Repository navigation
auth/extauth: only forward an ID-JAG to the MCP authorization server - #1438
Merged
guglielmo-san merged 3 commits intoOct 26, 2026
Merged
guglielmo-san merged 3 commits into
guglielmo-san merged 3 commits into
Conversation
EnterpriseHandler.Authorize asks the IdP to exchange the user's ID token for an ID-JAG, then sends the token it gets back to the MCP Server's authorization server as a JWT bearer assertion. It did not look at the issued_token_type of the exchange response, which ExchangeToken only checks is present. If the IdP issued another type of token, such as an access token, that token was handed to a different party than the one that issued it. Refuse the response unless issued_token_type is urn:ietf:params:oauth:token-type:id-jag, the value the Identity Assertion Authorization Grant specification defines for it. The fake IdP gets an IssuedTokenType option, and TestEnterpriseHandler_Authorize_NotIDJAG checks that such a token is not forwarded even to an authorization server that would accept it. It fails without the change.
guglielmo-san
approved these changes
Oct 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
EnterpriseHandler.Authorizeexchanges the user's ID token at the IdP for an ID-JAG (RFC 8693 token exchange), then sends the token it gets back to the MCP Server's authorization server as a JWT bearer assertion (RFC 7523). It never looked atissued_token_typein the exchange response;oauthex.ExchangeTokenonly checks that the field is present.So if the IdP answered with a different type of token, for example an access token from an IdP that does not implement ID-JAG but does implement plain token exchange, that token was forwarded to a party other than the one that issued it.
This refuses the exchange result unless
issued_token_typeisurn:ietf:params:oauth:token-type:id-jag(oauthex.TokenTypeIDJAG), the value the Identity Assertion Authorization Grant draft defines for this response. The check lives in the handler rather than inExchangeToken, which is a general RFC 8693 helper where the issued type may legitimately differ from the requested one.Tests:
internal/oauthtest: the fake IdP gets aTokenExchangeConfig.IssuedTokenTypeoption (defaults to the ID-JAG type, so existing tests are unchanged).TestEnterpriseHandler_Authorize_NotIDJAG: the IdP issues an access token, and the MCP authorization server is configured to accept it as an assertion. Without the changeAuthorizesucceeds, i.e. the token is forwarded and accepted; with it,Authorizereturns an error and no token source is stored.AI assistance: prepared with Claude Code.