shadowdaoandClaude Opus 5
1fed65a187
Second failure on the same path. With the aud fix in place, tokens now carry `aud: shared-memory` correctly but are still rejected — this time on `iss`. The MCP endpoint is a separate application in the IdP from the Web UI, and Authentik's default per_provider issuer mode stamps each token with its own application slug. MCP tokens therefore carry `.../application/o/shared-memory-mcp/` while OIDC_ISSUER points at `.../application/o/shared-memory/`, so jwtVerify throws "claim invalid: iss". Introduce OIDC_ISSUER_MCP (defaults to OIDC_ISSUER) and use it for both the issuer check and the JWKS URL. The protected-resource metadata now advertises that same issuer — previously it pointed clients at the Web UI's discovery document while the tokens came from the MCP provider. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
35 lines
1.3 KiB
TypeScript
35 lines
1.3 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { env } from "@/lib/env";
|
|
import { mcpIssuer } from "@/lib/auth/jwt";
|
|
|
|
export const runtime = "nodejs";
|
|
export const dynamic = "force-dynamic";
|
|
|
|
/**
|
|
* RFC 9728 — OAuth 2.0 Protected Resource Metadata.
|
|
*
|
|
* MCP clients discover the authorization server (Authentik) via this
|
|
* endpoint after receiving a 401 with `WWW-Authenticate: resource_metadata=...`.
|
|
*/
|
|
export function GET() {
|
|
const resource = env().PUBLIC_URL.replace(/\/$/, "");
|
|
|
|
// The audience scope MUST be advertised. Authentik only evaluates a scope
|
|
// mapping when the client requests that scope by name, and the client only
|
|
// learns scope names from this document. Omit it and every access token
|
|
// arrives without `aud`, which jwt.ts rejects as "claim invalid: aud".
|
|
const audienceScope =
|
|
env().OIDC_AUDIENCE_SCOPE ?? `aud-${env().OIDC_AUDIENCE}`;
|
|
|
|
return NextResponse.json({
|
|
resource,
|
|
// The MCP application's issuer, which is not necessarily the Web UI's —
|
|
// see mcpIssuer(). Advertising the wrong one sends clients to a discovery
|
|
// document whose tokens this endpoint will then reject on `iss`.
|
|
authorization_servers: [mcpIssuer()],
|
|
scopes_supported: ["openid", "profile", "email", audienceScope],
|
|
bearer_methods_supported: ["header"],
|
|
resource_documentation: `${resource}/`,
|
|
});
|
|
}
|