the client + // intends to use the requested token. For SEP-990, this MUST be the + // Issuer URL of the MCP Server's authorization server. + Audience string + + // Resource is the physical location or identifier of the target resource. + // For SEP-990, this MUST be the RFC9728 Resource Identifier of the MCP Server. + Resource string + + // Scope is a list of space-separated scopes for the requested token. + // This is OPTIONAL per RFC 8693 but commonly used in SEP-990. + Scope []string + + // SubjectToken is the security token that represents the identity of the + // party on behalf of whom the request is being made. For SEP-990, this is + // typically an OpenID Connect ID Token. + SubjectToken string + + // SubjectTokenType is the type of the security token in SubjectToken. + // For SEP-990 with OIDC, this MUST be TokenTypeIDToken. + SubjectTokenType string +} + +// TokenExchangeResponse represents the response from a token exchange request +// per RFC 8693 Section 2.2. +type TokenExchangeResponse struct { + // IssuedTokenType is the type of the security token in AccessToken. + // For SEP-990, this MUST be TokenTypeIDJAG. + IssuedTokenType string `json:"issued_token_type"` + + // AccessToken is the security token issued by the authorization server. + // Despite the name "access_token" (required by RFC 8693), for SEP-990 + // this contains an ID-JAG JWT, not an OAuth access token. + AccessToken string `json:"access_token"` + + // TokenType indicates the type of token returned. For SEP-990, this is "N_A" + // because the issued token is not an OAuth access token. + TokenType string `json:"token_type"` + + // Scope is the scope of the issued token, if the issued token scope is + // different from the requested scope. Per RFC 8693, this SHOULD be included + // if the scope differs from the request. + Scope string `json:"scope,omitempty"` + + // ExpiresIn is the lifetime in seconds of the issued token. + ExpiresIn int `json:"expires_in,omitempty"` +} + +// TokenExchangeError represents an error response from a token exchange request. +type TokenExchangeError struct { + // Error is the error code as defined in RFC 6749 Section 5.2. + ErrorCode string `json:"error"` + + // ErrorDescription is a human-readable description of the error. + ErrorDescription string `json:"error_description,omitempty"` + + // ErrorURI is a URI identifying a human-readable web page with information + // about the error. + ErrorURI string `json:"error_uri,omitempty"` +} + +func (e *TokenExchangeError) Error() string { + if e.ErrorDescription != "" { + return fmt.Sprintf("token exchange failed: %s (%s)", e.ErrorCode, e.ErrorDescription) + } + return fmt.Sprintf("token exchange failed: %s", e.ErrorCode) +} + +// ExchangeToken performs a token exchange request per RFC 8693 for Enterprise +// Managed Authorization (SEP-990). It exchanges an identity assertion (typically +// an ID Token) for an Identity Assertion JWT Authorization Grant (ID-JAG) that +// can be used to obtain an access token from an MCP Server. +// +// The tokenEndpoint parameter should be the IdP's token endpoint (typically +// obtained from the IdP's authorization server metadata). +// +// Client authentication must be performed by the caller by including appropriate +// credentials in the request (e.g., using Basic auth via the Authorization header, +// or including client_id and client_secret in the form data). +// +// Example: +// +// req := &TokenExchangeRequest{ +// RequestedTokenType: TokenTypeIDJAG, +// Audience: "https://auth.mcpserver.example/", +// Resource: "https://mcp.mcpserver.example/", +// Scope: []string{"read", "write"}, +// SubjectToken: idToken, +// SubjectTokenType: TokenTypeIDToken, +// } +// +// resp, err := ExchangeToken(ctx, idpTokenEndpoint, req, clientID, clientSecret, nil) +func ExchangeToken( + ctx context.Context, + tokenEndpoint string, + req *TokenExchangeRequest, + clientID string, + clientSecret string, + httpClient *http.Client, +) (*TokenExchangeResponse, error) { + if tokenEndpoint == "" { + return nil, fmt.Errorf("token endpoint is required") + } + if req == nil { + return nil, fmt.Errorf("token exchange request is required") + } + + // Validate required fields per SEP-990 Section 4 + if req.RequestedTokenType == "" { + return nil, fmt.Errorf("requested_token_type is required") + } + if req.Audience == "" { + return nil, fmt.Errorf("audience is required") + } + if req.Resource == "" { + return nil, fmt.Errorf("resource is required") + } + if req.SubjectToken == "" { + return nil, fmt.Errorf("subject_token is required") + } + if req.SubjectTokenType == "" { + return nil, fmt.Errorf("subject_token_type is required") + } + + // Validate URL schemes to prevent XSS attacks (see #526) + if err := checkURLScheme(tokenEndpoint); err != nil { + return nil, fmt.Errorf("invalid token endpoint: %w", err) + } + if err := checkURLScheme(req.Audience); err != nil { + return nil, fmt.Errorf("invalid audience: %w", err) + } + if err := checkURLScheme(req.Resource); err != nil { + return nil, fmt.Errorf("invalid resource: %w", err) + } + + // Build the token exchange request body per RFC 8693 + formData := url.Values{} + formData.Set("grant_type", GrantTypeTokenExchange) + formData.Set("requested_token_type", req.RequestedTokenType) + formData.Set("audience", req.Audience) + formData.Set("resource", req.Resource) + formData.Set("subject_token", req.SubjectToken) + formData.Set("subject_token_type", req.SubjectTokenType) + + if len(req.Scope) > 0 { + formData.Set("scope", strings.Join(req.Scope, " ")) + } + + // Add client authentication (following OAuth 2.0 client_secret_post method) + if clientID != "" { + formData.Set("client_id", clientID) + } + if clientSecret != "" { + formData.Set("client_secret", clientSecret) + } + + // Create HTTP request + httpReq, err := http.NewRequestWithContext( + ctx, + http.MethodPost, + tokenEndpoint, + strings.NewReader(formData.Encode()), + ) + if err != nil { + return nil, fmt.Errorf("failed to create token exchange request: %w", err) + } + + httpReq.Header.Set("Content-Type", "application/x-www-form-urlencoded") + httpReq.Header.Set("Accept", "application/json") + + // Use provided client or default + if httpClient == nil { + httpClient = http.DefaultClient + } + + // Execute the request + httpResp, err := httpClient.Do(httpReq) + if err != nil { + return nil, fmt.Errorf("token exchange request failed: %w", err) + } + defer httpResp.Body.Close() + + // Read response body (limit to 1MB for safety, following SDK pattern) + body, err := io.ReadAll(io.LimitReader(httpResp.Body, 1<<20)) + if err != nil { + return nil, fmt.Errorf("failed to read token exchange response: %w", err) + } + + // Handle success response (200 OK per RFC 8693) + if httpResp.StatusCode == http.StatusOK { + var resp TokenExchangeResponse + if err := json.Unmarshal(body, &resp); err != nil { + return nil, fmt.Errorf("failed to parse token exchange response: %w (body: %s)", err, string(body)) + } + + // Validate response per SEP-990 Section 4.2 + if resp.IssuedTokenType == "" { + return nil, fmt.Errorf("response missing required field: issued_token_type") + } + if resp.AccessToken == "" { + return nil, fmt.Errorf("response missing required field: access_token") + } + if resp.TokenType == "" { + return nil, fmt.Errorf("response missing required field: token_type") + } + + return &resp, nil + } + + // Handle error response (400 Bad Request per RFC 6749) + if httpResp.StatusCode == http.StatusBadRequest { + var errResp TokenExchangeError + if err := json.Unmarshal(body, &errResp); err != nil { + return nil, fmt.Errorf("failed to parse error response: %w (body: %s)", err, string(body)) + } + return nil, &errResp + } + + // Handle unexpected status codes + return nil, fmt.Errorf("unexpected status code %d: %s", httpResp.StatusCode, string(body)) +} diff --git a/oauthex/token_exchange_test.go b/oauthex/token_exchange_test.go new file mode 100644 index 00000000..316fa8e3 --- /dev/null +++ b/oauthex/token_exchange_test.go @@ -0,0 +1,220 @@ +// Copyright 2025 The Go MCP SDK Authors. All rights reserved. +// Use of this source code is governed by an MIT-style +// license that can be found in the LICENSE file. + +//go:build mcp_go_client_oauth + +package oauthex + +import ( + "context" + "encoding/json" + "net/http" + "net/http/httptest" + "testing" +) + +// TestExchangeToken tests the basic token exchange flow. +func TestExchangeToken(t *testing.T) { + // Create a test IdP server that implements token exchange + server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + // Verify request method and content type + if r.Method != http.MethodPost { + t.Errorf("expected POST request, got %s", r.Method) + http.Error(w, "method not allowed", http.StatusMethodNotAllowed) + return + } + + contentType := r.Header.Get("Content-Type") + if contentType != "application/x-www-form-urlencoded" { + t.Errorf("expected application/x-www-form-urlencoded, got %s", contentType) + http.Error(w, "invalid content type", http.StatusBadRequest) + return + } + + // Parse form data + if err := r.ParseForm(); err != nil { + http.Error(w, "failed to parse form", http.StatusBadRequest) + return + } + + // Verify required parameters per SEP-990 Section 4 + grantType := r.FormValue("grant_type") + if grantType != GrantTypeTokenExchange { + t.Errorf("expected grant_type %s, got %s", GrantTypeTokenExchange, grantType) + writeErrorResponse(w, "invalid_grant", "invalid grant_type") + return + } + + requestedTokenType := r.FormValue("requested_token_type") + if requestedTokenType != TokenTypeIDJAG { + t.Errorf("expected requested_token_type %s, got %s", TokenTypeIDJAG, requestedTokenType) + writeErrorResponse(w, "invalid_request", "invalid requested_token_type") + return + } + + audience := r.FormValue("audience") + if audience == "" { + t.Error("audience is required") + writeErrorResponse(w, "invalid_request", "missing audience") + return + } + + resource := r.FormValue("resource") + if resource == "" { + t.Error("resource is required") + writeErrorResponse(w, "invalid_request", "missing resource") + return + } + + subjectToken := r.FormValue("subject_token") + if subjectToken == "" { + t.Error("subject_token is required") + writeErrorResponse(w, "invalid_request", "missing subject_token") + return + } + + subjectTokenType := r.FormValue("subject_token_type") + if subjectTokenType != TokenTypeIDToken { + t.Errorf("expected subject_token_type %s, got %s", TokenTypeIDToken, subjectTokenType) + writeErrorResponse(w, "invalid_request", "invalid subject_token_type") + return + } + + // Verify client authentication + clientID := r.FormValue("client_id") + clientSecret := r.FormValue("client_secret") + if clientID == "" || clientSecret == "" { + t.Error("client authentication required") + writeErrorResponse(w, "invalid_client", "client authentication failed") + return + } + + if clientID != "test-client-id" || clientSecret != "test-client-secret" { + t.Error("invalid client credentials") + writeErrorResponse(w, "invalid_client", "invalid credentials") + return + } + + // Return successful token exchange response per SEP-990 Section 4.2 + resp := TokenExchangeResponse{ + IssuedTokenType: TokenTypeIDJAG, + AccessToken: "fake-id-jag-token", + TokenType: "N_A", + Scope: r.FormValue("scope"), + ExpiresIn: 300, + } + + w.Header().Set("Content-Type", "application/json") + w.Header().Set("Cache-Control", "no-store") + w.Header().Set("Pragma", "no-cache") + w.WriteHeader(http.StatusOK) + json.NewEncoder(w).Encode(resp) + })) + defer server.Close() + + // Test successful token exchange + t.Run("successful exchange", func(t *testing.T) { + req := &TokenExchangeRequest{ + RequestedTokenType: TokenTypeIDJAG, + Audience: "https://auth.mcpserver.example/", + Resource: "https://mcp.mcpserver.example/", + Scope: []string{"read", "write"}, + SubjectToken: "fake-id-token", + SubjectTokenType: TokenTypeIDToken, + } + + resp, err := ExchangeToken( + context.Background(), + server.URL, + req, + "test-client-id", + "test-client-secret", + server.Client(), + ) + + if err != nil { + t.Fatalf("ExchangeToken failed: %v", err) + } + + if resp.IssuedTokenType != TokenTypeIDJAG { + t.Errorf("expected issued_token_type %s, got %s", TokenTypeIDJAG, resp.IssuedTokenType) + } + + if resp.AccessToken != "fake-id-jag-token" { + t.Errorf("expected access_token 'fake-id-jag-token', got %s", resp.AccessToken) + } + + if resp.TokenType != "N_A" { + t.Errorf("expected token_type 'N_A', got %s", resp.TokenType) + } + + if resp.Scope != "read write" { + t.Errorf("expected scope 'read write', got %s", resp.Scope) + } + + if resp.ExpiresIn != 300 { + t.Errorf("expected expires_in 300, got %d", resp.ExpiresIn) + } + }) + + // Test missing required fields + t.Run("missing audience", func(t *testing.T) { + req := &TokenExchangeRequest{ + RequestedTokenType: TokenTypeIDJAG, + Resource: "https://mcp.mcpserver.example/", + SubjectToken: "fake-id-token", + SubjectTokenType: TokenTypeIDToken, + } + + _, err := ExchangeToken( + context.Background(), + server.URL, + req, + "test-client-id", + "test-client-secret", + server.Client(), + ) + + if err == nil { + t.Error("expected error for missing audience, got nil") + } + }) + + // Test invalid URL schemes + t.Run("invalid audience URL scheme", func(t *testing.T) { + req := &TokenExchangeRequest{ + RequestedTokenType: TokenTypeIDJAG, + Audience: "javascript:alert(1)", + Resource: "https://mcp.mcpserver.example/", + SubjectToken: "fake-id-token", + SubjectTokenType: TokenTypeIDToken, + } + + _, err := ExchangeToken( + context.Background(), + server.URL, + req, + "test-client-id", + "test-client-secret", + server.Client(), + ) + + if err == nil { + t.Error("expected error for invalid audience URL scheme, got nil") + } + }) +} + +// writeErrorResponse writes an OAuth 2.0 error response per RFC 6749 Section 5.2. +func writeErrorResponse(w http.ResponseWriter, errorCode, errorDescription string) { + errResp := TokenExchangeError{ + ErrorCode: errorCode, + ErrorDescription: errorDescription, + } + + w.Header().Set("Content-Type", "application/json") + w.Header().Set("Cache-Control", "no-store") + w.WriteHeader(http.StatusBadRequest) + json.NewEncoder(w).Encode(errResp) +} From 4c03a0b7d930a05605bef8e4205018e33052785a Mon Sep 17 00:00:00 2001 From: Pranav RK Date: Mon, 24 Nov 2025 15:40:55 +0530 Subject: [PATCH 02/10] feat: add jwt bearer flow with id-jag --- oauthex/jwt_bearer.go | 193 +++++++++++++++++++++++++++++++++++++ oauthex/jwt_bearer_test.go | 154 +++++++++++++++++++++++++++++ 2 files changed, 347 insertions(+) create mode 100644 oauthex/jwt_bearer.go create mode 100644 oauthex/jwt_bearer_test.go diff --git a/oauthex/jwt_bearer.go b/oauthex/jwt_bearer.go new file mode 100644 index 00000000..03a0df5d --- /dev/null +++ b/oauthex/jwt_bearer.go @@ -0,0 +1,193 @@ +// Copyright 2025 The Go MCP SDK Authors. All rights reserved. +// Use of this source code is governed by an MIT-style +// license that can be found in the LICENSE file. + +// This file implements JWT Bearer Authorization Grant (RFC 7523) for Enterprise Managed Authorization. +// See https://datatracker.ietf.org/doc/html/rfc7523 + +//go:build mcp_go_client_oauth + +package oauthex + +import ( + "context" + "encoding/json" + "fmt" + "io" + "net/http" + "net/url" + "strings" + "time" + + "golang.org/x/oauth2" +) + +// GrantTypeJWTBearer is the grant type for RFC 7523 JWT Bearer authorization grant. +// This is used in SEP-990 to exchange an ID-JAG for an access token at the MCP Server. +const GrantTypeJWTBearer = "urn:ietf:params:oauth:grant-type:jwt-bearer" + +// JWTBearerResponse represents the response from a JWT Bearer grant request +// per RFC 7523. This uses the standard OAuth 2.0 token response format. +type JWTBearerResponse struct { + // AccessToken is the OAuth access token issued by the MCP Server's + // authorization server. + AccessToken string `json:"access_token"` + // TokenType is the type of token issued. This is typically "Bearer". + TokenType string `json:"token_type"` + // ExpiresIn is the lifetime in seconds of the access token. + ExpiresIn int `json:"expires_in,omitempty"` + // RefreshToken is the refresh token, which can be used to obtain new + // access tokens using the same authorization grant. + RefreshToken string `json:"refresh_token,omitempty"` + // Scope is the scope of the access token as described by RFC 6749 Section 3.3. + Scope string `json:"scope,omitempty"` +} + +// JWTBearerError represents an error response from a JWT Bearer grant request. +type JWTBearerError struct { + // ErrorCode is the error code as defined in RFC 6749 Section 5.2. + // The JSON field name is "error" per the RFC specification. + ErrorCode string `json:"error"` + // ErrorDescription is a human-readable description of the error. + ErrorDescription string `json:"error_description,omitempty"` + // ErrorURI is a URI identifying a human-readable web page with information + // about the error. + ErrorURI string `json:"error_uri,omitempty"` +} + +func (e *JWTBearerError) Error() string { + if e.ErrorDescription != "" { + return fmt.Sprintf("JWT bearer grant failed: %s (%s)", e.ErrorCode, e.ErrorDescription) + } + return fmt.Sprintf("JWT bearer grant failed: %s", e.ErrorCode) +} + +// ExchangeJWTBearer exchanges an Identity Assertion JWT Authorization Grant (ID-JAG) +// for an access token using JWT Bearer Grant per RFC 7523. This is the second step +// in Enterprise Managed Authorization (SEP-990) after obtaining the ID-JAG from the +// IdP via token exchange. +// +// The tokenEndpoint parameter should be the MCP Server's token endpoint (typically +// obtained from the MCP Server's authorization server metadata). +// +// The assertion parameter should be the ID-JAG JWT obtained from the token exchange +// step with the enterprise IdP. +// +// Client authentication must be performed by the caller by including appropriate +// credentials in the request (e.g., using Basic auth via the Authorization header, +// or including client_id and client_secret in the form data). +// +// Example: +// +// // First, get ID-JAG via token exchange +// idJAG := tokenExchangeResp.AccessToken +// +// // Then exchange ID-JAG for access token +// token, err := ExchangeJWTBearer( +// ctx, +// "https://auth.mcpserver.example/oauth2/token", +// idJAG, +// "mcp-client-id", +// "mcp-client-secret", +// nil, +// ) +func ExchangeJWTBearer( + ctx context.Context, + tokenEndpoint string, + assertion string, + clientID string, + clientSecret string, + httpClient *http.Client, +) (*oauth2.Token, error) { + if tokenEndpoint == "" { + return nil, fmt.Errorf("token endpoint is required") + } + if assertion == "" { + return nil, fmt.Errorf("assertion is required") + } + // Validate URL scheme to prevent XSS attacks (see #526) + if err := checkURLScheme(tokenEndpoint); err != nil { + return nil, fmt.Errorf("invalid token endpoint: %w", err) + } + // Build the JWT Bearer grant request per RFC 7523 Section 2.1 + formData := url.Values{} + formData.Set("grant_type", GrantTypeJWTBearer) + formData.Set("assertion", assertion) + // Add client authentication (following OAuth 2.0 client_secret_post method) + // Note: Per SEP-990 Section 5.1, the client_id in the assertion must match + // the authenticated client + if clientID != "" { + formData.Set("client_id", clientID) + } + if clientSecret != "" { + formData.Set("client_secret", clientSecret) + } + // Create HTTP request + httpReq, err := http.NewRequestWithContext( + ctx, + http.MethodPost, + tokenEndpoint, + strings.NewReader(formData.Encode()), + ) + if err != nil { + return nil, fmt.Errorf("failed to create JWT bearer grant request: %w", err) + } + httpReq.Header.Set("Content-Type", "application/x-www-form-urlencoded") + httpReq.Header.Set("Accept", "application/json") + // Use provided client or default + if httpClient == nil { + httpClient = http.DefaultClient + } + // Execute the request + httpResp, err := httpClient.Do(httpReq) + if err != nil { + return nil, fmt.Errorf("JWT bearer grant request failed: %w", err) + } + defer httpResp.Body.Close() + // Read response body (limit to 1MB for safety, following SDK pattern) + body, err := io.ReadAll(io.LimitReader(httpResp.Body, 1<<20)) + if err != nil { + return nil, fmt.Errorf("failed to read JWT bearer grant response: %w", err) + } + // Handle success response (200 OK per OAuth 2.0) + if httpResp.StatusCode == http.StatusOK { + var resp JWTBearerResponse + if err := json.Unmarshal(body, &resp); err != nil { + return nil, fmt.Errorf("failed to parse JWT bearer grant response: %w (body: %s)", err, string(body)) + } + // Validate response per OAuth 2.0 + if resp.AccessToken == "" { + return nil, fmt.Errorf("response missing required field: access_token") + } + if resp.TokenType == "" { + return nil, fmt.Errorf("response missing required field: token_type") + } + // Convert to golang.org/x/oauth2.Token + token := &oauth2.Token{ + AccessToken: resp.AccessToken, + TokenType: resp.TokenType, + RefreshToken: resp.RefreshToken, + } + // Set expiration if provided + if resp.ExpiresIn > 0 { + token.Expiry = time.Now().Add(time.Duration(resp.ExpiresIn) * time.Second) + } + // Add scope to extra data if provided + if resp.Scope != "" { + token = token.WithExtra(map[string]interface{}{ + "scope": resp.Scope, + }) + } + return token, nil + } + // Handle error response (400 Bad Request per RFC 6749) + if httpResp.StatusCode == http.StatusBadRequest { + var errResp JWTBearerError + if err := json.Unmarshal(body, &errResp); err != nil { + return nil, fmt.Errorf("failed to parse error response: %w (body: %s)", err, string(body)) + } + return nil, &errResp + } + // Handle unexpected status codes + return nil, fmt.Errorf("unexpected status code %d: %s", httpResp.StatusCode, string(body)) +} diff --git a/oauthex/jwt_bearer_test.go b/oauthex/jwt_bearer_test.go new file mode 100644 index 00000000..3145d0bf --- /dev/null +++ b/oauthex/jwt_bearer_test.go @@ -0,0 +1,154 @@ +// Copyright 2025 The Go MCP SDK Authors. All rights reserved. +// Use of this source code is governed by an MIT-style +// license that can be found in the LICENSE file. + +//go:build mcp_go_client_oauth + +package oauthex + +import ( + "context" + "encoding/json" + "net/http" + "net/http/httptest" + "testing" + "time" +) + +// TestExchangeJWTBearer tests the JWT Bearer grant flow. +func TestExchangeJWTBearer(t *testing.T) { + // Create a test MCP Server auth server that accepts JWT Bearer grants + server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + // Verify request method and content type + if r.Method != http.MethodPost { + t.Errorf("expected POST request, got %s", r.Method) + http.Error(w, "method not allowed", http.StatusMethodNotAllowed) + return + } + contentType := r.Header.Get("Content-Type") + if contentType != "application/x-www-form-urlencoded" { + t.Errorf("expected application/x-www-form-urlencoded, got %s", contentType) + http.Error(w, "invalid content type", http.StatusBadRequest) + return + } + // Parse form data + if err := r.ParseForm(); err != nil { + http.Error(w, "failed to parse form", http.StatusBadRequest) + return + } + // Verify grant type per RFC 7523 + grantType := r.FormValue("grant_type") + if grantType != GrantTypeJWTBearer { + t.Errorf("expected grant_type %s, got %s", GrantTypeJWTBearer, grantType) + writeJWTBearerErrorResponse(w, "unsupported_grant_type", "grant type not supported") + return + } + // Verify assertion is provided + assertion := r.FormValue("assertion") + if assertion == "" { + t.Error("assertion is required") + writeJWTBearerErrorResponse(w, "invalid_request", "missing assertion") + return + } + // Verify client authentication + clientID := r.FormValue("client_id") + clientSecret := r.FormValue("client_secret") + if clientID == "" || clientSecret == "" { + t.Error("client authentication required") + writeJWTBearerErrorResponse(w, "invalid_client", "client authentication failed") + return + } + if clientID != "mcp-client-id" || clientSecret != "mcp-client-secret" { + t.Error("invalid client credentials") + writeJWTBearerErrorResponse(w, "invalid_client", "invalid credentials") + return + } + // Return successful OAuth token response + resp := JWTBearerResponse{ + AccessToken: "mcp-access-token-123", + TokenType: "Bearer", + ExpiresIn: 3600, + Scope: "read write", + RefreshToken: "mcp-refresh-token-456", + } + w.Header().Set("Content-Type", "application/json") + w.Header().Set("Cache-Control", "no-store") + w.Header().Set("Pragma", "no-cache") + w.WriteHeader(http.StatusOK) + json.NewEncoder(w).Encode(resp) + })) + defer server.Close() + // Test successful JWT Bearer grant + t.Run("successful exchange", func(t *testing.T) { + token, err := ExchangeJWTBearer( + context.Background(), + server.URL, + "fake-id-jag-jwt", + "mcp-client-id", + "mcp-client-secret", + server.Client(), + ) + if err != nil { + t.Fatalf("ExchangeJWTBearer failed: %v", err) + } + if token.AccessToken != "mcp-access-token-123" { + t.Errorf("expected access_token 'mcp-access-token-123', got %s", token.AccessToken) + } + if token.TokenType != "Bearer" { + t.Errorf("expected token_type 'Bearer', got %s", token.TokenType) + } + if token.RefreshToken != "mcp-refresh-token-456" { + t.Errorf("expected refresh_token 'mcp-refresh-token-456', got %s", token.RefreshToken) + } + // Check expiration (should be ~1 hour from now) + expectedExpiry := time.Now().Add(3600 * time.Second) + if token.Expiry.Before(time.Now()) || token.Expiry.After(expectedExpiry.Add(5*time.Second)) { + t.Errorf("unexpected expiry time: %v", token.Expiry) + } + // Check scope in extra data + scope, ok := token.Extra("scope").(string) + if !ok || scope != "read write" { + t.Errorf("expected scope 'read write', got %v", token.Extra("scope")) + } + }) + // Test missing assertion + t.Run("missing assertion", func(t *testing.T) { + _, err := ExchangeJWTBearer( + context.Background(), + server.URL, + "", // empty assertion + "mcp-client-id", + "mcp-client-secret", + server.Client(), + ) + if err == nil { + t.Error("expected error for missing assertion, got nil") + } + }) + // Test invalid URL scheme + t.Run("invalid token endpoint URL", func(t *testing.T) { + _, err := ExchangeJWTBearer( + context.Background(), + "javascript:alert(1)", + "fake-id-jag-jwt", + "mcp-client-id", + "mcp-client-secret", + server.Client(), + ) + if err == nil { + t.Error("expected error for invalid URL scheme, got nil") + } + }) +} + +// writeJWTBearerErrorResponse writes an OAuth 2.0 error response per RFC 6749 Section 5.2. +func writeJWTBearerErrorResponse(w http.ResponseWriter, errorCode, errorDescription string) { + errResp := JWTBearerError{ + ErrorCode: errorCode, + ErrorDescription: errorDescription, + } + w.Header().Set("Content-Type", "application/json") + w.Header().Set("Cache-Control", "no-store") + w.WriteHeader(http.StatusBadRequest) + json.NewEncoder(w).Encode(errResp) +} From 24f0de4aa2f14fd0771f803bba79175a68a36ca1 Mon Sep 17 00:00:00 2001 From: Pranav RK Date: Mon, 24 Nov 2025 17:45:45 +0530 Subject: [PATCH 03/10] feat: add id-jag+jwt parsing and enterprise auth --- auth/enterprise_auth.go | 137 ++++++++++++++++++++++ auth/enterprise_auth_test.go | 218 +++++++++++++++++++++++++++++++++++ oauthex/id_jag.go | 138 ++++++++++++++++++++++ oauthex/id_jag_test.go | 176 ++++++++++++++++++++++++++++ 4 files changed, 669 insertions(+) create mode 100644 auth/enterprise_auth.go create mode 100644 auth/enterprise_auth_test.go create mode 100644 oauthex/id_jag.go create mode 100644 oauthex/id_jag_test.go diff --git a/auth/enterprise_auth.go b/auth/enterprise_auth.go new file mode 100644 index 00000000..1fd471dc --- /dev/null +++ b/auth/enterprise_auth.go @@ -0,0 +1,137 @@ +// Copyright 2025 The Go MCP SDK Authors. All rights reserved. +// Use of this source code is governed by an MIT-style +// license that can be found in the LICENSE file. + +// This file implements the client-side Enterprise Managed Authorization flow +// for MCP as specified in SEP-990. + +//go:build mcp_go_client_oauth + +package auth + +import ( + "context" + "fmt" + "net/http" + + "github.com/modelcontextprotocol/go-sdk/oauthex" + "golang.org/x/oauth2" +) + +// EnterpriseAuthConfig contains configuration for Enterprise Managed Authorization +// (SEP-990). This configures both the IdP (for token exchange) and the MCP Server +// (for JWT Bearer grant). +type EnterpriseAuthConfig struct { + // IdP configuration (where the user authenticates) + IdPIssuerURL string // e.g., "https://acme.okta.com" + IdPClientID string // MCP Client's ID at the IdP + IdPClientSecret string // MCP Client's secret at the IdP + + // MCP Server configuration (the resource being accessed) + MCPAuthServerURL string // MCP Server's auth server issuer URL + MCPResourceURL string // MCP Server's resource identifier + MCPClientID string // MCP Client's ID at the MCP Server + MCPClientSecret string // MCP Client's secret at the MCP Server + MCPScopes []string // Requested scopes at the MCP Server + + // Optional HTTP client for customization + HTTPClient *http.Client +} + +// EnterpriseAuthFlow performs the complete Enterprise Managed Authorization flow: +// 1. Token Exchange: ID Token → ID-JAG at IdP +// 2. JWT Bearer: ID-JAG → Access Token at MCP Server +// +// This function takes an ID Token that was obtained via SSO (e.g., OIDC login) +// and exchanges it for an access token that can be used to call the MCP Server. +// +// Example: +// +// config := &EnterpriseAuthConfig{ +// IdPIssuerURL: "https://acme.okta.com", +// IdPClientID: "client-id-at-idp", +// IdPClientSecret: "secret-at-idp", +// MCPAuthServerURL: "https://auth.mcpserver.example", +// MCPResourceURL: "https://mcp.mcpserver.example", +// MCPClientID: "client-id-at-mcp", +// MCPClientSecret: "secret-at-mcp", +// MCPScopes: []string{"read", "write"}, +// } +// +// // After user logs in via OIDC, you have an ID Token +// accessToken, err := EnterpriseAuthFlow(ctx, config, idToken) +// if err != nil { +// log.Fatal(err) +// } +// +// // Use accessToken to call MCP Server APIs +func EnterpriseAuthFlow( + ctx context.Context, + config *EnterpriseAuthConfig, + idToken string, +) (*oauth2.Token, error) { + if config == nil { + return nil, fmt.Errorf("config is required") + } + if idToken == "" { + return nil, fmt.Errorf("idToken is required") + } + // Validate configuration + if config.IdPIssuerURL == "" { + return nil, fmt.Errorf("IdPIssuerURL is required") + } + if config.MCPAuthServerURL == "" { + return nil, fmt.Errorf("MCPAuthServerURL is required") + } + if config.MCPResourceURL == "" { + return nil, fmt.Errorf("MCPResourceURL is required") + } + httpClient := config.HTTPClient + if httpClient == nil { + httpClient = http.DefaultClient + } + + // Step 1: Token Exchange (ID Token → ID-JAG) + tokenExchangeReq := &oauthex.TokenExchangeRequest{ + RequestedTokenType: oauthex.TokenTypeIDJAG, + Audience: config.MCPAuthServerURL, + Resource: config.MCPResourceURL, + Scope: config.MCPScopes, + SubjectToken: idToken, + SubjectTokenType: oauthex.TokenTypeIDToken, + } + // Construct IdP token endpoint (assuming standard path) + idpTokenEndpoint := config.IdPIssuerURL + "/oauth2/v1/token" + if config.IdPIssuerURL[len(config.IdPIssuerURL)-1] == '/' { + idpTokenEndpoint = config.IdPIssuerURL + "oauth2/v1/token" + } + tokenExchangeResp, err := oauthex.ExchangeToken( + ctx, + idpTokenEndpoint, + tokenExchangeReq, + config.IdPClientID, + config.IdPClientSecret, + httpClient, + ) + if err != nil { + return nil, fmt.Errorf("token exchange failed: %w", err) + } + + // Step 2: JWT Bearer Grant (ID-JAG → Access Token) + mcpTokenEndpoint := config.MCPAuthServerURL + "/v1/token" + if config.MCPAuthServerURL[len(config.MCPAuthServerURL)-1] == '/' { + mcpTokenEndpoint = config.MCPAuthServerURL + "v1/token" + } + accessToken, err := oauthex.ExchangeJWTBearer( + ctx, + mcpTokenEndpoint, + tokenExchangeResp.AccessToken, // The ID-JAG + config.MCPClientID, + config.MCPClientSecret, + httpClient, + ) + if err != nil { + return nil, fmt.Errorf("JWT bearer grant failed: %w", err) + } + return accessToken, nil +} diff --git a/auth/enterprise_auth_test.go b/auth/enterprise_auth_test.go new file mode 100644 index 00000000..db2e5ffd --- /dev/null +++ b/auth/enterprise_auth_test.go @@ -0,0 +1,218 @@ +// Copyright 2025 The Go MCP SDK Authors. All rights reserved. +// Use of this source code is governed by an MIT-style +// license that can be found in the LICENSE file. + +//go:build mcp_go_client_oauth + +package auth + +import ( + "context" + "encoding/base64" + "encoding/json" + "fmt" + "net/http" + "net/http/httptest" + "testing" + "time" + + "github.com/modelcontextprotocol/go-sdk/oauthex" +) + +// TestEnterpriseAuthFlow tests the complete enterprise auth flow. +func TestEnterpriseAuthFlow(t *testing.T) { + // Create test servers for IdP and MCP Server + idpServer := createMockIdPServer(t) + defer idpServer.Close() + mcpServer := createMockMCPServer(t) + defer mcpServer.Close() + // Create a test ID Token + idToken := createTestIDToken() + // Configure enterprise auth + config := &EnterpriseAuthConfig{ + IdPIssuerURL: idpServer.URL, + IdPClientID: "test-idp-client", + IdPClientSecret: "test-idp-secret", + MCPAuthServerURL: mcpServer.URL, + MCPResourceURL: "https://mcp.example.com", + MCPClientID: "test-mcp-client", + MCPClientSecret: "test-mcp-secret", + MCPScopes: []string{"read", "write"}, + HTTPClient: idpServer.Client(), + } + // Test successful flow + t.Run("successful flow", func(t *testing.T) { + token, err := EnterpriseAuthFlow(context.Background(), config, idToken) + if err != nil { + t.Fatalf("EnterpriseAuthFlow failed: %v", err) + } + if token.AccessToken != "mcp-access-token" { + t.Errorf("expected access token 'mcp-access-token', got '%s'", token.AccessToken) + } + if token.TokenType != "Bearer" { + t.Errorf("expected token type 'Bearer', got '%s'", token.TokenType) + } + }) + // Test missing config + t.Run("nil config", func(t *testing.T) { + _, err := EnterpriseAuthFlow(context.Background(), nil, idToken) + if err == nil { + t.Error("expected error for nil config, got nil") + } + }) + // Test missing ID token + t.Run("empty ID token", func(t *testing.T) { + _, err := EnterpriseAuthFlow(context.Background(), config, "") + if err == nil { + t.Error("expected error for empty ID token, got nil") + } + }) + // Test missing IdP issuer + t.Run("missing IdP issuer", func(t *testing.T) { + badConfig := *config + badConfig.IdPIssuerURL = "" + _, err := EnterpriseAuthFlow(context.Background(), &badConfig, idToken) + if err == nil { + t.Error("expected error for missing IdP issuer, got nil") + } + }) +} + +// createMockIdPServer creates a mock IdP server for testing. +func createMockIdPServer(t *testing.T) *httptest.Server { + var serverURL string + server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + // Handle OIDC discovery endpoint + if r.URL.Path == "/.well-known/openid-configuration" { + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(map[string]interface{}{ + "issuer": serverURL, // Use actual server URL + "token_endpoint": serverURL + "/oauth2/v1/token", + "jwks_uri": serverURL + "/.well-known/jwks.json", + "code_challenge_methods_supported": []string{"S256"}, + "grant_types_supported": []string{ + "authorization_code", + "urn:ietf:params:oauth:grant-type:token-exchange", + }, + "response_types_supported": []string{"code"}, + }) + return + } + + // Handle token exchange endpoint + if r.URL.Path != "/oauth2/v1/token" { + http.NotFound(w, r) + return + } + + if err := r.ParseForm(); err != nil { + http.Error(w, "failed to parse form", http.StatusBadRequest) + return + } + grantType := r.FormValue("grant_type") + if grantType != oauthex.GrantTypeTokenExchange { + http.Error(w, "invalid grant type", http.StatusBadRequest) + return + } + + // Return a mock ID-JAG + now := time.Now().Unix() + header := map[string]string{"typ": "oauth-id-jag+jwt", "alg": "RS256"} + claims := map[string]interface{}{ + "iss": "https://test.okta.com", + "sub": "test-user", + "aud": r.FormValue("audience"), + "resource": r.FormValue("resource"), + "client_id": r.FormValue("client_id"), + "jti": "test-jti", + "exp": now + 300, + "iat": now, + "scope": r.FormValue("scope"), + } + headerJSON, _ := json.Marshal(header) + claimsJSON, _ := json.Marshal(claims) + headerB64 := base64.RawURLEncoding.EncodeToString(headerJSON) + claimsB64 := base64.RawURLEncoding.EncodeToString(claimsJSON) + mockIDJAG := fmt.Sprintf("%s.%s.mock-signature", headerB64, claimsB64) + + resp := oauthex.TokenExchangeResponse{ + IssuedTokenType: oauthex.TokenTypeIDJAG, + AccessToken: mockIDJAG, + TokenType: "N_A", + ExpiresIn: 300, + } + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(resp) + })) + serverURL = server.URL // Capture server URL for discovery response + return server +} + +// createMockMCPServer creates a mock MCP Server for testing. +func createMockMCPServer(t *testing.T) *httptest.Server { + var serverURL string + server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + // Handle OIDC discovery endpoint + if r.URL.Path == "/.well-known/openid-configuration" { + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(map[string]interface{}{ + "issuer": serverURL, // Use actual server URL + "token_endpoint": serverURL + "/v1/token", + "jwks_uri": serverURL + "/.well-known/jwks.json", + "code_challenge_methods_supported": []string{"S256"}, + "grant_types_supported": []string{ + "urn:ietf:params:oauth:grant-type:jwt-bearer", + }, + }) + return + } + + // Handle JWT Bearer endpoint + if r.URL.Path != "/v1/token" { + http.NotFound(w, r) + return + } + + if err := r.ParseForm(); err != nil { + http.Error(w, "failed to parse form", http.StatusBadRequest) + return + } + grantType := r.FormValue("grant_type") + if grantType != oauthex.GrantTypeJWTBearer { + http.Error(w, "invalid grant type", http.StatusBadRequest) + return + } + + resp := oauthex.JWTBearerResponse{ + AccessToken: "mcp-access-token", + TokenType: "Bearer", + ExpiresIn: 3600, + Scope: "read write", + RefreshToken: "mcp-refresh-token", + } + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(resp) + })) + serverURL = server.URL // Capture server URL for discovery response + return server +} + +// createTestIDToken creates a mock ID Token for testing. +func createTestIDToken() string { + now := time.Now().Unix() + header := map[string]string{"typ": "JWT", "alg": "RS256"} + claims := map[string]interface{}{ + "iss": "https://test.okta.com", + "sub": "test-user", + "aud": "test-client", + "exp": now + 3600, + "iat": now, + "email": "test@example.com", + } + headerJSON, _ := json.Marshal(header) + claimsJSON, _ := json.Marshal(claims) + headerB64 := base64.RawURLEncoding.EncodeToString(headerJSON) + claimsB64 := base64.RawURLEncoding.EncodeToString(claimsJSON) + + return fmt.Sprintf("%s.