From f46f54d50b6508c50e4f2ceac9864bd8df6562c2 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Wed, 16 Sep 2026 16:11:08 -0700 Subject: [PATCH] docs: quote the loopback regex actually deployed on the provider MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pattern in the walkthrough was written from memory and differs from the one on the `shared-memory-mcp` provider in a way that matters: `…:[0-9]+/.*` requires a path component, so it fails to match a bare `http://localhost:5693`, which the deployed `…:\d+(/.*)?$` accepts. Copy the live value verbatim instead. Co-Authored-By: Claude Opus 5 (1M context) --- README.md | 4 ++-- docs/oidc-entra-id.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 784a56e..50d9b66 100644 --- a/README.md +++ b/README.md @@ -318,7 +318,7 @@ first connection attempt: matching mode to **Regex** so any port works without re-registering: ``` - http://(localhost|127\.0\.0\.1):[0-9]+/.* + ^http://(127\.0\.0\.1|localhost):\d+(/.*)?$ ``` **The port is not optional.** Authentik rejects a portless @@ -571,7 +571,7 @@ What happens: `--callback-port` is required because your IdP only accepts pre-registered redirect URIs. Pick any free port; just make sure the matching URI is in your MCP client's **Redirect URIs** list. Authentik users with the regex -entry from the setup step (`http://(localhost|127\.0\.0\.1):[0-9]+/.*`) can +entry from the setup step (`^http://(127\.0\.0\.1|localhost):\d+(/.*)?$`) can use any port without re-registering. ### C. Manual-paste fallback (when loopback isn't reachable) diff --git a/docs/oidc-entra-id.md b/docs/oidc-entra-id.md index 8964339..7fb8a6a 100644 --- a/docs/oidc-entra-id.md +++ b/docs/oidc-entra-id.md @@ -241,7 +241,7 @@ prompt. See README → *Which redirect URIs to register*. `http://localhost` redirect URIs, so the single registration `http://localhost/callback` matches `http://localhost:33418/callback`, `http://localhost:9999/callback`, and any other port. This is Entra's -equivalent of the Authentik regex (`http://(localhost|127\.0\.0\.1):[0-9]+/.*`) +equivalent of the Authentik regex (`^http://(127\.0\.0\.1|localhost):\d+(/.*)?$`) the README mentions — users can pick any `--callback-port` without re-registering.