cybercove-labs/shared-memory
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: let deployments advertise offline_access so MCP sessions can refresh

Browse Source 
MCP clients were being kicked back to an interactive login on a short
cycle, reporting "requires re-authorization (token expired)".

Cause: /.well-known/oauth-protected-resource advertised only
openid/profile/email plus the audience scope. A client requests exactly
the scopes it finds there, and Authentik issues a refresh token only when
offline_access is among them — so the client received an access token
with nothing to renew it with. Once that token aged out, re-authenticating
by hand was the only path forward.

This is the same trap the audience scope already documents one comment
further up: a scope missing from this document is a scope the client will
never ask for, however the IdP is configured.

Adds OIDC_OFFLINE_ACCESS (default false). Enabling it appends
offline_access to the advertised scopes.

Left opt-in rather than always-on because it is only half the fix — the
IdP also needs an offline_access scope mapping on the provider, and
advertising a scope the IdP doesn't offer risks an invalid_scope
rejection that would break authentication outright. A deployment turns
this on after configuring its IdP; README documents both halves and how
to verify each.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
shadowdao
2026-08-11 15:19:14 -07:00
co-authored by Claude Opus 5
parent d4d478d2f3
commit db17e0890e
5 changed files with 140 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
+9
View File
@@ -53,6 +53,15 @@ OIDC_AUDIENCE=shared-memory
# named the scope mapping something else.
#OIDC_AUDIENCE_SCOPE=aud-shared-memory
# Advertise `offline_access` so MCP clients receive a REFRESH token and can
# renew silently. Without it the client only gets a short-lived access token
# and kicks the user back to an interactive login every time it expires.
#
# Enable this ONLY after adding an `offline_access` scope mapping to the MCP
# provider in your IdP — advertising a scope the IdP doesn't offer can fail
# the whole authorization request. See README -> "Keeping sessions alive".
#OIDC_OFFLINE_ACCESS=true
# -----------------------------------------------------------------------------
# Database (Postgres 16 + pgvector — pgvector/pgvector:pg16 image)
# -----------------------------------------------------------------------------