%s.mock-signature", headerB64, claimsB64) +} diff --git a/oauthex/id_jag.go b/oauthex/id_jag.go new file mode 100644 index 00000000..860a36ea --- /dev/null +++ b/oauthex/id_jag.go @@ -0,0 +1,138 @@ +// Copyright 2025 The Go MCP SDK Authors. All rights reserved. +// Use of this source code is governed by an MIT-style +// license that can be found in the LICENSE file. + +// This file implements ID-JAG (Identity Assertion JWT Authorization Grant) parsing +// for Enterprise Managed Authorization (SEP-990). +// See https://github.com/modelcontextprotocol/ext-auth/blob/main/specification/draft/enterprise-managed-authorization.mdx + +//go:build mcp_go_client_oauth + +package oauthex + +import ( + "encoding/base64" + "encoding/json" + "fmt" + "strings" + "time" +) + +// IDJAGClaims represents the claims in an Identity Assertion JWT Authorization Grant +// per SEP-990 Section 4.3. The ID-JAG is issued by the IdP during token exchange +// and describes the authorization grant for accessing an MCP Server. +type IDJAGClaims struct { + // Issuer is the IdP's issuer URL. + Issuer string `json:"iss"` + // Subject is the user identifier at the MCP Server. + Subject string `json:"sub"` + // Audience is the Issuer URL of the MCP Server's authorization server. + Audience string `json:"aud"` + // Resource is the Resource Identifier of the MCP Server. + Resource string `json:"resource"` + // ClientID is the identifier of the MCP Client that this JWT was issued to. + ClientID string `json:"client_id"` + // JTI is the unique identifier of this JWT. + JTI string `json:"jti"` + // ExpiresAt is the expiration time of this JWT (Unix timestamp). + ExpiresAt int64 `json:"exp"` + // IssuedAt is the time this JWT was issued (Unix timestamp). + IssuedAt int64 `json:"iat"` + // Scope is a space-separated list of scopes associated with the token. + Scope string `json:"scope,omitempty"` +} + +// Expiry returns the expiration time as a time.Time. +func (c *IDJAGClaims) Expiry() time.Time { + return time.Unix(c.ExpiresAt, 0) +} + +// IssuedTime returns the issued-at time as a time.Time. +func (c *IDJAGClaims) IssuedTime() time.Time { + return time.Unix(c.IssuedAt, 0) +} + +// IsExpired checks if the ID-JAG has expired. +func (c *IDJAGClaims) IsExpired() bool { + return time.Now().After(c.Expiry()) +} + +// ParseIDJAG parses an ID-JAG JWT and extracts its claims without validating +// the signature. This is useful for inspecting the contents of an ID-JAG during +// development or debugging. +// +// For production use on the server-side, use ValidateIDJAG instead, which +// performs full signature validation and claim verification. +// +// The JWT must have a "typ" header of "oauth-id-jag+jwt" per SEP-990 Section 4.3. +// +// Example: +// +// claims, err := ParseIDJAG(idJAG) +// if err != nil { +// log.Fatalf("Failed to parse ID-JAG: %v", err) +// } +// fmt.Printf("Subject: %s\n", claims.Subject) +// fmt.Printf("Expires: %v\n", claims.Expiry()) +func ParseIDJAG(jwt string) (*IDJAGClaims, error) { + if jwt == "" { + return nil, fmt.Errorf("JWT is empty") + } + // Split JWT into parts (header.payload.signature) + parts := strings.Split(jwt, ".") + if len(parts) != 3 { + return nil, fmt.Errorf("invalid JWT format: expected 3 parts, got %d", len(parts)) + } + // Decode header to check typ claim + headerJSON, err := base64.RawURLEncoding.DecodeString(parts[0]) + if err != nil { + return nil, fmt.Errorf("failed to decode JWT header: %w", err) + } + var header struct { + Type string `json:"typ"` + Alg string `json:"alg"` + } + if err := json.Unmarshal(headerJSON, &header); err != nil { + return nil, fmt.Errorf("failed to parse JWT header: %w", err) + } + // Verify typ claim per SEP-990 Section 4.3 + if header.Type != "oauth-id-jag+jwt" { + return nil, fmt.Errorf("invalid JWT type: expected 'oauth-id-jag+jwt', got '%s'", header.Type) + } + // Decode payload + payloadJSON, err := base64.RawURLEncoding.DecodeString(parts[1]) + if err != nil { + return nil, fmt.Errorf("failed to decode JWT payload: %w", err) + } + // Parse claims + var claims IDJAGClaims + if err := json.Unmarshal(payloadJSON, &claims); err != nil { + return nil, fmt.Errorf("failed to parse JWT claims: %w", err) + } + // Validate required claims are present per SEP-990 Section 4.3 + if claims.Issuer == "" { + return nil, fmt.Errorf("missing required claim: iss") + } + if claims.Subject == "" { + return nil, fmt.Errorf("missing required claim: sub") + } + if claims.Audience == "" { + return nil, fmt.Errorf("missing required claim: aud") + } + if claims.Resource == "" { + return nil, fmt.Errorf("missing required claim: resource") + } + if claims.ClientID == "" { + return nil, fmt.Errorf("missing required claim: client_id") + } + if claims.JTI == "" { + return nil, fmt.Errorf("missing required claim: jti") + } + if claims.ExpiresAt == 0 { + return nil, fmt.Errorf("missing required claim: exp") + } + if claims.IssuedAt == 0 { + return nil, fmt.Errorf("missing required claim: iat") + } + return &claims, nil +} diff --git a/oauthex/id_jag_test.go b/oauthex/id_jag_test.go new file mode 100644 index 00000000..ff710fcc --- /dev/null +++ b/oauthex/id_jag_test.go @@ -0,0 +1,176 @@ +// Copyright 2025 The Go MCP SDK Authors. All rights reserved. +// Use of this source code is governed by an MIT-style +// license that can be found in the LICENSE file. + +//go:build mcp_go_client_oauth + +package oauthex + +import ( + "encoding/base64" + "encoding/json" + "fmt" + "strings" + "testing" + "time" +) + +// TestParseIDJAG tests parsing of ID-JAG tokens. +func TestParseIDJAG(t *testing.T) { + // Create a test ID-JAG JWT + now := time.Now().Unix() + + header := map[string]string{ + "typ": "oauth-id-jag+jwt", + "alg": "RS256", + } + + claims := map[string]interface{}{ + "iss": "https://acme.okta.com", + "sub": "alice@acme.com", + "aud": "https://auth.mcpserver.example", + "resource": "https://mcp.mcpserver.example", + "client_id": "xyz789", + "jti": "unique-id-123", + "exp": now + 300, + "iat": now, + "scope": "read write", + } + // Encode header and payload + headerJSON, _ := json.Marshal(header) + claimsJSON, _ := json.Marshal(claims) + + headerB64 := base64.RawURLEncoding.EncodeToString(headerJSON) + claimsB64 := base64.RawURLEncoding.EncodeToString(claimsJSON) + + // Create fake JWT (header.payload.signature) + fakeJWT := fmt.Sprintf("%s.%s.fake-signature", headerB64, claimsB64) + // Test successful parsing + t.Run("successful parse", func(t *testing.T) { + parsed, err := ParseIDJAG(fakeJWT) + if err != nil { + t.Fatalf("ParseIDJAG failed: %v", err) + } + if parsed.Issuer != "https://acme.okta.com" { + t.Errorf("expected issuer 'https://acme.okta.com', got '%s'", parsed.Issuer) + } + if parsed.Subject != "alice@acme.com" { + t.Errorf("expected subject 'alice@acme.com', got '%s'", parsed.Subject) + } + if parsed.Audience != "https://auth.mcpserver.example" { + t.Errorf("expected audience 'https://auth.mcpserver.example', got '%s'", parsed.Audience) + } + if parsed.Resource != "https://mcp.mcpserver.example" { + t.Errorf("expected resource 'https://mcp.mcpserver.example', got '%s'", parsed.Resource) + } + if parsed.ClientID != "xyz789" { + t.Errorf("expected client_id 'xyz789', got '%s'", parsed.ClientID) + } + if parsed.JTI != "unique-id-123" { + t.Errorf("expected jti 'unique-id-123', got '%s'", parsed.JTI) + } + if parsed.Scope != "read write" { + t.Errorf("expected scope 'read write', got '%s'", parsed.Scope) + } + if parsed.IsExpired() { + t.Error("expected ID-JAG not to be expired") + } + }) + // Test empty JWT + t.Run("empty JWT", func(t *testing.T) { + _, err := ParseIDJAG("") + if err == nil { + t.Error("expected error for empty JWT, got nil") + } + }) + // Test invalid format + t.Run("invalid format", func(t *testing.T) { + _, err := ParseIDJAG("invalid.jwt") + if err == nil { + t.Error("expected error for invalid JWT format, got nil") + } + }) + // Test wrong typ header + t.Run("wrong typ header", func(t *testing.T) { + wrongHeader := map[string]string{ + "typ": "JWT", // Should be "oauth-id-jag+jwt" + "alg": "RS256", + } + wrongHeaderJSON, _ := json.Marshal(wrongHeader) + wrongHeaderB64 := base64.RawURLEncoding.EncodeToString(wrongHeaderJSON) + wrongJWT := fmt.Sprintf("%s.%s.fake-signature", wrongHeaderB64, claimsB64) + _, err := ParseIDJAG(wrongJWT) + if err == nil { + t.Error("expected error for wrong typ header, got nil") + } + if err != nil && !strings.Contains(err.Error(), "invalid JWT type") { + t.Errorf("expected 'invalid JWT type' error, got: %v", err) + } + }) + // Test missing required claims + t.Run("missing required claims", func(t *testing.T) { + incompleteClaims := map[string]interface{}{ + "iss": "https://acme.okta.com", + // Missing other required claims + } + incompleteJSON, _ := json.Marshal(incompleteClaims) + incompleteB64 := base64.RawURLEncoding.EncodeToString(incompleteJSON) + incompleteJWT := fmt.Sprintf("%s.%s.fake-signature", headerB64, incompleteB64) + _, err := ParseIDJAG(incompleteJWT) + if err == nil { + t.Error("expected error for missing claims, got nil") + } + }) + // Test expired ID-JAG + t.Run("expired ID-JAG", func(t *testing.T) { + expiredClaims := map[string]interface{}{ + "iss": "https://acme.okta.com", + "sub": "alice@acme.com", + "aud": "https://auth.mcpserver.example", + "resource": "https://mcp.mcpserver.example", + "client_id": "xyz789", + "jti": "unique-id-123", + "exp": now - 300, // Expired 5 minutes ago + "iat": now - 600, + "scope": "read write", + } + expiredJSON, _ := json.Marshal(expiredClaims) + expiredB64 := base64.RawURLEncoding.EncodeToString(expiredJSON) + expiredJWT := fmt.Sprintf("%s.%s.fake-signature", headerB64, expiredB64) + parsed, err := ParseIDJAG(expiredJWT) + if err != nil { + t.Fatalf("ParseIDJAG failed: %v", err) + } + if !parsed.IsExpired() { + t.Error("expected ID-JAG to be expired") + } + }) +} + +// TestIDJAGClaimsMethods tests the helper methods on IDJAGClaims. +func TestIDJAGClaimsMethods(t *testing.T) { + now := time.Now() + claims := &IDJAGClaims{ + ExpiresAt: now.Add(1 * time.Hour).Unix(), + IssuedAt: now.Unix(), + } + // Test Expiry + expiry := claims.Expiry() + if expiry.Before(now) { + t.Error("expected expiry to be in the future") + } + // Test IssuedTime + issued := claims.IssuedTime() + if issued.After(now.Add(1 * time.Second)) { + t.Error("expected issued time to be in the past") + } + // Test IsExpired (should not be expired) + if claims.IsExpired() { + t.Error("expected claims not to be expired") + } + // Test IsExpired (should be expired) + claims.ExpiresAt = now.Add(-1 * time.Hour).Unix() + if !claims.IsExpired() { + t.Error("expected claims to be expired") + } +} From c10d6fac4f404a634d45c0f2747ef81f97c02b9a Mon Sep 17 00:00:00 2001 From: Pranav RK Date: Mon, 24 Nov 2025 19:59:31 +0530 Subject: [PATCH 04/10] chore: use auth server metadata for token endpoints --- auth/enterprise_auth.go | 29 ++++++++++++++++------------- oauthex/oauth2.go | 4 +--- 2 files changed, 17 insertions(+), 16 deletions(-) diff --git a/auth/enterprise_auth.go b/auth/enterprise_auth.go index 1fd471dc..5478e0e4 100644 --- a/auth/enterprise_auth.go +++ b/auth/enterprise_auth.go @@ -91,7 +91,13 @@ func EnterpriseAuthFlow( httpClient = http.DefaultClient } - // Step 1: Token Exchange (ID Token → ID-JAG) + // Step 1: Discover IdP token endpoint via OIDC discovery + idpMeta, err := oauthex.GetAuthServerMeta(ctx, config.IdPIssuerURL, httpClient) + if err != nil { + return nil, fmt.Errorf("failed to discover IdP metadata: %w", err) + } + + // Step 2: Token Exchange (ID Token → ID-JAG) tokenExchangeReq := &oauthex.TokenExchangeRequest{ RequestedTokenType: oauthex.TokenTypeIDJAG, Audience: config.MCPAuthServerURL, @@ -100,14 +106,10 @@ func EnterpriseAuthFlow( SubjectToken: idToken, SubjectTokenType: oauthex.TokenTypeIDToken, } - // Construct IdP token endpoint (assuming standard path) - idpTokenEndpoint := config.IdPIssuerURL + "/oauth2/v1/token" - if config.IdPIssuerURL[len(config.IdPIssuerURL)-1] == '/' { - idpTokenEndpoint = config.IdPIssuerURL + "oauth2/v1/token" - } + tokenExchangeResp, err := oauthex.ExchangeToken( ctx, - idpTokenEndpoint, + idpMeta.TokenEndpoint, tokenExchangeReq, config.IdPClientID, config.IdPClientSecret, @@ -117,15 +119,16 @@ func EnterpriseAuthFlow( return nil, fmt.Errorf("token exchange failed: %w", err) } - // Step 2: JWT Bearer Grant (ID-JAG → Access Token) - mcpTokenEndpoint := config.MCPAuthServerURL + "/v1/token" - if config.MCPAuthServerURL[len(config.MCPAuthServerURL)-1] == '/' { - mcpTokenEndpoint = config.MCPAuthServerURL + "v1/token" + // Step 3: JWT Bearer Grant (ID-JAG → Access Token) + mcpMeta, err := oauthex.GetAuthServerMeta(ctx, config.MCPAuthServerURL, httpClient) + if err != nil { + return nil, fmt.Errorf("failed to discover MCP auth server metadata: %w", err) } + accessToken, err := oauthex.ExchangeJWTBearer( ctx, - mcpTokenEndpoint, - tokenExchangeResp.AccessToken, // The ID-JAG + mcpMeta.TokenEndpoint, + tokenExchangeResp.AccessToken, config.MCPClientID, config.MCPClientSecret, httpClient, diff --git a/oauthex/oauth2.go b/oauthex/oauth2.go index cdda695b..7595eb0c 100644 --- a/oauthex/oauth2.go +++ b/oauthex/oauth2.go @@ -58,9 +58,7 @@ func getJSON[T any](ctx context.Context, c *http.Client, url string, limit int64 return nil, fmt.Errorf("bad status %s", res.Status) } // Specs require application/json. - ct := res.Header.Get("Content-Type") - mediaType, _, err := mime.ParseMediaType(ct) - if err != nil || mediaType != "application/json" { + if ct := res.Header.Get("Content-Type"); ct != "application/json" { return nil, fmt.Errorf("bad content type %q", ct) } From 1f13a84acd37da00f3b4b271dbc3d86ea2ce8eb4 Mon Sep 17 00:00:00 2001 From: Pranav RK Date: Mon, 24 Nov 2025 21:11:04 +0530 Subject: [PATCH 05/10] feat: fetch jwks for jwt signature verification --- auth/jwks_cache.go | 150 ++++++++++++++++++++++++++++++ auth/jwks_cache_test.go | 199 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 349 insertions(+) create mode 100644 auth/jwks_cache.go create mode 100644 auth/jwks_cache_test.go diff --git a/auth/jwks_cache.go b/auth/jwks_cache.go new file mode 100644 index 00000000..70efe89f --- /dev/null +++ b/auth/jwks_cache.go @@ -0,0 +1,150 @@ +// Copyright 2025 The Go MCP SDK Authors. All rights reserved. +// Use of this source code is governed by an MIT-style +// license that can be found in the LICENSE file. + +// This file implements JWKS (JSON Web Key Set) fetching and caching for +// JWT signature verification in Enterprise Managed Authorization (SEP-990). + +//go:build mcp_go_client_oauth + +package auth + +import ( + "context" + "encoding/json" + "fmt" + "io" + "net/http" + "sync" + "time" +) + +// JWK represents a JSON Web Key per RFC 7517. +type JWK struct { + // KeyType is the key type (e.g., "RSA", "EC"). + KeyType string `json:"kty"` + // Use indicates the intended use of the key (e.g., "sig" for signature). + Use string `json:"use,omitempty"` + // KeyID is the key identifier. + KeyID string `json:"kid"` + // Algorithm is the algorithm intended for use with the key. + Algorithm string `json:"alg,omitempty"` + // N is the RSA modulus (base64url encoded). + N string `json:"n,omitempty"` + // E is the RSA public exponent (base64url encoded). + E string `json:"e,omitempty"` + // X is the X coordinate for elliptic curve keys (base64url encoded). + X string `json:"x,omitempty"` + // Y is the Y coordinate for elliptic curve keys (base64url encoded). + Y string `json:"y,omitempty"` + // Curve is the elliptic curve name (e.g., "P-256"). + Curve string `json:"crv,omitempty"` +} + +// JWKS represents a JSON Web Key Set per RFC 7517. +type JWKS struct { + Keys []JWK `json:"keys"` +} + +// FindKey finds a key by its key ID (kid). +func (j *JWKS) FindKey(kid string) (*JWK, error) { + for i := range j.Keys { + if j.Keys[i].KeyID == kid { + return &j.Keys[i], nil + } + } + return nil, fmt.Errorf("key with kid %q not found", kid) +} + +// JWKSCache caches JWKS responses to reduce network requests. +type JWKSCache struct { + mu sync.RWMutex + entries map[string]*jwksCacheEntry + client *http.Client +} +type jwksCacheEntry struct { + jwks *JWKS + expiresAt time.Time +} + +// NewJWKSCache creates a new JWKS cache with the given HTTP client. +// If client is nil, http.DefaultClient is used. +func NewJWKSCache(client *http.Client) *JWKSCache { + if client == nil { + client = http.DefaultClient + } + return &JWKSCache{ + entries: make(map[string]*jwksCacheEntry), + client: client, + } +} + +// Get fetches JWKS from the given URL, using cache if available and not expired. +// The cache duration is 1 hour per best practices for JWKS caching. +func (c *JWKSCache) Get(ctx context.Context, jwksURL string) (*JWKS, error) { + // Check cache first + c.mu.RLock() + entry, ok := c.entries[jwksURL] + c.mu.RUnlock() + if ok && time.Now().Before(entry.expiresAt) { + return entry.jwks, nil + } + // Fetch from network + jwks, err := c.fetch(ctx, jwksURL) + if err != nil { + return nil, err + } + // Update cache + c.mu.Lock() + c.entries[jwksURL] = &jwksCacheEntry{ + jwks: jwks, + expiresAt: time.Now().Add(1 * time.Hour), + } + c.mu.Unlock() + return jwks, nil +} + +// fetch retrieves JWKS from the given URL. +func (c *JWKSCache) fetch(ctx context.Context, jwksURL string) (*JWKS, error) { + req, err := http.NewRequestWithContext(ctx, http.MethodGet, jwksURL, nil) + if err != nil { + return nil, fmt.Errorf("failed to create JWKS request: %w", err) + } + req.Header.Set("Accept", "application/json") + resp, err := c.client.Do(req) + if err != nil { + return nil, fmt.Errorf("failed to fetch JWKS: %w", err) + } + defer resp.Body.Close() + if resp.StatusCode != http.StatusOK { + return nil, fmt.Errorf("JWKS endpoint returned status %d", resp.StatusCode) + } + // Read response body (limit to 1MB for safety) + body, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20)) + if err != nil { + return nil, fmt.Errorf("failed to read JWKS response: %w", err) + } + // Parse JWKS + var jwks JWKS + if err := json.Unmarshal(body, &jwks); err != nil { + return nil, fmt.Errorf("failed to parse JWKS: %w", err) + } + if len(jwks.Keys) == 0 { + return nil, fmt.Errorf("JWKS contains no keys") + } + return &jwks, nil +} + +// Invalidate removes a JWKS entry from the cache, forcing a fresh fetch on next Get. +func (c *JWKSCache) Invalidate(jwksURL