Repository navigation
enhance auth server discovery with OAuth2 and OIDC metadata support #976
Description
Activity
@ihrpr Are you already working on implementing this, or planning to prior to the next spec release? Hoping to pick it up if not, as it'd enable using Cognito as an AS instead of needing a custom proxy. Looks like a small code change, as you already fixed the path routing for RFC8414 metadata earlier today (which this depends on).
@LucaButBoring For Cognito, we have another issue with the metadata published on the endpoint. Though it supports S256 and PKCE, Cognito doesnt publish it. As the client specification expects it and checks for it, we end up with an error. I had to write a proxy to get the metadata from Cognito and add the S256 code_challenge_methods_supported option before responding to the client.
Reacted by Luca ChangRaised a PR for this (#1061).
As the client specification expects it and checks for it
@manthram is that the case on the latest SDK version? From what I can see, the client code does assume S256 is supported, but doesn't appear to actually enforce that it's declared.
code_challenge_methods_supportedisn't defined for OIDC to begin with. The metadata type (OAuthMetadata) doesn't appear to enforce S256 during validation, either.Reacted by manthram- linked a pull request that will close this issueSupport falling back to OIDC metadata for auth #1061
on Jul 16, 2025
On hold until modelcontextprotocol/modelcontextprotocol#797 is merged