Skip to content

Conversation

zhaohuabing
Copy link
Contributor

@zhaohuabing zhaohuabing commented Sep 28, 2025

According to the RFC 8414, if the issuer identifier value contains a path component, the well-known URI must include that path as a suffix.
For example, if the issuer identifier is https://example.com/issuer1, then the OAuth 2.0 Authorization Server Metadata URL should be:

https://example.com/.well-known/oauth-authorization-server/issuer1

In practice, however, some implementations diverge from the spec and either:

  • place the discovery document directly at the domain root, or
  • use a suffixed form of the well-known URI.

This PR updates the agent to try all three variants in the following order, improving interoperability across different authorization server implementations:

  1. Suffixed well-known URI (https://example.com/.well-known/oauth-authorization-server/issuer1)
  2. Prefixed/custom-path well-known URI (https://example.com/issuer1/.well-known/oauth-authorization-server)
  3. Domain root well-known URI (https://example.com/.well-known/oauth-authorization-server)

Implements: #403

Motivation and Context

How Has This Been Tested?

Breaking Changes

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update

Checklist

  • I have read the MCP Documentation
  • My code follows the repository's style guidelines - not sure about this - happy to make any updates as needed.
  • New and existing tests pass locally
  • I have added appropriate error handling
  • I have added or updated documentation as needed - not sure about this - happy to make any updates as needed.

Additional context

Caveat: I'm new to Rust development. If this PR is missing something or doesn't follow best practices, please let me know. I'm happy to make any updates.

@zhaohuabing zhaohuabing marked this pull request as draft September 28, 2025 09:02
@github-actions github-actions bot added T-core Core library changes T-transport Transport layer changes labels Sep 28, 2025
@zhaohuabing zhaohuabing changed the title support suffixed and preffixed well-knonw paths auth: support well-known paths at domain root, with prefixes, and with suffixes Sep 28, 2025
@zhaohuabing zhaohuabing force-pushed the fix-well-known-oauth-paths branch from 47a435f to cc1447c Compare September 28, 2025 09:35
@zhaohuabing zhaohuabing marked this pull request as ready for review September 29, 2025 02:05
@zhaohuabing zhaohuabing changed the title auth: support well-known paths at domain root, with prefixes, and with suffixes auth: support well-known paths at domain root, with prefix path, and with suffix path Sep 29, 2025
@zhaohuabing zhaohuabing force-pushed the fix-well-known-oauth-paths branch from cc1447c to 82856a6 Compare September 29, 2025 02:53
@zhaohuabing zhaohuabing force-pushed the fix-well-known-oauth-paths branch from 82856a6 to 2356ffa Compare September 29, 2025 03:26
Copy link
Collaborator

@jokemanfire jokemanfire left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, LGTM

@jokemanfire jokemanfire merged commit 0566d13 into modelcontextprotocol:main Sep 30, 2025
9 of 11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
T-core Core library changes T-transport Transport layer changes
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants