With aud fixed, tokens are still rejected on iss — the MCP endpoint is a separate IdP application and Authentik stamps each token with its own slug. Adds OIDC_ISSUER_MCP.
With aud fixed, tokens are still rejected on `iss` — the MCP endpoint is a separate IdP application and Authentik stamps each token with its own slug. Adds OIDC_ISSUER_MCP.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Second failure on the same path. With the aud fix in place, tokens now carry
`aud: shared-memory` correctly but are still rejected — this time on `iss`.
The MCP endpoint is a separate application in the IdP from the Web UI, and
Authentik's default per_provider issuer mode stamps each token with its own
application slug. MCP tokens therefore carry
`.../application/o/shared-memory-mcp/` while OIDC_ISSUER points at
`.../application/o/shared-memory/`, so jwtVerify throws "claim invalid: iss".
Introduce OIDC_ISSUER_MCP (defaults to OIDC_ISSUER) and use it for both the
issuer check and the JWKS URL. The protected-resource metadata now advertises
that same issuer — previously it pointed clients at the Web UI's discovery
document while the tokens came from the MCP provider.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
jknapp
merged commit 1728752ce1 into main2026-07-27 13:10:38 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
With aud fixed, tokens are still rejected on
iss— the MCP endpoint is a separate IdP application and Authentik stamps each token with its own slug. Adds OIDC_ISSUER_MCP.🤖 Generated with Claude Code