Skip to content

fix(mcp): request openid scope on interactive OIDC so downstream APIs accept the token #1091

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Aaron ("AJ") Steers (aaronsteers) merged 4 commits into from
Jul 24, 2026
Merged

fix(mcp): request openid scope on interactive OIDC so downstream APIs accept the token #1091

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0931e36
fix(mcp): request openid scope on interactive OIDC so downstream APIs…
devin-ai-integration[bot] Jul 24, 2026
fa5cfd8
fix(mcp): always include openid even when scopes are overridden
devin-ai-integration[bot] Jul 24, 2026
06f219f
refactor(mcp): rename DEFAULT_OIDC_SCOPES to AIRBYTE_CLOUD_REQUIRED_O…
devin-ai-integration[bot] Jul 24, 2026
4ca28e5
refactor(mcp): drop AIRBYTE_MCP_OIDC_SCOPES override, hardcode openid…
devin-ai-integration[bot] Jul 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions airbyte/mcp/server.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,6 +142,12 @@
OIDC_CLIENT_SECRET_ENV = "AIRBYTE_MCP_OIDC_CLIENT_SECRET"
OIDC_CONFIG_URL_ENV = "AIRBYTE_MCP_OIDC_CONFIG_URL"

# Upstream authorize scopes requested for the interactive OIDC flow, also
# advertised to clients via DCR/`.well-known` and enforced on the verified
# upstream token. `openid` is required for OIDC: without it the IdP may issue an
# identity-only token that downstream APIs reject.
AIRBYTE_CLOUD_REQUIRED_OIDC_SCOPES: str = "openid email profile"

# Headless JWT verifier. A signing-key source (`JWKS_URI_ENV` or
# `JWT_PUBLIC_KEY_ENV`) activates it; issuer/audience/algorithm refine it.
JWKS_URI_ENV = "AIRBYTE_MCP_AUTH_JWKS_URI"
Expand Down Expand Up @@ -278,6 +284,7 @@ def _create_auth() -> AuthProvider | None:
client_id=oidc_client_id,
client_secret=oidc_client_secret,
base_url=base_url,
required_scopes=AIRBYTE_CLOUD_REQUIRED_OIDC_SCOPES.split(),
client_storage=_resolve_client_storage(encryption_source_material=oidc_client_secret),
)

Expand Down
3 changes: 3 additions & 0 deletions tests/unit_tests/test_mcp_auth.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,6 +185,9 @@ def test_create_auth_activates_oidc_when_credentials_present(
assert oidc.client_id == "cid"
assert oidc.client_secret == "csecret"
assert oidc.config_url == "https://idp.example/.well-known"
# `openid` must be requested upstream, else the IdP may issue an
# identity-only token that downstream APIs reject.
assert oidc.required_scopes == ["openid", "email", "profile"]
Comment thread
aaronsteers marked this conversation as resolved.
# No storage factory configured -> in-memory default.
assert oidc.client_storage is None

Expand Down
Loading