string) { + c.mu.Lock() + delete(c.entries, jwksURL) + c.mu.Unlock() +} + +// Clear removes all entries from the cache. +func (c *JWKSCache) Clear() { + c.mu.Lock() + c.entries = make(map[string]*jwksCacheEntry) + c.mu.Unlock() +} diff --git a/auth/jwks_cache_test.go b/auth/jwks_cache_test.go new file mode 100644 index 00000000..4ec87ca7 --- /dev/null +++ b/auth/jwks_cache_test.go @@ -0,0 +1,199 @@ +// Copyright 2025 The Go MCP SDK Authors. All rights reserved. +// Use of this source code is governed by an MIT-style +// license that can be found in the LICENSE file. + +//go:build mcp_go_client_oauth + +package auth + +import ( + "context" + "encoding/json" + "net/http" + "net/http/httptest" + "testing" + "time" +) + +// TestJWKSCache tests JWKS fetching and caching. +func TestJWKSCache(t *testing.T) { + // Create test JWKS + testJWKS := &JWKS{ + Keys: []JWK{ + { + KeyType: "RSA", + Use: "sig", + KeyID: "test-key-1", + Algorithm: "RS256", + N: "test-modulus", + E: "AQAB", + }, + { + KeyType: "RSA", + Use: "sig", + KeyID: "test-key-2", + Algorithm: "RS256", + N: "test-modulus-2", + E: "AQAB", + }, + }, + } + // Create test server + var requestCount int + server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + requestCount++ + if r.Method != http.MethodGet { + http.Error(w, "method not allowed", http.StatusMethodNotAllowed) + return + } + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(testJWKS) + })) + defer server.Close() + cache := NewJWKSCache(server.Client()) + // Test first fetch + t.Run("first fetch", func(t *testing.T) { + jwks, err := cache.Get(context.Background(), server.URL) + if err != nil { + t.Fatalf("Get failed: %v", err) + } + if len(jwks.Keys) != 2 { + t.Errorf("expected 2 keys, got %d", len(jwks.Keys)) + } + if jwks.Keys[0].KeyID != "test-key-1" { + t.Errorf("expected key ID 'test-key-1', got '%s'", jwks.Keys[0].KeyID) + } + if requestCount != 1 { + t.Errorf("expected 1 request, got %d", requestCount) + } + }) + // Test cache hit + t.Run("cache hit", func(t *testing.T) { + jwks, err := cache.Get(context.Background(), server.URL) + if err != nil { + t.Fatalf("Get failed: %v", err) + } + if len(jwks.Keys) != 2 { + t.Errorf("expected 2 keys from cache, got %d", len(jwks.Keys)) + } + // Should still be 1 request (served from cache) + if requestCount != 1 { + t.Errorf("expected 1 request (cached), got %d", requestCount) + } + }) + // Test FindKey + t.Run("find key", func(t *testing.T) { + jwks, _ := cache.Get(context.Background(), server.URL) + key, err := jwks.FindKey("test-key-2") + if err != nil { + t.Fatalf("FindKey failed: %v", err) + } + if key.KeyID != "test-key-2" { + t.Errorf("expected key ID 'test-key-2', got '%s'", key.KeyID) + } + if key.N != "test-modulus-2" { + t.Errorf("expected modulus 'test-modulus-2', got '%s'", key.N) + } + }) + // Test key not found + t.Run("key not found", func(t *testing.T) { + jwks, _ := cache.Get(context.Background(), server.URL) + _, err := jwks.FindKey("nonexistent") + if err == nil { + t.Error("expected error for nonexistent key, got nil") + } + }) + // Test Invalidate + t.Run("invalidate", func(t *testing.T) { + cache.Invalidate(server.URL) + // Next fetch should hit the server again + _, err := cache.Get(context.Background(), server.URL) + if err != nil { + t.Fatalf("Get after invalidate failed: %v", err) + } + if requestCount != 2 { + t.Errorf("expected 2 requests after invalidate, got %d", requestCount) + } + }) + // Test Clear + t.Run("clear", func(t *testing.T) { + cache.Clear() + // Next fetch should hit the server again + _, err := cache.Get(context.Background(), server.URL) + if err != nil { + t.Fatalf("Get after clear failed: %v", err) + } + if requestCount != 3 { + t.Errorf("expected 3 requests after clear, got %d", requestCount) + } + }) + // Test error handling + t.Run("server error", func(t *testing.T) { + errorServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + http.Error(w, "internal error", http.StatusInternalServerError) + })) + defer errorServer.Close() + _, err := cache.Get(context.Background(), errorServer.URL) + if err == nil { + t.Error("expected error for server error, got nil") + } + }) + // Test invalid JSON + t.Run("invalid json", func(t *testing.T) { + invalidServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Type", "application/json") + w.Write([]byte("invalid json")) + })) + defer invalidServer.Close() + _, err := cache.Get(context.Background(), invalidServer.URL) + if err == nil { + t.Error("expected error for invalid JSON, got nil") + } + }) + // Test empty keys + t.Run("empty keys", func(t *testing.T) { + emptyServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(&JWKS{Keys: []JWK{}}) + })) + defer emptyServer.Close() + _, err := cache.Get(context.Background(), emptyServer.URL) + if err == nil { + t.Error("expected error for empty keys, got nil") + } + }) +} + +// TestJWKSCacheExpiration tests cache expiration. +func TestJWKSCacheExpiration(t *testing.T) { + testJWKS := &JWKS{ + Keys: []JWK{{KeyID: "test", KeyType: "RSA", N: "test", E: "AQAB"}}, + } + var requestCount int + server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + requestCount++ + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(testJWKS) + })) + defer server.Close() + cache := NewJWKSCache(server.Client()) + // First fetch + _, err := cache.Get(context.Background(), server.URL) + if err != nil { + t.Fatalf("Get failed: %v", err) + } + // Manually expire the cache entry + cache.mu.Lock() + if entry, ok := cache.entries[server.URL]; ok { + entry.expiresAt = time.Now().Add(-1 * time.Hour) + } + cache.mu.Unlock() + // Next fetch should hit server again + _, err = cache.Get(context.Background(), server.URL) + if err != nil { + t.Fatalf("Get after expiration failed: %v", err) + } + if requestCount != 2 { + t.Errorf("expected 2 requests after expiration, got %d", requestCount) + } +} From 7ae14ce9d5c65bf7330f9282d60a57d15d436ed9 Mon Sep 17 00:00:00 2001 From: Pranav RK Date: Mon, 24 Nov 2025 21:21:19 +0530 Subject: [PATCH 06/10] feat: add id-jag validation for mcp servers --- auth/id_jag_verifier.go | 250 +++++++++++++++++++++++++++++++++++ auth/id_jag_verifier_test.go | 191 ++++++++++++++++++++++++++ 2 files changed, 441 insertions(+) create mode 100644 auth/id_jag_verifier.go create mode 100644 auth/id_jag_verifier_test.go diff --git a/auth/id_jag_verifier.go b/auth/id_jag_verifier.go new file mode 100644 index 00000000..45cb710d --- /dev/null +++ b/auth/id_jag_verifier.go @@ -0,0 +1,250 @@ +// Copyright 2025 The Go MCP SDK Authors. All rights reserved. +// Use of this source code is governed by an MIT-style +// license that can be found in the LICENSE file. + +// This file implements ID-JAG (Identity Assertion JWT Authorization Grant) validation +// for MCP Servers in Enterprise Managed Authorization (SEP-990). + +//go:build mcp_go_client_oauth + +package auth + +import ( + "context" + "crypto/rsa" + "encoding/base64" + "encoding/json" + "fmt" + "math/big" + "net/http" + "strings" + "sync" + "time" + + "github.com/golang-jwt/jwt/v5" + "github.com/modelcontextprotocol/go-sdk/oauthex" +) + +// TrustedIdPConfig contains configuration for a trusted Identity Provider. +type TrustedIdPConfig struct { + // IssuerURL is the IdP's issuer URL (must match the iss claim). + IssuerURL string + // JWKSURL is the URL to fetch the IdP's JSON Web Key Set. + JWKSURL string +} + +// IDJAGVerifierConfig configures ID-JAG validation for an MCP Server. +type IDJAGVerifierConfig struct { + // AuthServerIssuerURL is this MCP Server's authorization server issuer URL. + // This must match the aud claim in the ID-JAG. + AuthServerIssuerURL string + // TrustedIdPs is a map of trusted Identity Providers. + // The key is a friendly name, the value is the IdP configuration. + TrustedIdPs map[string]*TrustedIdPConfig + // JWKSCache is the cache for JWKS responses. If nil, a new cache is created. + JWKSCache *JWKSCache + // HTTPClient is the HTTP client for fetching JWKS. If nil, http.DefaultClient is used. + HTTPClient *http.Client + // AllowedClockSkew is the allowed clock skew for exp/iat validation. + // Default is 5 minutes. + AllowedClockSkew time.Duration +} + +// IDJAGVerifier validates ID-JAG tokens for MCP Servers. +type IDJAGVerifier struct { + config *IDJAGVerifierConfig + jwksCache *JWKSCache + usedJTIs map[string]time.Time // Replay attack prevention + usedJTIMu sync.RWMutex +} + +// NewIDJAGVerifier creates a new ID-JAG verifier with the given configuration. +// This returns a TokenVerifier that can be used with RequireBearerToken middleware. +// +// Example: +// +// config := &IDJAGVerifierConfig{ +// AuthServerIssuerURL: "https://auth.mcpserver.example", +// TrustedIdPs: map[string]*TrustedIdPConfig{ +// "acme-okta": { +// IssuerURL: "https://acme.okta.com", +// JWKSURL: "https://acme.okta.com/.well-known/jwks.json", +// }, +// }, +// } +// +// verifier := NewIDJAGVerifier(config) +// middleware := RequireBearerToken(verifier, &RequireBearerTokenOptions{ +// Scopes: []string{"read"}, +// }) +func NewIDJAGVerifier(config *IDJAGVerifierConfig) TokenVerifier { + if config.JWKSCache == nil { + config.JWKSCache = NewJWKSCache(config.HTTPClient) + } + if config.AllowedClockSkew == 0 { + config.AllowedClockSkew = 5 * time.Minute + } + verifier := &IDJAGVerifier{ + config: config, + jwksCache: config.JWKSCache, + usedJTIs: make(map[string]time.Time), + } + // Start cleanup goroutine for JTI tracking + go verifier.cleanupExpiredJTIs() + return verifier.Verify +} + +// Verify validates an ID-JAG token and returns TokenInfo. +// This implements the TokenVerifier interface. +func (v *IDJAGVerifier) Verify(ctx context.Context, token string, req *http.Request) (*TokenInfo, error) { + // Step 1: Parse the ID-JAG (without signature verification yet) + claims, err := oauthex.ParseIDJAG(token) + if err != nil { + return nil, fmt.Errorf("%w: failed to parse ID-JAG: %v", ErrInvalidToken, err) + } + // Step 2: Check if expired (with clock skew) + expiryTime := time.Unix(claims.ExpiresAt, 0) + if time.Now().After(expiryTime.Add(v.config.AllowedClockSkew)) { + return nil, fmt.Errorf("%w: ID-JAG expired at %v", ErrInvalidToken, expiryTime) + } + // Step 3: Validate aud claim per SEP-990 Section 5.1 + if claims.Audience != v.config.AuthServerIssuerURL { + return nil, fmt.Errorf("%w: invalid audience: expected %q, got %q", + ErrInvalidToken, v.config.AuthServerIssuerURL, claims.Audience) + } + // Step 4: Find trusted IdP + var trustedIdP *TrustedIdPConfig + for _, idp := range v.config.TrustedIdPs { + if idp.IssuerURL == claims.Issuer { + trustedIdP = idp + break + } + } + if trustedIdP == nil { + return nil, fmt.Errorf("%w: untrusted issuer: %q", ErrInvalidToken, claims.Issuer) + } + // Step 5: Verify JWT signature using IdP's JWKS + if err := v.verifySignature(ctx, token, trustedIdP.JWKSURL); err != nil { + return nil, fmt.Errorf("%w: signature verification failed: %v", ErrInvalidToken, err) + } + // Step 6: Replay attack prevention (check JTI) + if err := v.checkJTI(claims.JTI, expiryTime); err != nil { + return nil, fmt.Errorf("%w: %v", ErrInvalidToken, err) + } + // Step 7: Return TokenInfo + scopes := []string{} + if claims.Scope != "" { + scopes = strings.Split(claims.Scope, " ") + } + return &TokenInfo{ + Scopes: scopes, + Expiration: expiryTime, + Extra: map[string]any{ + "sub": claims.Subject, + "client_id": claims.ClientID, + "resource": claims.Resource, + "iss": claims.Issuer, + }, + }, nil +} + +// verifySignature verifies the JWT signature using the IdP's JWKS. +func (v *IDJAGVerifier) verifySignature(ctx context.Context, tokenString, jwksURL string) error { + // Parse JWT to get header + parts := strings.Split(tokenString, ".") + if len(parts) != 3 { + return fmt.Errorf("invalid JWT format") + } + // Decode header to get kid + headerJSON, err := base64.RawURLEncoding.DecodeString(parts[0]) + if err != nil { + return fmt.Errorf("failed to decode JWT header: %w", err) + } + var header struct { + Kid string `json:"kid"` + Alg string `json:"alg"` + } + if err := json.Unmarshal(headerJSON, &header); err != nil { + return fmt.Errorf("failed to parse JWT header: %w", err) + } + // Fetch JWKS + jwks, err := v.jwksCache.Get(ctx, jwksURL) + if err != nil { + return fmt.Errorf("failed to fetch JWKS: %w", err) + } + // Find the key + jwk, err := jwks.FindKey(header.Kid) + if err != nil { + return fmt.Errorf("key not found in JWKS: %w", err) + } + // Parse JWT with verification + token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) { + // Verify algorithm + if token.Method.Alg() != header.Alg { + return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"]) + } + // Convert JWK to public key + return jwkToPublicKey(jwk) + }) + if err != nil { + return fmt.Errorf("JWT verification failed: %w", err) + } + if !token.Valid { + return fmt.Errorf("JWT is invalid") + } + return nil +} + +// checkJTI checks if the JTI has been used before (replay attack prevention). +func (v *IDJAGVerifier) checkJTI(jti string, expiresAt time.Time) error { + v.usedJTIMu.Lock() + defer v.usedJTIMu.Unlock() + if _, used := v.usedJTIs[jti]; used { + return fmt.Errorf("JTI %q already used (replay attack)", jti) + } + // Mark as used + v.usedJTIs[jti] = expiresAt + return nil +} + +// cleanupExpiredJTIs periodically removes expired JTIs from the tracking map. +func (v *IDJAGVerifier) cleanupExpiredJTIs() { + ticker := time.NewTicker(10 * time.Minute) + defer ticker.Stop() + for range ticker.C { + v.usedJTIMu.Lock() + now := time.Now() + for jti, expiresAt := range v.usedJTIs { + if now.After(expiresAt) { + delete(v.usedJTIs, jti) + } + } + v.usedJTIMu.Unlock() + } +} + +// jwkToPublicKey converts a JWK to a public key for signature verification. +func jwkToPublicKey(jwk *JWK) (interface{}, error) { + switch jwk.KeyType { + case "RSA": + // Decode modulus + nBytes, err := base64.RawURLEncoding.DecodeString(jwk.N) + if err != nil { + return nil, fmt.Errorf("failed to decode modulus: %w", err) + } + // Decode exponent + eBytes, err := base64.RawURLEncoding.DecodeString(jwk.E) + if err != nil { + return nil, fmt.Errorf("failed to decode exponent: %w", err) + } + // Convert to big.Int + n := new(big.Int).SetBytes(nBytes) + e := new(big.Int).SetBytes(eBytes) + return &rsa.PublicKey{ + N: n, + E: int(e.Int64()), + }, nil + default: + return nil, fmt.Errorf("unsupported key type: %s", jwk.KeyType) + } +} diff --git a/auth/id_jag_verifier_test.go b/auth/id_jag_verifier_test.go new file mode 100644 index 00000000..544aef6b --- /dev/null +++ b/auth/id_jag_verifier_test.go @@ -0,0 +1,191 @@ +// Copyright 2025 The Go MCP SDK Authors. All rights reserved. +// Use of this source code is governed by an MIT-style +// license that can be found in the LICENSE file. + +//go:build mcp_go_client_oauth + +package auth + +import ( + "context" + "crypto/rand" + "crypto/rsa" + "encoding/base64" + "encoding/json" + "fmt" + "math/big" + "net/http" + "net/http/httptest" + "strings" + "testing" + "time" + + "github.com/golang-jwt/jwt/v5" +) + +// TestIDJAGVerifier tests ID-JAG validation. +func TestIDJAGVerifier(t *testing.T) { + // Generate RSA key pair for testing + privateKey, err := rsa.GenerateKey(rand.Reader, 2048) + if err != nil { + t.Fatalf("Failed to generate key: %v", err) + } + publicKey := &privateKey.PublicKey + // Create mock JWKS server + jwksServer := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + jwks := &JWKS{ + Keys: []JWK{ + { + KeyType: "RSA", + Use: "sig", + KeyID: "test-key", + Algorithm: "RS256", + N: base64.RawURLEncoding.EncodeToString(publicKey.N.Bytes()), + E: base64.RawURLEncoding.EncodeToString(big.NewInt(int64(publicKey.E)).Bytes()), + }, + }, + } + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(jwks) + })) + defer jwksServer.Close() + // Configure verifier + config := &IDJAGVerifierConfig{ + AuthServerIssuerURL: "https://auth.mcpserver.example", + TrustedIdPs: map[string]*TrustedIdPConfig{ + "test-idp": { + IssuerURL: "https://test.okta.com", + JWKSURL: jwksServer.URL, + }, + }, + HTTPClient: jwksServer.Client(), + } + verifier := NewIDJAGVerifier(config) + // Test valid ID-JAG + t.Run("valid ID-JAG", func(t *testing.T) { + idJAG := createTestIDJAG(t, privateKey, map[string]interface{}{ + "iss": "https://test.okta.com", + "sub": "user123", + "aud": "https://auth.mcpserver.example", + "resource": "https://mcp.mcpserver.example", + "client_id": "client123", + "jti": "jti-" + fmt.Sprint(time.Now().UnixNano()), + "exp": time.Now().Add(1 * time.Hour).Unix(), + "iat": time.Now().Unix(), + "scope": "read write", + }) + tokenInfo, err := verifier(context.Background(), idJAG, nil) + if err != nil { + t.Fatalf("Verify failed: %v", err) + } + if len(tokenInfo.Scopes) != 2 { + t.Errorf("expected 2 scopes, got %d", len(tokenInfo.Scopes)) + } + if tokenInfo.Extra["sub"] != "user123" { + t.Errorf("expected sub 'user123', got %v", tokenInfo.Extra["sub"]) + } + if tokenInfo.Extra["client_id"] != "client123" { + t.Errorf("expected client_id 'client123', got %v", tokenInfo.Extra["client_id"]) + } + }) + // Test expired ID-JAG + t.Run("expired ID-JAG", func(t *testing.T) { + idJAG := createTestIDJAG(t, privateKey, map[string]interface{}{ + "iss": "https://test.okta.com", + "sub": "user123", + "aud": "https://auth.mcpserver.example", + "resource": "https://mcp.mcpserver.example", + "client_id": "client123", + "jti": "jti-expired", + "exp": time.Now().Add(-1 * time.Hour).Unix(), + "iat": time.Now().Add(-2 * time.Hour).Unix(), + "scope": "read write", + }) + _, err := verifier(context.Background(), idJAG, nil) + if err == nil { + t.Error("expected error for expired ID-JAG, got nil") + } + }) + // Test wrong audience + t.Run("wrong audience", func(t *testing.T) { + idJAG := createTestIDJAG(t, privateKey, map[string]interface{}{ + "iss": "https://test.okta.com", + "sub": "user123", + "aud": "https://wrong.audience.com", + "resource": "https://mcp.mcpserver.example", + "client_id": "client123", + "jti": "jti-wrong-aud", + "exp": time.Now().Add(1 * time.Hour).Unix(), + "iat": time.Now().Unix(), + "scope": "read write", + }) + _, err := verifier(context.Background(), idJAG, nil) + if err == nil { + t.Error("expected error for wrong audience, got nil") + } + if !strings.Contains(err.Error(), "invalid audience") { + t.Errorf("expected 'invalid audience' error, got: %v", err) + } + }) + // Test untrusted issuer + t.Run("untrusted issuer", func(t *testing.T) { + idJAG := createTestIDJAG(t, privateKey, map[string]interface{}{ + "iss": "https://untrusted.idp.com", + "sub": "user123", + "aud": "https://auth.mcpserver.example", + "resource": "https://mcp.mcpserver.example", + "client_id": "client123", + "jti": "jti-untrusted", + "exp": time.Now().Add(1 * time.Hour).Unix(), + "iat": time.Now().Unix(), + "scope": "read write", + }) + _, err := verifier(context.Background(), idJAG, nil) + if err == nil { + t.Error("expected error for untrusted issuer, got nil") + } + if !strings.Contains(err.Error(), "untrusted issuer") { + t.Errorf("expected 'untrusted issuer' error, got: %v", err) + } + }) + // Test replay attack + t.Run("replay attack", func(t *testing.T) { + jti := "jti-replay-" + fmt.Sprint(time.Now().UnixNano()) + idJAG := createTestIDJAG(t, privateKey, map[string]interface{}{ + "iss": "https://test.okta.com", + "sub": "user123", + "aud": "https://auth.mcpserver.example", + "resource": "https://mcp.mcpserver.example", + "client_id": "client123", + "jti": jti, + "exp": time.Now().Add(1 * time.Hour).Unix(), + "iat": time.Now().Unix(), + "scope": "read write", + }) + // First use should succeed + _, err := verifier(context.Background(), idJAG, nil) + if err != nil { + t.Fatalf("First verify failed: %v", err) + } + // Second use (replay) should fail + _, err = verifier(context.Background(), idJAG, nil) + if err == nil { + t.Error("expected error for replay attack, got nil") + } + if !strings.Contains(err.Error(), "already used") { + t.Errorf("expected 'already used' error, got: %v", err) + } + }) +} + +// createTestIDJAG creates a test ID-JAG JWT signed with the given private key. +func createTestIDJAG(t *testing.T, privateKey *rsa.PrivateKey, claims map[string]interface{}) string { + token := jwt.NewWithClaims(jwt.SigningMethodRS256, jwt.MapClaims(claims)) + token.Header["typ"] = "oauth-id-jag+jwt" + token.Header["kid"] = "test-key" + signedToken, err := token.SignedString(privateKey) + if err != nil { + t.Fatalf("Failed to sign token: %v", err) + } + return signedToken +} From bfbeedb761b52e731710f369249d2f1445995b07 Mon Sep 17 00:00:00 2001 From: Pranav RK Date: Mon, 24 Nov 2025 23:16:30 +0530 Subject: [PATCH 07/10] feat: add oidc login for sso --- auth/enterprise_auth.go | 47 ++++- auth/oidc_login.go | 454 ++++++++++++++++++++++++++++++++++++++++ auth/oidc_login_test.go | 384 +++++++++++++++++++++++++++++++++ oauthex/oauth2.go | 6 + 4 files changed, 888 insertions(+), 3 deletions(-) create mode 100644 auth/oidc_login.go create mode 100644 auth/oidc_login_test.go diff --git a/auth/enterprise_auth.go b/auth/enterprise_auth.go index 5478e0e4..2d903ca2 100644 --- a/auth/enterprise_auth.go +++ b/auth/enterprise_auth.go @@ -45,7 +45,48 @@ type EnterpriseAuthConfig struct { // This function takes an ID Token that was obtained via SSO (e.g., OIDC login) // and exchanges it for an access token that can be used to call the MCP Server. // -// Example: +// There are two ways to obtain an ID Token for use with this function: +// +// Option 1: Use the OIDC login helper functions (full flow with SSO): +// +// // Step 1: Initiate OIDC login +// oidcConfig := &OIDCLoginConfig{ +// IssuerURL: "https://acme.okta.com", +// ClientID: "client-id", +// RedirectURL: "http://localhost:8080/callback", +// Scopes: []string{"openid", "profile", "email"}, +// } +// authReq, err := InitiateOIDCLogin(ctx, oidcConfig) +// if err != nil { +// log.Fatal(err) +// } +// +// // Step 2: Direct user to authReq.AuthURL for authentication +// fmt.Printf("Visit: %s\n", authReq.AuthURL) +// +// // Step 3: After redirect, complete login with authorization code +// tokens, err := CompleteOIDCLogin(ctx, oidcConfig, authCode, authReq.CodeVerifier) +// if err != nil { +// log.Fatal(err) +// } +// +// // Step 4: Use ID token for enterprise auth +// enterpriseConfig := &EnterpriseAuthConfig{ +// IdPIssuerURL: "https://acme.okta.com", +// IdPClientID: "client-id-at-idp", +// IdPClientSecret: "secret-at-idp", +// MCPAuthServerURL: "https://auth.mcpserver.example", +// MCPResourceURL: "https://mcp.mcpserver.example", +// MCPClientID: "client-id-at-mcp", +// MCPClientSecret: "secret-at-mcp", +// MCPScopes: []string{"read", "write"}, +// } +// accessToken, err := EnterpriseAuthFlow(ctx, enterpriseConfig, tokens.IDToken) +// if err != nil { +// log.Fatal(err) +// } +// +// Option 2: Bring your own ID Token (if you already have one): // // config := &EnterpriseAuthConfig{ // IdPIssuerURL: "https://acme.okta.com", @@ -58,8 +99,8 @@ type EnterpriseAuthConfig struct { // MCPScopes: []string{"read", "write"}, // } // -// // After user logs in via OIDC, you have an ID Token -// accessToken, err := EnterpriseAuthFlow(ctx, config, idToken) +// // If you already obtained an ID token through your own means +// accessToken, err := EnterpriseAuthFlow(ctx, config, myIDToken) // if err != nil { // log.Fatal(err) // } diff --git a/auth/oidc_login.go b/auth/oidc_login.go new file mode 100644 index 00000000..5c1d9106 --- /dev/null +++ b/auth/oidc_login.go @@ -0,0 +1,454 @@ +// Copyright 2025 The Go MCP SDK Authors. All rights reserved. +// Use of this source code is governed by an MIT-style +// license that can be found in the LICENSE file. + +// This file implements OIDC Authorization Code flow for obtaining ID tokens +// as part of Enterprise Managed Authorization (SEP-990). +// See https://openid.net/specs/openid-connect-core-1_0.html + +//go:build mcp_go_client_oauth + +package auth + +import ( + "context" + "crypto/rand" + "crypto/sha256" + "encoding/base64" + "encoding/json" + "fmt" + "io" + "net/http" + "net/url" + "strings" + "time" + + "github.com/modelcontextprotocol/go-sdk/oauthex" + "golang.org/x/oauth2" +) + +// OIDCLoginConfig configures the OIDC Authorization Code flow for obtaining +// an ID Token. This is an OPTIONAL step before calling EnterpriseAuthFlow. +// Users can alternatively obtain ID tokens through their own methods. +type OIDCLoginConfig struct { + // IssuerURL is the IdP's issuer URL (e.g., "https://acme.okta.com"). + IssuerURL string + // ClientID is the MCP Client's ID registered at the IdP. + ClientID string + // ClientSecret is the MCP Client's secret at the IdP. + // This is OPTIONAL and only used if the client is confidential. + ClientSecret string + // RedirectURL is the OAuth2 redirect URI registered with the IdP. + // This must match exactly what was registered with the IdP. + RedirectURL string + // Scopes are the OAuth2/OIDC scopes to request. + // "openid" is REQUIRED for OIDC. Common values: ["openid", "profile", "email"] + Scopes []string + // LoginHint is an OPTIONAL hint to the IdP about the user's identity. + // Some IdPs may require this (e.g., as an email address for routing to SSO providers). + // Example: "user@example.com" + LoginHint string + // HTTPClient is the HTTP client for making requests. + // If nil, http.DefaultClient is used. + HTTPClient *http.Client +} + +// OIDCAuthorizationRequest represents the result of initiating an OIDC +// authorization code flow. Users must direct the end-user to AuthURL +// to complete authentication. +type OIDCAuthorizationRequest struct { + // AuthURL is the URL the user should visit to authenticate. + // This URL includes the authorization request parameters. + AuthURL string + // State is the OAuth2 state parameter for CSRF protection. + // Users MUST validate that the state returned from the IdP matches this value. + State string + // CodeVerifier is the PKCE code verifier for secure authorization code exchange. + // This must be provided to CompleteOIDCLogin along with the authorization code. + CodeVerifier string +} + +// OIDCTokenResponse contains the tokens returned from a successful OIDC login. +type OIDCTokenResponse struct { + // IDToken is the OpenID Connect ID Token (JWT). + // This can be passed to EnterpriseAuthFlow for token exchange. + IDToken string + // AccessToken is the OAuth2 access token (if issued by IdP). + // This is typically not needed for SEP-990, but may be useful for other IdP APIs. + AccessToken string + // RefreshToken is the OAuth2 refresh token (if issued by IdP). + RefreshToken string + // TokenType is the token type (typically "Bearer"). + TokenType string + // ExpiresAt is when the ID token expires. + ExpiresAt int64 +} + +// InitiateOIDCLogin initiates an OIDC Authorization Code flow with PKCE. +// This is the first step for users who want to use SSO to obtain an ID token. +// +// The returned AuthURL should be presented to the user (e.g., opened in a browser). +// After the user authenticates, the IdP will redirect to the RedirectURL with +// an authorization code and state parameter. +// +// Example: +// +// config := &OIDCLoginConfig{ +// IssuerURL: "https://acme.okta.com", +// ClientID: "client-id", +// RedirectURL: "http://localhost:8080/callback", +// Scopes: []string{"openid", "profile", "email"}, +// } +// +// authReq, err := InitiateOIDCLogin(ctx, config) +// if err != nil { +// log.Fatal(err) +// } +// +// // Direct user to authReq.AuthURL +// fmt.Printf("Visit this URL to login: %s\n", authReq.AuthURL) +// +// // After user completes login, IdP redirects to RedirectURL with code & state +// // Extract code and state from the redirect, then call CompleteOIDCLogin +func InitiateOIDCLogin( + ctx context.Context, + config *OIDCLoginConfig, +) (*OIDCAuthorizationRequest, error) { + if config == nil { + return nil, fmt.Errorf("config is required") + } + // Validate required fields + if config.IssuerURL == "" { + return nil, fmt.Errorf("IssuerURL is required") + } + if config.ClientID == "" { + return nil, fmt.Errorf("ClientID is required") + } + if config.RedirectURL == "" { + return nil, fmt.Errorf("RedirectURL is required") + } + if len(config.Scopes) == 0 { + return nil, fmt.Errorf("Scopes is required (must include 'openid')") + } + // Validate that "openid" scope is present (required for OIDC) + hasOpenID := false + for _, scope := range config.Scopes { + if scope == "openid" { + hasOpenID = true + break + } + } + if !hasOpenID { + return nil, fmt.Errorf("Scopes must include 'openid' for OIDC") + } + // Validate URL schemes to prevent XSS attacks + if err := oauthex.CheckURLScheme(config.IssuerURL); err != nil { + return nil, fmt.Errorf("invalid IssuerURL: %w", err) + } + if err := oauthex.CheckURLScheme(config.RedirectURL); err != nil { + return nil, fmt.Errorf("invalid RedirectURL: %w", err) + } + // Discover OIDC endpoints via .well-known + httpClient := config.HTTPClient + if httpClient == nil { + httpClient = http.DefaultClient + } + meta, err := oauthex.GetAuthServerMeta(ctx, config.IssuerURL, httpClient) + if err != nil { + return nil, fmt.Errorf("failed to discover OIDC metadata: %w", err) + } + if meta.AuthorizationEndpoint == "" { + return nil, fmt.Errorf("authorization_endpoint not found in OIDC metadata") + } + // Generate PKCE code verifier and challenge (RFC 7636) + codeVerifier, err := generateCodeVerifier() + if err != nil { + return nil, fmt.Errorf("failed to generate PKCE verifier: %w", err) + } + codeChallenge := generateCodeChallenge(codeVerifier) + // Generate state for CSRF protection (RFC 6749 Section 10.12) + state, err := generateState() + if err != nil { + return nil, fmt.Errorf("failed to generate state: %w", err) + } + // Build authorization URL per OIDC Core Section 3.1.2.1 + authURL, err := buildAuthorizationURL( + meta.AuthorizationEndpoint, + config.ClientID, + config.RedirectURL, + config.Scopes, + state, + codeChallenge, + config.LoginHint, + ) + if err != nil { + return nil, fmt.Errorf("failed to build authorization URL: %w", err) + } + return &OIDCAuthorizationRequest{ + AuthURL: authURL, + State: state, + CodeVerifier: codeVerifier, + }, nil +} + +// CompleteOIDCLogin completes the OIDC Authorization Code flow by exchanging +// the authorization code for tokens. This is the second step after the user +// has authenticated and been redirected back to the application. +// +// The authCode and returnedState parameters should come from the redirect URL +// query parameters. The state MUST match the state from InitiateOIDCLogin +// for CSRF protection. +// +// Example: +// +// // In your redirect handler (e.g., http://localhost:8080/callback) +// authCode := r.URL.Query().Get("code") +// returnedState := r.URL.Query().Get("state") +// +// // Validate state matches what we sent +// if returnedState != authReq.State { +// log.Fatal("State mismatch - possible CSRF attack") +// } +// +// // Exchange code for tokens +// tokens, err := CompleteOIDCLogin(ctx, config, authCode, authReq.CodeVerifier) +// if err != nil { +// log.Fatal(err) +// } +// +// // Now use tokens.IDToken with EnterpriseAuthFlow +// accessToken, err := EnterpriseAuthFlow(ctx, enterpriseConfig, tokens.IDToken) +func CompleteOIDCLogin( + ctx context.Context, + config *OIDCLoginConfig, + authCode string, + codeVerifier string, +) (*OIDCTokenResponse, error) { + if config == nil { + return nil, fmt.Errorf("config is required") + } + if authCode == "" { + return nil, fmt.Errorf("authCode is required") + } + if codeVerifier == "" { + return nil, fmt.Errorf("codeVerifier is required") + } + // Validate required fields + if config.IssuerURL == "" { + return nil, fmt.Errorf("IssuerURL is required") + } + if config.ClientID == "" { + return nil, fmt.Errorf("ClientID is required") + } + if config.RedirectURL == "" { + return nil, fmt.Errorf("RedirectURL is required") + } + // Discover token endpoint + httpClient := config.HTTPClient + if httpClient == nil { + httpClient = http.DefaultClient + } + meta, err := oauthex.GetAuthServerMeta(ctx, config.IssuerURL, httpClient) + if err != nil { + return nil, fmt.Errorf("failed to discover OIDC metadata: %w", err) + } + if meta.TokenEndpoint == "" { + return nil, fmt.Errorf("token_endpoint not found in OIDC metadata") + } + // Build token request per OIDC Core Section 3.1.3.1 + formData := url.Values{} + formData.Set("grant_type", "authorization_code") + formData.Set("code", authCode) + formData.Set("redirect_uri", config.RedirectURL) + formData.Set("client_id", config.ClientID) + formData.Set("code_verifier", codeVerifier) + // Add client_secret if provided (confidential client) + if config.ClientSecret != "" { + formData.Set("client_secret", config.ClientSecret) + } + // Exchange authorization code for tokens + oauth2Token, err := exchangeAuthorizationCode( + ctx, + meta.TokenEndpoint, + formData, + httpClient, + ) + if err != nil { + return nil, fmt.Errorf("token exchange failed: %w", err) + } + // Extract ID Token from response + idToken, ok := oauth2Token.Extra("id_token").(string) + if !ok || idToken == "" { + return nil, fmt.Errorf("id_token not found in token response") + } + return &OIDCTokenResponse{ + IDToken: idToken, + AccessToken: oauth2Token.AccessToken, + RefreshToken: oauth2Token.RefreshToken, + TokenType: oauth2Token.TokenType, + ExpiresAt: oauth2Token.Expiry.Unix(), + }, nil +} + +// generateCodeVerifier generates a cryptographically random code verifier +// for PKCE per RFC 7636 Section 4.1. +func generateCodeVerifier() (string, error) { + // Per RFC 7636: code verifier is 43-128 characters from [A-Z] / [a-z] / [0-9] / "-" / "." / "_" / "~" + // We use 32 random bytes (256 bits) base64url-encoded = 43 characters + randomBytes := make([]byte, 32) + if _, err := rand.Read(randomBytes); err != nil { + return "", fmt.Errorf("failed to generate random bytes: %w", err) + } + return base64.RawURLEncoding.EncodeToString(randomBytes), nil +} + +// generateCodeChallenge generates the PKCE code challenge from the verifier +// using SHA256 per RFC 7636 Section 4.2. +func generateCodeChallenge(verifier string) string { + hash := sha256.Sum256([]byte(verifier)) + return base64.RawURLEncoding.EncodeToString(hash[:]) +} + +// generateState generates a cryptographically random state parameter +// for CSRF protection per RFC 6749 Section 10.12. +func generateState() (string, error) { + randomBytes := make([]byte, 32) + if _, err := rand.Read(randomBytes); err != nil { + return "", fmt.Errorf("failed to generate random bytes: %w", err) + } + return base64.RawURLEncoding.EncodeToString(randomBytes), nil +} + +// buildAuthorizationURL constructs the OIDC authorization URL. +func buildAuthorizationURL( + authEndpoint string, + clientID string, + redirectURL string, + scopes []string, + state string, + codeChallenge string, + loginHint string, +) (string, error) { + u, err := url.Parse(authEndpoint) + if err != nil { + return "", fmt.Errorf("invalid authorization endpoint: %w", err) + } + q := u.Query() + q.Set("response_type", "code") + q.Set("client_id", clientID) + q.Set("redirect_uri", redirectURL) + q.Set("scope", strings.Join(scopes, " ")) + q.Set("state", state) + q.Set("code_challenge", codeChallenge) + q.Set("code_challenge_method", "S256") + // Add login_hint if provided (optional per OIDC spec, but some IdPs may require it) + if loginHint != "" { + q.Set("login_hint", loginHint) + } + u.RawQuery = q.Encode() + return u.String(), nil +} + +// exchangeAuthorizationCode exchanges the authorization code for tokens. +func exchangeAuthorizationCode( + ctx context.Context, + tokenEndpoint string, + formData url.Values, + httpClient *http.Client, +) (*oauth2.Token, error) { + // Create HTTP request + httpReq, err := http.NewRequestWithContext( + ctx, + http.MethodPost, + tokenEndpoint, + strings.NewReader(formData.Encode()), + ) + if err != nil { + return nil, fmt.Errorf("failed to create token request: %w", err) + } + + httpReq.Header.Set("Content-Type", "application/x-www-form-urlencoded") + httpReq.Header.Set("Accept", "application/json") + + // Execute request + httpResp, err := httpClient.Do(httpReq) + if err != nil { + return nil, fmt.Errorf("token request failed: %w", err) + } + defer httpResp.Body.Close() + + // Read response body (limit to 1MB for safety) + body, err := io.ReadAll(io.LimitReader(httpResp.Body, 1<<20)) + if err != nil { + return nil, fmt.Errorf("failed to read token response: %w", err) + } + + // Handle success response (200 OK) + if httpResp.StatusCode == http.StatusOK { + // Parse token response manually (following jwt_bearer.go pattern) + var tokenResp struct { + AccessToken string `json:"access_token"` + TokenType string `json:"token_type"` + ExpiresIn int `json:"expires_in,omitempty"` + RefreshToken string `json:"refresh_token,omitempty"` + IDToken string `json:"id_token,omitempty"` + Scope string `json:"scope,omitempty"` + } + if err := json.Unmarshal(body, &tokenResp); err != nil { + return nil, fmt.Errorf("failed to parse token response: %w (body: %s)", err, string(body)) + } + + // Validate required fields + if tokenResp.AccessToken == "" { + return nil, fmt.Errorf("response missing required field: access_token") + } + if tokenResp.TokenType == "" { + return nil, fmt.Errorf("response missing required field: token_type") + } + + // Convert to oauth2.Token + token := &oauth2.Token{ + AccessToken: tokenResp.AccessToken, + TokenType: tokenResp.TokenType, + RefreshToken: tokenResp.RefreshToken, + } + + // Set expiration if provided + if tokenResp.ExpiresIn > 0 { + token.Expiry = time.Now().Add(time.Duration(tokenResp.ExpiresIn) * time.Second) + } + + // Add extra fields (id_token, scope) + extra := make(map[string]interface{}) + if tokenResp.IDToken != "" { + extra["id_token"] = tokenResp.IDToken + } + if tokenResp.Scope != "" { + extra["scope"] = tokenResp.Scope + } + if len(extra) > 0 { + token = token.WithExtra(extra) + } + + return token, nil + } + + // Handle error response (400 Bad Request) + if httpResp.StatusCode == http.StatusBadRequest { + var errResp struct { + Error string `json:"error"` + ErrorDescription string `json:"error_description,omitempty"` + ErrorURI string `json:"error_uri,omitempty"` + } + if err := json.Unmarshal(body, &errResp); err != nil { + return nil, fmt.Errorf("failed to parse error response: %w (body: %s)", err, string(body)) + } + if errResp.ErrorDescription != "" { + return nil, fmt.Errorf("token request failed: %s (%s)", errResp.Error, errResp.ErrorDescription) + } + return nil, fmt.Errorf("token request failed: %s", errResp.Error) + } + + // Handle unexpected status codes + return nil, fmt.Errorf("unexpected status code %d: %s", httpResp.StatusCode, string(body)) +} diff --git a/auth/oidc_login_test.go b/auth/oidc_login_test.go new file mode 100644 index 00000000..ca8c3609 --- /dev/null +++ b/auth/oidc_login_test.go @@ -0,0 +1,384 @@ +// Copyright 2025 The Go MCP SDK Authors. All rights reserved. +// Use of this source code is governed by an MIT-style +// license that can be found in the LICENSE file. + +//go:build mcp_go_client_oauth + +package auth + +import ( + "context" + "encoding/base64" + "encoding/json" + "fmt" + "net/http" + "net/http/httptest" + "net/url" + "strings" + "testing" + "time" +) + +// TestInitiateOIDCLogin tests the OIDC authorization request generation. +func TestInitiateOIDCLogin(t *testing.T) { + // Create mock IdP server + idpServer := createMockOIDCServer(t) + defer idpServer.Close() + config := &OIDCLoginConfig{ + IssuerURL: idpServer.URL, + ClientID: "test-client", + RedirectURL: "http://localhost:8080/callback", + Scopes: []string{"openid", "profile", "email"}, + HTTPClient: idpServer.Client(), + } + t.Run("successful initiation", func(t *testing.T) { + authReq, err := InitiateOIDCLogin(context.Background(), config) + if err != nil { + t.Fatalf("InitiateOIDCLogin failed: %v", err) + } + // Validate AuthURL + if authReq.AuthURL == "" { + t.Error("AuthURL is empty") + } + // Parse and validate URL parameters + u, err := url.Parse(authReq.AuthURL) + if err != nil { + t.Fatalf("Failed to parse AuthURL: %v", err) + } + q := u.Query() + if q.Get("response_type") != "code" { + t.Errorf("expected response_type 'code', got '%s'", q.Get("response_type")) + } + if q.Get("client_id") != "test-client" { + t.Errorf("expected client_id 'test-client', got '%s'", q.Get("client_id")) + } + if q.Get("redirect_uri") != "http://localhost:8080/callback" { + t.Errorf("expected redirect_uri 'http://localhost:8080/callback', got '%s'", q.Get("redirect_uri")) + } + if q.Get("scope") != "openid profile email" { + t.Errorf("expected scope 'openid profile email', got '%s'", q.Get("scope")) + } + if q.Get("code_challenge_method") != "S256" { + t.Errorf("expected code_challenge_method 'S256', got '%s'", q.Get("code_challenge_method")) + } + // Validate state is generated + if authReq.State == "" { + t.Error("State is empty") + } + if q.Get("state") != authReq.State { + t.Errorf("state in URL doesn't match returned state") + } + // Validate PKCE parameters + if authReq.CodeVerifier == "" { + t.Error("CodeVerifier is empty") + } + if q.Get("code_challenge") == "" { + t.Error("code_challenge is empty") + } + }) + t.Run("with login_hint", func(t *testing.T) { + configWithHint := *config + configWithHint.LoginHint = "user@example.com" + authReq, err := InitiateOIDCLogin(context.Background(), &configWithHint) + if err != nil { + t.Fatalf("InitiateOIDCLogin failed: %v", err) + } + u, err := url.Parse(authReq.AuthURL) + if err != nil { + t.Fatalf("Failed to parse AuthURL: %v", err) + } + q := u.Query() + if q.Get("login_hint") != "user@example.com" { + t.Errorf("expected login_hint 'user@example.com', got '%s'", q.Get("login_hint")) + } + }) + t.Run("without login_hint", func(t *testing.T) { + authReq, err := InitiateOIDCLogin(context.Background(), config) + if err != nil { + t.Fatalf("InitiateOIDCLogin failed: %v", err) + } + u, err := url.Parse(authReq.AuthURL) + if err != nil { + t.Fatalf("Failed to parse AuthURL: %v", err) + } + q := u.Query() + if q.Has("login_hint") { + t.Errorf("expected no login_hint parameter, but got '%s'", q.Get("login_hint")) + } + }) + t.Run("nil config", func(t *testing.T) { + _, err := InitiateOIDCLogin(context.Background(), nil) + if err == nil { + t.Error("expected error for nil config, got nil") + } + }) + t.Run("missing openid scope", func(t *testing.T) { + badConfig := *config + badConfig.Scopes = []string{"profile", "email"} // Missing "openid" + _, err := InitiateOIDCLogin(context.Background(), &badConfig) + if err == nil { + t.Error("expected error for missing openid scope, got nil") + } + if !strings.Contains(err.Error(), "openid") { + t.Errorf("expected error about missing 'openid', got: %v", err) + } + }) + t.Run("missing required fields", func(t *testing.T) { + tests := []struct { + name string + mutate func(*OIDCLoginConfig) + expectErr string + }{ + { + name: "missing IssuerURL", + mutate: func(c *OIDCLoginConfig) { c.IssuerURL = "" }, + expectErr: "IssuerURL is required", + }, + { + name: "missing ClientID", + mutate: func(c *OIDCLoginConfig) { c.ClientID = "" }, + expectErr: "ClientID is required", + }, + { + name: "missing RedirectURL", + mutate: func(c *OIDCLoginConfig) { c.RedirectURL = "" }, + expectErr: "RedirectURL is required", + }, + { + name: "missing Scopes", + mutate: func(c *OIDCLoginConfig) { c.Scopes = nil }, + expectErr: "Scopes is required", + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + badConfig := *config + tt.mutate(&badConfig) + _, err := InitiateOIDCLogin(context.Background(), &badConfig) + if err == nil { + t.Error("expected error, got nil") + } + if !strings.Contains(err.Error(), tt.expectErr) { + t.Errorf("expected error containing '%s', got: %v", tt.expectErr, err) + } + }) + } + }) +} + +// TestCompleteOIDCLogin tests the authorization code exchange. +func TestCompleteOIDCLogin(t *testing.T) { + // Create mock IdP server + idpServer := createMockOIDCServerWithToken(t) + defer idpServer.Close() + config := &OIDCLoginConfig{ + IssuerURL: idpServer.URL, + ClientID: "test-client", + ClientSecret: "test-secret", + RedirectURL: "http://localhost:8080/callback", + Scopes: []string{"openid", "profile", "email"}, + HTTPClient: idpServer.Client(), + } + t.Run("successful code exchange", func(t *testing.T) { + tokens, err := CompleteOIDCLogin( + context.Background(), + config, + "test-auth-code", + "test-code-verifier", + ) + if err != nil { + t.Fatalf("CompleteOIDCLogin failed: %v", err) + } + // Validate tokens + if tokens.IDToken == "" { + t.Error("IDToken is empty") + } + if tokens.AccessToken == "" { + t.Error("AccessToken is empty") + } + if tokens.TokenType != "Bearer" { + t.Errorf("expected TokenType 'Bearer', got '%s'", tokens.TokenType) + } + if tokens.ExpiresAt == 0 { + t.Error("ExpiresAt is zero") + } + }) + t.Run("nil config", func(t *testing.T) { + _, err := CompleteOIDCLogin( + context.Background(), + nil, + "test-auth-code", + "test-code-verifier", + ) + if err == nil { + t.Error("expected error for nil config, got nil") + } + }) + t.Run("missing parameters", func(t *testing.T) { + tests := []struct { + name string + authCode string + codeVerifier string + expectErr string + }{ + { + name: "missing authCode", + authCode: "", + codeVerifier: "test-verifier", + expectErr: "authCode is required", + }, + { + name: "missing codeVerifier", + authCode: "test-code", + codeVerifier: "", + expectErr: "codeVerifier is required", + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + _, err := CompleteOIDCLogin( + context.Background(), + config, + tt.authCode, + tt.codeVerifier, + ) + if err == nil { + t.Error("expected error, got nil") + } + if !strings.Contains(err.Error(), tt.expectErr) { + t.Errorf("expected error containing '%s', got: %v", tt.expectErr, err) + } + }) + } + }) +} + +// TestOIDCLoginE2E tests the complete OIDC login flow end-to-end. +func TestOIDCLoginE2E(t *testing.T) { + // Create mock IdP server + idpServer := createMockOIDCServerWithToken(t) + defer idpServer.Close() + config := &OIDCLoginConfig{ + IssuerURL: idpServer.URL, + ClientID: "test-client", + ClientSecret: "test-secret", + RedirectURL: "http://localhost:8080/callback", + Scopes: []string{"openid", "profile", "email"}, + HTTPClient: idpServer.Client(), + } + // Step 1: Initiate login + authReq, err := InitiateOIDCLogin(context.Background(), config) + if err != nil { + t.Fatalf("InitiateOIDCLogin failed: %v", err) + } + // Step 2: Simulate user authentication and redirect + // (In real flow, user would visit authReq.AuthURL and IdP would redirect back) + // Here we just use a mock authorization code + mockAuthCode := "mock-authorization-code" + // Step 3: Complete login with authorization code + tokens, err := CompleteOIDCLogin( + context.Background(), + config, + mockAuthCode, + authReq.CodeVerifier, + ) + if err != nil { + t.Fatalf("CompleteOIDCLogin failed: %v", err) + } + // Validate we got an ID token + if tokens.IDToken == "" { + t.Error("Expected ID token, got empty string") + } + // Validate ID token is a JWT (has 3 parts) + parts := strings.Split(tokens.IDToken, ".") + if len(parts) != 3 { + t.Errorf("Expected JWT with 3 parts, got %d parts", len(parts)) + } +} + +// createMockOIDCServer creates a mock OIDC server for testing InitiateOIDCLogin. +func createMockOIDCServer(t *testing.T) *httptest.Server { + var serverURL string + server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + // Handle OIDC discovery + if r.URL.Path == "/.well-known/openid-configuration" { + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(map[string]interface{}{ + "issuer": serverURL, + "authorization_endpoint": serverURL + "/authorize", + "token_endpoint": serverURL + "/token", + "jwks_uri": serverURL + "/.well-known/jwks.json", + "response_types_supported": []string{"code"}, + "code_challenge_methods_supported": []string{"S256"}, + "grant_types_supported": []string{"authorization_code"}, + }) + return + } + http.NotFound(w, r) + })) + serverURL = server.URL + return server +} + +// createMockOIDCServerWithToken creates a mock OIDC server that also handles token exchange. +func createMockOIDCServerWithToken(t *testing.T) *httptest.Server { + var serverURL string + server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + // Handle OIDC discovery + if r.URL.Path == "/.well-known/openid-configuration" { + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(map[string]interface{}{ + "issuer": serverURL, + "authorization_endpoint": serverURL + "/authorize", + "token_endpoint": serverURL + "/token", + "jwks_uri": serverURL + "/.well-known/jwks.json", + "response_types_supported": []string{"code"}, + "code_challenge_methods_supported": []string{"S256"}, + "grant_types_supported": []string{"authorization_code"}, + }) + return + } + // Handle token endpoint + if r.URL.Path == "/token" { + if err := r.ParseForm(); err != nil { + http.Error(w, "failed to parse form", http.StatusBadRequest) + return + } + // Validate grant type + if r.FormValue("grant_type") != "authorization_code" { + http.Error(w, "invalid grant_type", http.StatusBadRequest) + return + } + // Create mock ID token (JWT) + now := time.Now().Unix() + idToken := fmt.Sprintf("eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.%s.mock-signature", + base64EncodeClaims(map[string]interface{}{ + "iss": serverURL, + "sub": "test-user", + "aud": "test-client", + "exp": now + 3600, + "iat": now, + "email": "test@example.com", + })) + // Return token response + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(map[string]interface{}{ + "access_token": "mock-access-token", + "token_type": "Bearer", + "expires_in": 3600, + "refresh_token": "mock-refresh-token", + "id_token": idToken, + }) + return + } + http.NotFound(w, r) + })) + serverURL = server.URL + return server +} + +// base64EncodeClaims encodes JWT claims for testing. +func base64EncodeClaims(claims map[string]interface{}) string { + claimsJSON, _ := json.Marshal(claims) + return base64.RawURLEncoding.EncodeToString(claimsJSON) +} diff --git a/oauthex/oauth2.go b/oauthex/oauth2.go index 7595eb0c..3bc392ab 100644 --- a/oauthex/oauth2.go +++ b/oauthex/oauth2.go @@ -87,3 +87,9 @@ func checkURLScheme(u string) error { } return nil } + +// CheckURLScheme validates a URL scheme for security. +// This is exported for use by the auth package. +func CheckURLScheme(u string) error { + return checkURLScheme(u) +} From df29f1dc7765671d12517f4bdbd84d07ebc7f4e4 Mon Sep 17 00:00:00 2001 From: Pranav RK Date: Wed, 26 Nov 2025 18:50:32 +0530 Subject: [PATCH 08/10] docs: add docs for enterprise authorization --- docs/protocol.md | 63 +++++++++++++++++++++++++++++++++++ internal/docs/protocol.src.md | 63 +++++++++++++++++++++++++++++++++++ 2 files changed, 126 insertions(+) diff --git a/docs/protocol.md b/docs/protocol.md index 16ba0bfa..b8dd6dc2 100644 --- a/docs/protocol.md +++ b/docs/protocol.md @@ -304,12 +304,75 @@ For more sophisticated CORS policies, wrap the handler with a CORS middleware li The [_auth middleware example_](https://github.com/modelcontextprotocol/go-sdk/tree/main/examples/server/auth-middleware) shows how to implement authorization for both JWT tokens and API keys. +#### Enterprise Managed Authorization (SEP-990) + +For enterprise environments with centralized identity providers, the SDK supports ID-JAG (Identity Assertion JWT Authorization Grant) token validation using [`NewIDJAGVerifier`](https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk/auth#NewIDJAGVerifier). + +This verifier validates ID-JAG tokens issued by trusted identity providers through: +- Signature verification using the IdP's JWKS +- Audience validation (ensures token was issued for this MCP server) +- Expiration and clock skew handling +- Replay attack prevention via JTI tracking + +Example configuration: + +```go +config := &IDJAGVerifierConfig{ + AuthServerIssuerURL: "https://auth.mcpserver.example", + TrustedIdPs: map[string]*TrustedIdPConfig{ + "acme-okta": { + IssuerURL: "https://acme.okta.com", + JWKSURL: "https://acme.okta.com/.well-known/jwks.json", + }, + }, +} + +verifier := NewIDJAGVerifier(config) +middleware := RequireBearerToken(verifier, &RequireBearerTokenOptions{ + Scopes: []string{"read"}, +}) +``` + +Tool handlers can access ID-JAG claims from `req.Extra.TokenInfo.Extra`, which includes the subject, client ID, resource, and issuer from the validated token. + ### Client Client-side OAuth is implemented by setting [`StreamableClientTransport.HTTPClient`](https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk@v0.5.0/mcp#StreamableClientTransport.HTTPClient) to a custom [`http.Client`](https://pkg.go.dev/net/http#Client) Additional support is forthcoming; see modelcontextprotocol/go-sdk#493. +#### Enterprise Authentication Flow (SEP-990) + +For enterprise SSO scenarios, the SDK provides an [`EnterpriseAuthFlow`](https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk/auth#EnterpriseAuthFlow) function that implements the complete token exchange flow: + +1. **Token Exchange** at IdP: ID Token -> ID-JAG +2. **JWT Bearer Grant** at MCP Server: ID-JAG -> Access Token + +This flow is typically used after obtaining an ID Token via OIDC login: + +```go +// Step 1: Obtain ID token via OIDC (see auth.InitiateOIDCLogin and auth.CompleteOIDCLogin) +idToken := "..." // from OIDC login + +// Step 2: Exchange for MCP access token +enterpriseConfig := &EnterpriseAuthConfig{ + IdPIssuerURL: "https://acme.okta.com", + IdPClientID: "client-id-at-idp", + IdPClientSecret: "secret-at-idp", + MCPAuthServerURL: "https://auth.mcpserver.example", + MCPResourceURL: "https://mcp.mcpserver.example", + MCPClientID: "client-id-at-mcp", + MCPClientSecret: "secret-at-mcp", + MCPScopes: []string{"read", "write"}, +} +accessToken, err := EnterpriseAuthFlow(ctx, enterpriseConfig, tokens.IDToken) +// Use accessToken with MCP client +``` + +Helper functions are provided for OIDC login: +- [`InitiateOIDCLogin`](https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk/auth#InitiateOIDCLogin) - Generate authorization URL with PKCE +- [`CompleteOIDCLogin`](https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk/auth#CompleteOIDCLogin) - Exchange authorization code for tokens + ## Security Here we discuss the mitigations described under diff --git a/internal/docs/protocol.src.md b/internal/docs/protocol.src.md index ada34371..efb483d4 100644 --- a/internal/docs/protocol.src.md +++ b/internal/docs/protocol.src.md @@ -230,12 +230,75 @@ For more sophisticated CORS policies, wrap the handler with a CORS middleware li The [_auth middleware example_](https://github.com/modelcontextprotocol/go-sdk/tree/main/examples/server/auth-middleware) shows how to implement authorization for both JWT tokens and API keys. +#### Enterprise Managed Authorization (SEP-990) + +For enterprise environments with centralized identity providers, the SDK supports ID-JAG (Identity Assertion JWT Authorization Grant) token validation using [`NewIDJAGVerifier`](https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk/auth#NewIDJAGVerifier). + +This verifier validates ID-JAG tokens issued by trusted identity providers through: +- Signature verification using the IdP's JWKS +- Audience validation (ensures token was issued for this MCP server) +- Expiration and clock skew handling +- Replay attack prevention via JTI tracking + +Example configuration: + +```go +config := &IDJAGVerifierConfig{ + AuthServerIssuerURL: "https://auth.mcpserver.example", + TrustedIdPs: map[string]*TrustedIdPConfig{ + "acme-okta": { + IssuerURL: "https://acme.okta.com", + JWKSURL: "https://acme.okta.com/.well-known/jwks.json", + }, + }, +} + +verifier := NewIDJAGVerifier(config) +middleware := RequireBearerToken(verifier, &RequireBearerTokenOptions{ + Scopes: []string{"read"}, +}) +``` + +Tool handlers can access ID-JAG claims from `req.Extra.TokenInfo.Extra`, which includes the subject, client ID, resource, and issuer from the validated token. + ### Client Client-side OAuth is implemented by setting [`StreamableClientTransport.HTTPClient`](https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk@v0.5.0/mcp#StreamableClientTransport.HTTPClient) to a custom [`http.Client`](https://pkg.go.dev/net/http#Client) Additional support is forthcoming; see modelcontextprotocol/go-sdk#493. +#### Enterprise Authentication Flow (SEP-990) + +For enterprise SSO scenarios, the SDK provides an [`EnterpriseAuthFlow`](https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk/auth#EnterpriseAuthFlow) function that implements the complete token exchange flow: + +1. **Token Exchange** at IdP: ID Token -> ID-JAG +2. **JWT Bearer Grant** at MCP Server: ID-JAG -> Access Token + +This flow is typically used after obtaining an ID Token via OIDC login: + +```go +// Step 1: Obtain ID token via OIDC (see auth.InitiateOIDCLogin and auth.CompleteOIDCLogin) +idToken := "..." // from OIDC login + +// Step 2: Exchange for MCP access token +enterpriseConfig := &EnterpriseAuthConfig{ + IdPIssuerURL: "https://acme.okta.com", + IdPClientID: "client-id-at-idp", + IdPClientSecret: "secret-at-idp", + MCPAuthServerURL: "https://auth.mcpserver.example", + MCPResourceURL: "https://mcp.mcpserver.example", + MCPClientID: "client-id-at-mcp", + MCPClientSecret: "secret-at-mcp", + MCPScopes: []string{"read", "write"}, +} +accessToken, err := EnterpriseAuthFlow(ctx, enterpriseConfig, tokens.IDToken) +// Use accessToken with MCP client +``` + +Helper functions are provided for OIDC login: +- [`InitiateOIDCLogin`](https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk/auth#InitiateOIDCLogin) - Generate authorization URL with PKCE +- [`CompleteOIDCLogin`](https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk/auth#CompleteOIDCLogin) - Exchange authorization code for tokens + ## Security Here we discuss the mitigations described under From 2ffe79f7d0f10aa8244b9aba9f87518b838b6963 Mon Sep 17 00:00:00 2001 From: Pranav RK Date: Thu, 27 Nov 2025 17:38:13 +0530 Subject: [PATCH 09/10] chore: remove id jag verification --- auth/id_jag_verifier.go | 250 ---------------------------------- auth/id_jag_verifier_test.go | 191 -------------------------- auth/jwks_cache.go | 150 -------------------- auth/jwks_cache_test.go | 199 --------------------------- docs/protocol.md | 61 +++------ internal/docs/protocol.src.md | 61 +++------ 6 files changed, 34 insertions(+), 878 deletions(-) delete mode 100644 auth/id_jag_verifier.go delete mode 100644 auth/id_jag_verifier_test.go delete mode 100644 auth/jwks_cache.go delete mode 100644 auth/jwks_cache_test.go diff --git a/auth/id_jag_verifier.go b/auth/id_jag_verifier.go deleted file mode 100644 index 45cb710d..00000000 --- a/auth/id_jag_verifier.go +++ /dev/null @@ -1,250 +0,0 @@ -// Copyright 2025 The Go MCP SDK Authors. All rights reserved. -// Use of this source code is governed by an MIT-style -// license that can be found in the LICENSE file. - -// This file implements ID-JAG (Identity Assertion JWT Authorization Grant) validation -// for MCP Servers in Enterprise Managed Authorization (SEP-990). - -//go:build mcp_go_client_oauth - -package auth - -import ( - "context" - "crypto/rsa" - "encoding/base64" - "encoding/json" - "fmt" - "math/big" - "net/http" - "strings" - "sync" - "time" - - "github.com/golang-jwt/jwt/v5" - "github.com/modelcontextprotocol/go-sdk/oauthex" -) - -// TrustedIdPConfig contains configuration for a trusted Identity Provider. -type TrustedIdPConfig struct { - // IssuerURL is the IdP's issuer URL (must match the iss claim). - IssuerURL string - // JWKSURL is the URL to fetch the IdP's JSON Web Key Set. - JWKSURL string -} - -// IDJAGVerifierConfig configures ID-JAG validation for an MCP Server. -type IDJAGVerifierConfig struct { - // AuthServerIssuerURL is this MCP Server's authorization server issuer URL. - // This must match the aud claim in the ID-JAG. - AuthServerIssuerURL string - // TrustedIdPs is a map of trusted Identity Providers. - // The key is a friendly name, the value is the IdP configuration. - TrustedIdPs map[string]*TrustedIdPConfig - // JWKSCache is the cache for JWKS responses. If nil, a new cache is created. - JWKSCache *JWKSCache - // HTTPClient is the HTTP client for fetching JWKS. If nil, http.DefaultClient is used. - HTTPClient *http.Client - // AllowedClockSkew is the allowed clock skew for exp/iat validation. - // Default is 5 minutes. - AllowedClockSkew time.Duration -} - -// IDJAGVerifier validates ID-JAG tokens for MCP Servers. -type IDJAGVerifier struct { - config *IDJAGVerifierConfig - jwksCache *JWKSCache - usedJTIs map[string]time.Time // Replay attack prevention - usedJTIMu sync.RWMutex -} - -// NewIDJAGVerifier creates a new ID-JAG verifier with the given configuration. -// This returns a TokenVerifier that can be used with RequireBearerToken middleware. -// -// Example: -// -// config := &IDJAGVerifierConfig{ -// AuthServerIssuerURL: "https://auth.mcpserver.example", -// TrustedIdPs: map[string]*TrustedIdPConfig{ -// "acme-okta": { -// IssuerURL: "https://acme.okta.com", -// JWKSURL: "https://acme.okta.com/.well-known/jwks.json", -// }, -// }, -// } -// -// verifier := NewIDJAGVerifier(config) -// middleware := RequireBearerToken(verifier, &RequireBearerTokenOptions{ -// Scopes: []string{"read"}, -// }) -func NewIDJAGVerifier(config *IDJAGVerifierConfig) TokenVerifier { - if config.JWKSCache == nil { - config.JWKSCache = NewJWKSCache(config.HTTPClient) - } - if config.AllowedClockSkew == 0 { - config.AllowedClockSkew = 5 * time.Minute - } - verifier := &IDJAGVerifier{ - config: config, - jwksCache: config.JWKSCache, - usedJTIs: make(map[string]time.Time), - } - // Start cleanup goroutine for JTI tracking - go verifier.cleanupExpiredJTIs() - return verifier.Verify -} - -// Verify validates an ID-JAG token and returns TokenInfo. -// This implements the TokenVerifier interface. -func (v *IDJAGVerifier) Verify(ctx context.Context, token string, req *http.Request) (*TokenInfo, error) { - // Step 1: Parse the ID-JAG (without signature verification yet) - claims, err := oauthex.ParseIDJAG(token) - if err != nil { - return nil, fmt.Errorf("%w: failed to parse ID-JAG: %v", ErrInvalidToken, err) - } - // Step 2: Check if expired (with clock skew) - expiryTime := time.Unix(claims.ExpiresAt, 0) - if time.Now().After(expiryTime.Add(v.config.AllowedClockSkew)) { - return nil, fmt.Errorf("%w: ID-JAG expired at %v", ErrInvalidToken, expiryTime) - } - // Step 3: Validate aud claim per SEP-990 Section 5.1 - if claims.Audience != v.config.AuthServerIssuerURL { - return nil, fmt.Errorf("%w: invalid audience: expected %q, got %q", - ErrInvalidToken, v.config.AuthServerIssuerURL, claims.Audience) - } - // Step 4: Find trusted IdP - var trustedIdP *TrustedIdPConfig - for _, idp := range v.config.TrustedIdPs { - if idp.IssuerURL == claims.Issuer { - trustedIdP = idp - break - } - } - if trustedIdP == nil { - return nil, fmt.Errorf("%w: untrusted issuer: %q", ErrInvalidToken, claims.Issuer) - } - // Step 5: Verify JWT signature using IdP's JWKS - if err := v.verifySignature(ctx, token, trustedIdP.JWKSURL); err != nil { - return nil, fmt.Errorf("%w: signature verification failed: %v", ErrInvalidToken, err) - } - // Step 6: Replay attack prevention (check JTI) - if err := v.checkJTI(claims.JTI, expiryTime); err != nil { - return nil, fmt.Errorf("%w: %v", ErrInvalidToken, err) - } - // Step 7: Return TokenInfo - scopes := []string{} - if claims.Scope != "" { - scopes = strings.Split(claims.Scope, " ") - } - return &TokenInfo{ - Scopes: scopes, - Expiration: expiryTime, - Extra: map[string]any{ - "sub": claims.Subject, - "client_id": claims.ClientID, - "resource": claims.Resource, - "iss": claims.Issuer, - }, - }, nil -} - -// verifySignature verifies the JWT signature using the IdP's JWKS. -func (v *IDJAGVerifier) verifySignature(ctx context.Context, tokenString, jwksURL string) error { - // Parse JWT to get header - parts := strings.Split(tokenString, ".") - if len(parts) != 3 { - return fmt.Errorf("invalid JWT format") - } - // Decode header to get kid - headerJSON, err := base64.RawURLEncoding.DecodeString(parts[0]) - if err != nil { - return fmt.Errorf("failed to decode JWT header: %w", err) - } - var header struct { - Kid string `json:"kid"` - Alg string `json:"alg"` - } - if err := json.Unmarshal(headerJSON, &header); err != nil { - return fmt.Errorf("failed to parse JWT header: %w", err) - } - // Fetch JWKS - jwks, err := v.jwksCache.Get(ctx, jwksURL) - if err != nil { - return fmt.Errorf("failed to fetch JWKS: %w", err) - } - // Find the key - jwk, err := jwks.FindKey(header.Kid) - if err != nil { - return fmt.Errorf("key not found in JWKS: %w", err) - } - // Parse JWT with verification - token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) { - // Verify algorithm - if token.Method.Alg() != header.Alg { - return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"]) - } - // Convert JWK to public key - return jwkToPublicKey(jwk) - }) - if err != nil { - return fmt.Errorf("JWT verification failed: %w", err) - } - if !token.Valid { - return fmt.Errorf("JWT is invalid") - } - return nil -} - -// checkJTI checks if the JTI has been used before (replay attack prevention). -func (v *IDJAGVerifier) checkJTI(jti string, expiresAt time.Time) error { - v.usedJTIMu.Lock() - defer v.usedJTIMu.Unlock() - if _, used := v.usedJTIs[jti]; used { - return fmt.Errorf("JTI %q already used (replay attack)", jti) - } - // Mark as used - v.usedJTIs[jti] = expiresAt - return nil -} - -// cleanupExpiredJTIs periodically removes expired JTIs from the tracking map. -func (v *IDJAGVerifier) cleanupExpiredJTIs() { - ticker := time.NewTicker(10 * time.Minute) - defer ticker.Stop() - for range ticker.C { - v.usedJTIMu.Lock() - now := time.Now() - for jti, expiresAt := range v.usedJTIs { - if now.After(expiresAt) { - delete(v.usedJTIs, jti) - } - } - v.usedJTIMu.Unlock() - } -} - -// jwkToPublicKey converts a JWK to a public key for signature verification. -func jwkToPublicKey(jwk *JWK) (interface{}, error) { - switch jwk.KeyType { - case "RSA": - // Decode modulus - nBytes, err := base64.RawURLEncoding.DecodeString(jwk.N) - if err != nil { - return nil, fmt.Errorf("failed to decode modulus: %w", err) - } - // Decode exponent - eBytes, err := base64.RawURLEncoding.DecodeString(jwk.E) - if err != nil { - return nil, fmt.Errorf("failed to decode exponent: %w", err) - } - // Convert to big.Int - n := new(big.Int).SetBytes(nBytes) - e := new(big.Int).SetBytes(eBytes) - return &rsa.PublicKey{ - N: n, - E: int(e.Int64()), - }, nil - default: - return nil, fmt.Errorf("unsupported key type: %s", jwk.KeyType) - } -} diff --git a/auth/id_jag_verifier_test.go b/auth/id_jag_verifier_test.go deleted file mode 100644 index 544aef6b..00000000 --- a/auth/id_jag_verifier_test.go +++ /dev/null @@ -1,191 +0,0 @@ -// Copyright 2025 The Go MCP SDK Authors. All rights reserved. -// Use of this source code is governed by an MIT-style -// license that can be found in the LICENSE file. - -//go:build mcp_go_client_oauth - -package auth - -import ( - "context" - "crypto/rand" - "crypto/rsa" - "encoding/base64" - "encoding/json" - "fmt" - "math/big" - "net/http" - "net/http/httptest" - "strings" - "testing" - "time" - - "github.com/golang-jwt/jwt/v5" -) - -// TestIDJAGVerifier tests ID-JAG validation. -func TestIDJAGVerifier(t *testing.T) { - // Generate RSA key pair for testing - privateKey, err := rsa.GenerateKey(rand.Reader, 2048) - if err != nil { - t.Fatalf("Failed to generate key: %v", err) - } - publicKey := &privateKey.PublicKey - // Create mock JWKS server - jwksServer := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - jwks := &JWKS{ - Keys: []JWK{ - { - KeyType: "RSA", - Use: "sig", - KeyID: "test-key", - Algorithm: "RS256", - N: base64.RawURLEncoding.EncodeToString(publicKey.N.Bytes()), - E: base64.RawURLEncoding.EncodeToString(big.NewInt(int64(publicKey.E)).Bytes()), - }, - }, - } - w.Header().Set("Content-Type", "application/json") - json.NewEncoder(w).Encode(jwks) - })) - defer jwksServer.Close() - // Configure verifier - config := &IDJAGVerifierConfig{ - AuthServerIssuerURL: "https://auth.mcpserver.example", - TrustedIdPs: map[string]*TrustedIdPConfig{ - "test-idp": { - IssuerURL: "https://test.okta.com", - JWKSURL: jwksServer.URL, - }, - }, - HTTPClient: jwksServer.Client(), - } - verifier := NewIDJAGVerifier(config) - // Test valid ID-JAG - t.Run("valid ID-JAG", func(t *testing.T) { - idJAG := createTestIDJAG(t, privateKey, map[string]interface{}{ - "iss": "https://test.okta.com", - "sub": "user123", - "aud": "https://auth.mcpserver.example", - "resource": "https://mcp.mcpserver.example", - "client_id": "client123", - "jti": "jti-" + fmt.Sprint(time.Now().UnixNano()), - "exp": time.Now().Add(1 * time.Hour).Unix(), - "iat": time.Now().Unix(), - "scope": "read write", - }) - tokenInfo, err := verifier(context.Background(), idJAG, nil) - if err != nil { - t.Fatalf("Verify failed: %v", err) - } - if len(tokenInfo.Scopes) != 2 { - t.Errorf("expected 2 scopes, got %d", len(tokenInfo.Scopes)) - } - if tokenInfo.Extra["sub"] != "user123" { - t.Errorf("expected sub 'user123', got %v", tokenInfo.Extra["sub"]) - } - if tokenInfo.Extra["client_id"] != "client123" { - t.Errorf("expected client_id 'client123', got %v", tokenInfo.Extra["client_id"]) - } - }) - // Test expired ID-JAG - t.Run("expired ID-JAG", func(t *testing.T) { - idJAG := createTestIDJAG(t, privateKey, map[string]interface{}{ - "iss": "https://test.okta.com", - "sub": "user123", - "aud": "https://auth.mcpserver.example", - "resource": "https://mcp.mcpserver.example", - "client_id": "client123", - "jti": "jti-expired", - "exp": time.Now().Add(-1 * time.Hour).Unix(), - "iat": time.Now().Add(-2 * time.Hour).Unix(), - "scope": "read write", - }) - _, err := verifier(context.Background(), idJAG, nil) - if err == nil { - t.Error("expected error for expired ID-JAG, got nil") - } - }) - // Test wrong audience - t.Run("wrong audience", func(t *testing.T) { - idJAG := createTestIDJAG(t, privateKey, map[string]interface{}{ - "iss": "https://test.okta.com", - "sub": "user123", - "aud": "https://wrong.audience.com", - "resource": "https://mcp.mcpserver.example", - "client_id": "client123", - "jti": "jti-wrong-aud", - "exp": time.Now().Add(1 * time.Hour).Unix(), - "iat": time.Now().Unix(), - "scope": "read write", - }) - _, err := verifier(context.Background(), idJAG, nil) - if err == nil { - t.Error("expected error for wrong audience, got nil") - } - if !strings.Contains(err.Error(), "invalid audience") { - t.Errorf("expected 'invalid audience' error, got: %v", err) - } - }) - // Test untrusted issuer - t.Run("untrusted issuer", func(t *testing.T) { - idJAG := createTestIDJAG(t, privateKey, map[string]interface{}{ - "iss": "https://untrusted.idp.com", - "sub": "user123", - "aud": "https://auth.mcpserver.example", - "resource": "https://mcp.mcpserver.example", - "client_id": "client123", - "jti": "jti-untrusted", - "exp": time.Now().Add(1 * time.Hour).Unix(), - "iat": time.Now().Unix(), - "scope": "read write", - }) - _, err := verifier(context.Background(), idJAG, nil) - if err == nil { - t.Error("expected error for untrusted issuer, got nil") - } - if !strings.Contains(err.Error(), "untrusted issuer") { - t.Errorf("expected 'untrusted issuer' error, got: %v", err) - } - }) - // Test replay attack - t.Run("replay attack", func(t *testing.T) { - jti := "jti-replay-" + fmt.Sprint(time.Now().UnixNano()) - idJAG := createTestIDJAG(t, privateKey, map[string]interface{}{ - "iss": "https://test.okta.com", - "sub": "user123", - "aud": "https://auth.mcpserver.example", - "resource": "https://mcp.mcpserver.example", - "client_id": "client123", - "jti": jti, - "exp": time.Now().Add(1 * time.Hour).Unix(), - "iat": time.Now().Unix(), - "scope": "read write", - }) - // First use should succeed - _, err := verifier(context.Background(), idJAG, nil) - if err != nil { - t.Fatalf("First verify failed: %v", err) - } - // Second use (replay) should fail - _, err = verifier(context.Background(), idJAG, nil) - if err == nil { - t.Error("expected error for replay attack, got nil") - } - if !strings.Contains(err.Error(), "already used") { - t.Errorf("expected 'already used' error, got: %v", err) - } - }) -} - -// createTestIDJAG creates a test ID-JAG JWT signed with the given private key. -func createTestIDJAG(t *testing.T, privateKey *rsa.PrivateKey, claims map[string]interface{}) string { - token := jwt.NewWithClaims(jwt.SigningMethodRS256, jwt.MapClaims(claims)) - token.Header["typ"] = "oauth-id-jag+jwt" - token.Header["kid"] = "test-key" - signedToken, err := token.SignedString(privateKey) - if err != nil { - t.Fatalf("Failed to sign token: %v", err) - } - return signedToken -} diff --git a/auth/jwks_cache.go b/auth/jwks_cache.go deleted file mode 100644 index 70efe89f..00000000 --- a/auth/jwks_cache.go +++ /dev/null @@ -1,150 +0,0 @@ -// Copyright 2025 The Go MCP SDK Authors. All rights reserved. -// Use of this source code is governed by an MIT-style -// license that can be found in the LICENSE file. - -// This file implements JWKS (JSON Web Key Set) fetching and caching for -// JWT signature verification in Enterprise Managed Authorization (SEP-990). - -//go:build mcp_go_client_oauth - -package auth - -import ( - "context" - "encoding/json" - "fmt" - "io" - "net/http" - "sync" - "time" -) - -// JWK represents a JSON Web Key per RFC 7517. -type JWK struct { - // KeyType is the key type (e.g., "RSA", "EC"). - KeyType string `json:"kty"` - // Use indicates the intended use of the key (e.g., "sig" for signature). - Use string `json:"use,omitempty"` - // KeyID is the key identifier. - KeyID string `json:"kid"` - // Algorithm is the algorithm intended for use with the key. - Algorithm string `json:"alg,omitempty"` - // N is the RSA modulus (base64url encoded). - N string `json:"n,omitempty"` - // E is the RSA public exponent (base64url encoded). - E string `json:"e,omitempty"` - // X is the X coordinate for elliptic curve keys (base64url encoded). - X string `json:"x,omitempty"` - // Y is the Y coordinate for elliptic curve keys (base64url encoded). - Y string `json:"y,omitempty"` - // Curve is the elliptic curve name (e.g., "P-256"). - Curve string `json:"crv,omitempty"` -} - -// JWKS represents a JSON Web Key Set per RFC 7517. -type JWKS struct { - Keys []JWK `json:"keys"` -} - -// FindKey finds a key by its key ID (kid). -func (j *JWKS) FindKey(kid string) (*JWK, error) { - for i := range j.Keys { - if j.Keys[i].KeyID == kid { - return &j.Keys[i], nil - } - } - return nil, fmt.Errorf("key with kid %q not found", kid) -} - -// JWKSCache caches JWKS responses to reduce network requests. -type JWKSCache struct { - mu sync.RWMutex - entries map[string]*jwksCacheEntry - client *http.Client -} -type jwksCacheEntry struct { - jwks *JWKS - expiresAt time.Time -} - -// NewJWKSCache creates a new JWKS cache with the given HTTP client. -// If client is nil, http.DefaultClient is used. -func NewJWKSCache(client *http.Client) *JWKSCache { - if client == nil { - client = http.DefaultClient - } - return &JWKSCache{ - entries: make(map[string]*jwksCacheEntry), - client: client, - } -} - -// Get fetches JWKS from the given URL, using cache if available and not expired. -// The cache duration is 1 hour per best practices for JWKS caching. -func (c *JWKSCache) Get(ctx context.Context, jwksURL string) (*JWKS, error) { - // Check cache first - c.mu.RLock() - entry, ok := c.entries[jwksURL] - c.mu.RUnlock() - if ok && time.Now().Before(entry.expiresAt) { - return entry.jwks, nil - } - // Fetch from network - jwks, err := c.fetch(ctx, jwksURL) - if err != nil { - return nil, err - } - // Update cache - c.mu.Lock() - c.entries[jwksURL] = &jwksCacheEntry{ - jwks: jwks, - expiresAt: time.Now().Add(1 * time.Hour), - } - c.mu.Unlock() - return jwks, nil -} - -// fetch retrieves JWKS from the given URL. -func (c *JWKSCache) fetch(ctx context.Context, jwksURL string) (*JWKS, error) { - req, err := http.NewRequestWithContext(ctx, http.MethodGet, jwksURL, nil) - if err != nil { - return nil, fmt.Errorf("failed to create JWKS request: %w", err) - } - req.Header.Set("Accept", "application/json") - resp, err := c.client.Do(req) - if err != nil { - return nil, fmt.Errorf("failed to fetch JWKS: %w", err) - } - defer resp.Body.Close() - if resp.StatusCode != http.StatusOK { - return nil, fmt.Errorf("JWKS