fix the authorization resource for EXTERNAL_OAUTH21_PROVIDER=true - #401
fix the authorization resource for EXTERNAL_OAUTH21_PROVIDER=true#401ryohang wants to merge 4 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
This PR fixes OAuth 2.1 configuration for external provider mode by properly implementing Resource Server behavior that points to Google's Authorization Server.
Changes:
- Modified ExternalOAuthProvider to act as a Resource Server with metadata endpoints pointing to Google
- Updated server configuration to enable OAuth validation at the protocol level
- Enhanced documentation explaining Resource Server vs Authorization Server roles
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| core/server.py | Enabled protocol-level auth and updated logging to reflect Resource Server configuration |
| auth/external_oauth_provider.py | Added get_routes() method and resource_server_url parameter to create protected resource metadata |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
@copilot open a new pull request to apply changes based on the comments in this thread |
|
I updated according to the comments |
|
I don't see any new commits? |
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
sorry, I was not too familiar with the process, just submitted. |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| self._client_id = client_id | ||
| self._client_secret = client_secret | ||
| if self._resource_server_url: | ||
| self.resource_server_url = AnyHttpUrl(self._resource_server_url) |
There was a problem hiding this comment.
The AnyHttpUrl constructor expects a URL string but is being called like a function. Use Pydantic's validation pattern: self.resource_server_url = AnyHttpUrl.validate(self._resource_server_url) or directly assign the string and let Pydantic handle validation through field typing.
| self.resource_server_url = AnyHttpUrl(self._resource_server_url) | |
| self.resource_server_url = AnyHttpUrl.validate(self._resource_server_url) |
| # Create protected resource routes that point to Google as the authorization server | ||
| protected_routes = create_protected_resource_routes( | ||
| resource_url=self.resource_server_url, | ||
| authorization_servers=[AnyHttpUrl(GOOGLE_ISSUER_URL)], |
There was a problem hiding this comment.
The AnyHttpUrl constructor is being misused. Either use AnyHttpUrl.validate(GOOGLE_ISSUER_URL) or pass the string directly if the function expects URL strings, not Pydantic types.
| authorization_servers=[AnyHttpUrl(GOOGLE_ISSUER_URL)], | |
| authorization_servers=[AnyHttpUrl.validate(GOOGLE_ISSUER_URL)], |
Summary
Fixes the authorization resource metadata for EXTERNAL_OAUTH21_PROVIDER=true mode to properly act as a Resource Server that points to Google's Authorization Server.
Problem
When using external OAuth mode (where access tokens are issued by external systems), the MCP server was not properly advertising its role as a Resource Server or pointing to the correct Authorization Server.
Changes
Enhanced ExternalOAuthProvider to implement proper Resource Server behavior:
Changed from server.auth = None to server.auth = provider to enable OAuth validation
Added clearer logging to indicate protected resource metadata setup
not sure about Version bump: 1.7.1 → 1.8.0 . please advise