cybercove-labs/shared-memory
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: serve RFC 9728 path-suffixed metadata, document connector redirect URIs #26

Merged
jknapp merged 3 commits from fix/oauth-redirect-uris-and-rfc9728-discovery into main 2026-09-16 23:33:07 +00:00
Conversation 0 Commits 3 Files Changed 7
+3 -3
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit f46f54d50b - Show all commits
README.md
+2 -2
View File
@@ -318,7 +318,7 @@ first connection attempt:
matching mode to **Regex** so any port works without re-registering: matching mode to **Regex** so any port works without re-registering:
``` ```
http://(localhost|127\.0\.0\.1):[0-9]+/.* ^http://(127\.0\.0\.1|localhost):\d+(/.*)?$
``` ```
**The port is not optional.** Authentik rejects a portless **The port is not optional.** Authentik rejects a portless
@@ -571,7 +571,7 @@ What happens:
`--callback-port` is required because your IdP only accepts pre-registered `--callback-port` is required because your IdP only accepts pre-registered
redirect URIs. Pick any free port; just make sure the matching URI is in redirect URIs. Pick any free port; just make sure the matching URI is in
your MCP client's **Redirect URIs** list. Authentik users with the regex your MCP client's **Redirect URIs** list. Authentik users with the regex
entry from the setup step (`http://(localhost|127\.0\.0\.1):[0-9]+/.*`) can entry from the setup step (`^http://(127\.0\.0\.1|localhost):\d+(/.*)?$`) can
use any port without re-registering. use any port without re-registering.
### C. Manual-paste fallback (when loopback isn't reachable) ### C. Manual-paste fallback (when loopback isn't reachable)
docs/oidc-entra-id.md
+1 -1
View File
@@ -241,7 +241,7 @@ prompt. See README → *Which redirect URIs to register*.
`http://localhost` redirect URIs, so the single registration `http://localhost` redirect URIs, so the single registration
`http://localhost/callback` matches `http://localhost:33418/callback`, `http://localhost/callback` matches `http://localhost:33418/callback`,
`http://localhost:9999/callback`, and any other port. This is Entra's `http://localhost:9999/callback`, and any other port. This is Entra's
equivalent of the Authentik regex (`http://(localhost|127\.0\.0\.1):[0-9]+/.*`) equivalent of the Authentik regex (`^http://(127\.0\.0\.1|localhost):\d+(/.*)?$`)
the README mentions — users can pick any `--callback-port` without the README mentions — users can pick any `--callback-port` without
re-registering. re-registering.