endpoint returned status %d", resp.StatusCode) - } - // Read response body (limit to 1MB for safety) - body, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20)) - if err != nil { - return nil, fmt.Errorf("failed to read JWKS response: %w", err) - } - // Parse JWKS - var jwks JWKS - if err := json.Unmarshal(body, &jwks); err != nil { - return nil, fmt.Errorf("failed to parse JWKS: %w", err) - } - if len(jwks.Keys) == 0 { - return nil, fmt.Errorf("JWKS contains no keys") - } - return &jwks, nil -} - -// Invalidate removes a JWKS entry from the cache, forcing a fresh fetch on next Get. -func (c *JWKSCache) Invalidate(jwksURL string) { - c.mu.Lock() - delete(c.entries, jwksURL) - c.mu.Unlock() -} - -// Clear removes all entries from the cache. -func (c *JWKSCache) Clear() { - c.mu.Lock() - c.entries = make(map[string]*jwksCacheEntry) - c.mu.Unlock() -} diff --git a/auth/jwks_cache_test.go b/auth/jwks_cache_test.go deleted file mode 100644 index 4ec87ca7..00000000 --- a/auth/jwks_cache_test.go +++ /dev/null @@ -1,199 +0,0 @@ -// Copyright 2025 The Go MCP SDK Authors. All rights reserved. -// Use of this source code is governed by an MIT-style -// license that can be found in the LICENSE file. - -//go:build mcp_go_client_oauth - -package auth - -import ( - "context" - "encoding/json" - "net/http" - "net/http/httptest" - "testing" - "time" -) - -// TestJWKSCache tests JWKS fetching and caching. -func TestJWKSCache(t *testing.T) { - // Create test JWKS - testJWKS := &JWKS{ - Keys: []JWK{ - { - KeyType: "RSA", - Use: "sig", - KeyID: "test-key-1", - Algorithm: "RS256", - N: "test-modulus", - E: "AQAB", - }, - { - KeyType: "RSA", - Use: "sig", - KeyID: "test-key-2", - Algorithm: "RS256", - N: "test-modulus-2", - E: "AQAB", - }, - }, - } - // Create test server - var requestCount int - server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - requestCount++ - if r.Method != http.MethodGet { - http.Error(w, "method not allowed", http.StatusMethodNotAllowed) - return - } - w.Header().Set("Content-Type", "application/json") - json.NewEncoder(w).Encode(testJWKS) - })) - defer server.Close() - cache := NewJWKSCache(server.Client()) - // Test first fetch - t.Run("first fetch", func(t *testing.T) { - jwks, err := cache.Get(context.Background(), server.URL) - if err != nil { - t.Fatalf("Get failed: %v", err) - } - if len(jwks.Keys) != 2 { - t.Errorf("expected 2 keys, got %d", len(jwks.Keys)) - } - if jwks.Keys[0].KeyID != "test-key-1" { - t.Errorf("expected key ID 'test-key-1', got '%s'", jwks.Keys[0].KeyID) - } - if requestCount != 1 { - t.Errorf("expected 1 request, got %d", requestCount) - } - }) - // Test cache hit - t.Run("cache hit", func(t *testing.T) { - jwks, err := cache.Get(context.Background(), server.URL) - if err != nil { - t.Fatalf("Get failed: %v", err) - } - if len(jwks.Keys) != 2 { - t.Errorf("expected 2 keys from cache, got %d", len(jwks.Keys)) - } - // Should still be 1 request (served from cache) - if requestCount != 1 { - t.Errorf("expected 1 request (cached), got %d", requestCount) - } - }) - // Test FindKey - t.Run("find key", func(t *testing.T) { - jwks, _ := cache.Get(context.Background(), server.URL) - key, err := jwks.FindKey("test-key-2") - if err != nil { - t.Fatalf("FindKey failed: %v", err) - } - if key.KeyID != "test-key-2" { - t.Errorf("expected key ID 'test-key-2', got '%s'", key.KeyID) - } - if key.N != "test-modulus-2" { - t.Errorf("expected modulus 'test-modulus-2', got '%s'", key.N) - } - }) - // Test key not found - t.Run("key not found", func(t *testing.T) { - jwks, _ := cache.Get(context.Background(), server.URL) - _, err := jwks.FindKey("nonexistent") - if err == nil { - t.Error("expected error for nonexistent key, got nil") - } - }) - // Test Invalidate - t.Run("invalidate", func(t *testing.T) { - cache.Invalidate(server.URL) - // Next fetch should hit the server again - _, err := cache.Get(context.Background(), server.URL) - if err != nil { - t.Fatalf("Get after invalidate failed: %v", err) - } - if requestCount != 2 { - t.Errorf("expected 2 requests after invalidate, got %d", requestCount) - } - }) - // Test Clear - t.Run("clear", func(t *testing.T) { - cache.Clear() - // Next fetch should hit the server again - _, err := cache.Get(context.Background(), server.URL) - if err != nil { - t.Fatalf("Get after clear failed: %v", err) - } - if requestCount != 3 { - t.Errorf("expected 3 requests after clear, got %d", requestCount) - } - }) - // Test error handling - t.Run("server error", func(t *testing.T) { - errorServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - http.Error(w, "internal error", http.StatusInternalServerError) - })) - defer errorServer.Close() - _, err := cache.Get(context.Background(), errorServer.URL) - if err == nil { - t.Error("expected error for server error, got nil") - } - }) - // Test invalid JSON - t.Run("invalid json", func(t *testing.T) { - invalidServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - w.Header().Set("Content-Type", "application/json") - w.Write([]byte("invalid json")) - })) - defer invalidServer.Close() - _, err := cache.Get(context.Background(), invalidServer.URL) - if err == nil { - t.Error("expected error for invalid JSON, got nil") - } - }) - // Test empty keys - t.Run("empty keys", func(t *testing.T) { - emptyServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - w.Header().Set("Content-Type", "application/json") - json.NewEncoder(w).Encode(&JWKS{Keys: []JWK{}}) - })) - defer emptyServer.Close() - _, err := cache.Get(context.Background(), emptyServer.URL) - if err == nil { - t.Error("expected error for empty keys, got nil") - } - }) -} - -// TestJWKSCacheExpiration tests cache expiration. -func TestJWKSCacheExpiration(t *testing.T) { - testJWKS := &JWKS{ - Keys: []JWK{{KeyID: "test", KeyType: "RSA", N: "test", E: "AQAB"}}, - } - var requestCount int - server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - requestCount++ - w.Header().Set("Content-Type", "application/json") - json.NewEncoder(w).Encode(testJWKS) - })) - defer server.Close() - cache := NewJWKSCache(server.Client()) - // First fetch - _, err := cache.Get(context.Background(), server.URL) - if err != nil { - t.Fatalf("Get failed: %v", err) - } - // Manually expire the cache entry - cache.mu.Lock() - if entry, ok := cache.entries[server.URL]; ok { - entry.expiresAt = time.Now().Add(-1 * time.Hour) - } - cache.mu.Unlock() - // Next fetch should hit server again - _, err = cache.Get(context.Background(), server.URL) - if err != nil { - t.Fatalf("Get after expiration failed: %v", err) - } - if requestCount != 2 { - t.Errorf("expected 2 requests after expiration, got %d", requestCount) - } -} diff --git a/docs/protocol.md b/docs/protocol.md index b8dd6dc2..d9962cf7 100644 --- a/docs/protocol.md +++ b/docs/protocol.md @@ -304,37 +304,6 @@ For more sophisticated CORS policies, wrap the handler with a CORS middleware li The [_auth middleware example_](https://github.com/modelcontextprotocol/go-sdk/tree/main/examples/server/auth-middleware) shows how to implement authorization for both JWT tokens and API keys. -#### Enterprise Managed Authorization (SEP-990) - -For enterprise environments with centralized identity providers, the SDK supports ID-JAG (Identity Assertion JWT Authorization Grant) token validation using [`NewIDJAGVerifier`](https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk/auth#NewIDJAGVerifier). - -This verifier validates ID-JAG tokens issued by trusted identity providers through: -- Signature verification using the IdP's JWKS -- Audience validation (ensures token was issued for this MCP server) -- Expiration and clock skew handling -- Replay attack prevention via JTI tracking - -Example configuration: - -```go -config := &IDJAGVerifierConfig{ - AuthServerIssuerURL: "https://auth.mcpserver.example", - TrustedIdPs: map[string]*TrustedIdPConfig{ - "acme-okta": { - IssuerURL: "https://acme.okta.com", - JWKSURL: "https://acme.okta.com/.well-known/jwks.json", - }, - }, -} - -verifier := NewIDJAGVerifier(config) -middleware := RequireBearerToken(verifier, &RequireBearerTokenOptions{ - Scopes: []string{"read"}, -}) -``` - -Tool handlers can access ID-JAG claims from `req.Extra.TokenInfo.Extra`, which includes the subject, client ID, resource, and issuer from the validated token. - ### Client Client-side OAuth is implemented by setting @@ -343,10 +312,12 @@ Additional support is forthcoming; see modelcontextprotocol/go-sdk#493. #### Enterprise Authentication Flow (SEP-990) -For enterprise SSO scenarios, the SDK provides an [`EnterpriseAuthFlow`](https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk/auth#EnterpriseAuthFlow) function that implements the complete token exchange flow: +For enterprise SSO scenarios, the SDK provides an +[`EnterpriseAuthFlow`](https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk/auth#EnterpriseAuthFlow) +function that implements the complete token exchange flow: -1. **Token Exchange** at IdP: ID Token -> ID-JAG -2. **JWT Bearer Grant** at MCP Server: ID-JAG -> Access Token +1. **Token Exchange** at IdP: ID Token → ID-JAG +2. **JWT Bearer Grant** at MCP Server: ID-JAG → Access Token This flow is typically used after obtaining an ID Token via OIDC login: @@ -355,17 +326,18 @@ This flow is typically used after obtaining an ID Token via OIDC login: idToken := "..." // from OIDC login // Step 2: Exchange for MCP access token -enterpriseConfig := &EnterpriseAuthConfig{ - IdPIssuerURL: "https://acme.okta.com", - IdPClientID: "client-id-at-idp", - IdPClientSecret: "secret-at-idp", - MCPAuthServerURL: "https://auth.mcpserver.example", - MCPResourceURL: "https://mcp.mcpserver.example", - MCPClientID: "client-id-at-mcp", - MCPClientSecret: "secret-at-mcp", - MCPScopes: []string{"read", "write"}, +config := &auth.EnterpriseAuthConfig{ + IdPIssuerURL: "https://company.okta.com", + IdPClientID: "client-id-at-idp", + IdPClientSecret: "secret-at-idp", + MCPAuthServerURL: "https://auth.mcpserver.example", + MCPResourceURL: "https://mcp.mcpserver.example", + MCPClientID: "client-id-at-mcp", + MCPClientSecret: "secret-at-mcp", + MCPScopes: []string{"read", "write"}, } -accessToken, err := EnterpriseAuthFlow(ctx, enterpriseConfig, tokens.IDToken) + +accessToken, err := auth.EnterpriseAuthFlow(ctx, config, idToken) // Use accessToken with MCP client ``` @@ -567,3 +539,4 @@ func Example_progress() { // frobbing widgets 2/2 } ``` + diff --git a/internal/docs/protocol.src.md b/internal/docs/protocol.src.md index efb483d4..b060e083 100644 --- a/internal/docs/protocol.src.md +++ b/internal/docs/protocol.src.md @@ -230,37 +230,6 @@ For more sophisticated CORS policies, wrap the handler with a CORS middleware li The [_auth middleware example_](https://github.com/modelcontextprotocol/go-sdk/tree/main/examples/server/auth-middleware) shows how to implement authorization for both JWT tokens and API keys. -#### Enterprise Managed Authorization (SEP-990) - -For enterprise environments with centralized identity providers, the SDK supports ID-JAG (Identity Assertion JWT Authorization Grant) token validation using [`NewIDJAGVerifier`](https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk/auth#NewIDJAGVerifier). - -This verifier validates ID-JAG tokens issued by trusted identity providers through: -- Signature verification using the IdP's JWKS -- Audience validation (ensures token was issued for this MCP server) -- Expiration and clock skew handling -- Replay attack prevention via JTI tracking - -Example configuration: - -```go -config := &IDJAGVerifierConfig{ - AuthServerIssuerURL: "https://auth.mcpserver.example", - TrustedIdPs: map[string]*TrustedIdPConfig{ - "acme-okta": { - IssuerURL: "https://acme.okta.com", - JWKSURL: "https://acme.okta.com/.well-known/jwks.json", - }, - }, -} - -verifier := NewIDJAGVerifier(config) -middleware := RequireBearerToken(verifier, &RequireBearerTokenOptions{ - Scopes: []string{"read"}, -}) -``` - -Tool handlers can access ID-JAG claims from `req.Extra.TokenInfo.Extra`, which includes the subject, client ID, resource, and issuer from the validated token. - ### Client Client-side OAuth is implemented by setting @@ -269,10 +238,12 @@ Additional support is forthcoming; see modelcontextprotocol/go-sdk#493. #### Enterprise Authentication Flow (SEP-990) -For enterprise SSO scenarios, the SDK provides an [`EnterpriseAuthFlow`](https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk/auth#EnterpriseAuthFlow) function that implements the complete token exchange flow: +For enterprise SSO scenarios, the SDK provides an +[`EnterpriseAuthFlow`](https://pkg.go.dev/github.com/modelcontextprotocol/go-sdk/auth#EnterpriseAuthFlow) +function that implements the complete token exchange flow: -1. **Token Exchange** at IdP: ID Token -> ID-JAG -2. **JWT Bearer Grant** at MCP Server: ID-JAG -> Access Token +1. **Token Exchange** at IdP: ID Token → ID-JAG +2. **JWT Bearer Grant** at MCP Server: ID-JAG → Access Token This flow is typically used after obtaining an ID Token via OIDC login: @@ -281,17 +252,18 @@ This flow is typically used after obtaining an ID Token via OIDC login: idToken := "..." // from OIDC login // Step 2: Exchange for MCP access token -enterpriseConfig := &EnterpriseAuthConfig{ - IdPIssuerURL: "https://acme.okta.com", - IdPClientID: "client-id-at-idp", - IdPClientSecret: "secret-at-idp", - MCPAuthServerURL: "https://auth.mcpserver.example", - MCPResourceURL: "https://mcp.mcpserver.example", - MCPClientID: "client-id-at-mcp", - MCPClientSecret: "secret-at-mcp", - MCPScopes: []string{"read", "write"}, +config := &auth.EnterpriseAuthConfig{ + IdPIssuerURL: "https://company.okta.com", + IdPClientID: "client-id-at-idp", + IdPClientSecret: "secret-at-idp", + MCPAuthServerURL: "https://auth.mcpserver.example", + MCPResourceURL: "https://mcp.mcpserver.example", + MCPClientID: "client-id-at-mcp", + MCPClientSecret: "secret-at-mcp", + MCPScopes: []string{"read", "write"}, } -accessToken, err := EnterpriseAuthFlow(ctx, enterpriseConfig, tokens.IDToken) + +accessToken, err := auth.EnterpriseAuthFlow(ctx, config, idToken) // Use accessToken with MCP client ``` @@ -391,3 +363,4 @@ or Issue #460 discusses some potential ergonomic improvements to this API. %include ../../mcp/mcp_example_test.go progress - + From 49e71f5f447e7bf194d625a8a972522e7c4e6041 Mon Sep 17 00:00:00 2001 From: Pranav RK Date: Thu, 4 Dec 2025 20:41:09 +0530 Subject: [PATCH 10/10] chore: rename MCPResourceURL to MCPResourceURI --- auth/enterprise_auth.go | 12 ++++++------ auth/enterprise_auth_test.go | 2 +- docs/protocol.md | 2 +- internal/docs/protocol.src.md | 2 +- oauthex/oauth2.go | 5 +++-- 5 files changed, 12 insertions(+), 11 deletions(-) diff --git a/auth/enterprise_auth.go b/auth/enterprise_auth.go index 2d903ca2..54535c40 100644 --- a/auth/enterprise_auth.go +++ b/auth/enterprise_auth.go @@ -29,7 +29,7 @@ type EnterpriseAuthConfig struct { // MCP Server configuration (the resource being accessed) MCPAuthServerURL string // MCP Server's auth server issuer URL - MCPResourceURL string // MCP Server's resource identifier + MCPResourceURI string // MCP Server's resource identifier MCPClientID string // MCP Client's ID at the MCP Server MCPClientSecret string // MCP Client's secret at the MCP Server MCPScopes []string // Requested scopes at the MCP Server @@ -76,7 +76,7 @@ type EnterpriseAuthConfig struct { // IdPClientID: "client-id-at-idp", // IdPClientSecret: "secret-at-idp", // MCPAuthServerURL: "https://auth.mcpserver.example", -// MCPResourceURL: "https://mcp.mcpserver.example", +// MCPResourceURI: "https://mcp.mcpserver.example", // MCPClientID: "client-id-at-mcp", // MCPClientSecret: "secret-at-mcp", // MCPScopes: []string{"read", "write"}, @@ -93,7 +93,7 @@ type EnterpriseAuthConfig struct { // IdPClientID: "client-id-at-idp", // IdPClientSecret: "secret-at-idp", // MCPAuthServerURL: "https://auth.mcpserver.example", -// MCPResourceURL: "https://mcp.mcpserver.example", +// MCPResourceURI: "https://mcp.mcpserver.example", // MCPClientID: "client-id-at-mcp", // MCPClientSecret: "secret-at-mcp", // MCPScopes: []string{"read", "write"}, @@ -124,8 +124,8 @@ func EnterpriseAuthFlow( if config.MCPAuthServerURL == "" { return nil, fmt.Errorf("MCPAuthServerURL is required") } - if config.MCPResourceURL == "" { - return nil, fmt.Errorf("MCPResourceURL is required") + if config.MCPResourceURI == "" { + return nil, fmt.Errorf("MCPResourceURI is required") } httpClient := config.HTTPClient if httpClient == nil { @@ -142,7 +142,7 @@ func EnterpriseAuthFlow( tokenExchangeReq := &oauthex.TokenExchangeRequest{ RequestedTokenType: oauthex.TokenTypeIDJAG, Audience: config.MCPAuthServerURL, - Resource: config.MCPResourceURL, + Resource: config.MCPResourceURI, Scope: config.MCPScopes, SubjectToken: idToken, SubjectTokenType: oauthex.TokenTypeIDToken, diff --git a/auth/enterprise_auth_test.go b/auth/enterprise_auth_test.go index db2e5ffd..c44e4233 100644 --- a/auth/enterprise_auth_test.go +++ b/auth/enterprise_auth_test.go @@ -34,7 +34,7 @@ func TestEnterpriseAuthFlow(t *testing.T) { IdPClientID: "test-idp-client", IdPClientSecret: "test-idp-secret", MCPAuthServerURL: mcpServer.URL, - MCPResourceURL: "https://mcp.example.com", + MCPResourceURI: "https://mcp.example.com", MCPClientID: "test-mcp-client", MCPClientSecret: "test-mcp-secret", MCPScopes: []string{"read", "write"}, diff --git a/docs/protocol.md b/docs/protocol.md index d9962cf7..2fa9d2db 100644 --- a/docs/protocol.md +++ b/docs/protocol.md @@ -331,7 +331,7 @@ config := &auth.EnterpriseAuthConfig{ IdPClientID: "client-id-at-idp", IdPClientSecret: "secret-at-idp", MCPAuthServerURL: "https://auth.mcpserver.example", - MCPResourceURL: "https://mcp.mcpserver.example", + MCPResourceURI: "https://mcp.mcpserver.example", MCPClientID: "client-id-at-mcp", MCPClientSecret: "secret-at-mcp", MCPScopes: []string{"read", "write"}, diff --git a/internal/docs/protocol.src.md b/internal/docs/protocol.src.md index b060e083..63a7e20d 100644 --- a/internal/docs/protocol.src.md +++ b/internal/docs/protocol.src.md @@ -257,7 +257,7 @@ config := &auth.EnterpriseAuthConfig{ IdPClientID: "client-id-at-idp", IdPClientSecret: "secret-at-idp", MCPAuthServerURL: "https://auth.mcpserver.example", - MCPResourceURL: "https://mcp.mcpserver.example", + MCPResourceURI: "https://mcp.mcpserver.example", MCPClientID: "client-id-at-mcp", MCPClientSecret: "secret-at-mcp", MCPScopes: []string{"read", "write"}, diff --git a/oauthex/oauth2.go b/oauthex/oauth2.go index 3bc392ab..ab72f699 100644 --- a/oauthex/oauth2.go +++ b/oauthex/oauth2.go @@ -58,8 +58,9 @@ func getJSON[T any](ctx context.Context, c *http.Client, url string, limit int64 return nil, fmt.Errorf("bad status %s", res.Status) } // Specs require application/json. - if ct := res.Header.Get("Content-Type"); ct != "application/json" { - return nil, fmt.Errorf("bad content type %q", ct) + ct := strings.TrimSpace(strings.SplitN(res.Header.Get("Content-Type"), ";", 2)[0]) + if ct != "application/json" { + return nil, fmt.Errorf("bad content type %q", res.Header.Get("Content-Type")) } var t T