Module oauth 

OAuth 2.1 JWKS cache, token validation, and token exchange helpers. OAuth 2.1 JWT bearer token validation with JWKS caching.

When enabled, Bearer tokens that look like JWTs (three base64-separated segments with a valid JSON header containing "alg") are validated against a JWKS fetched from the configured Authorization Server. Token scopes are mapped to RBAC roles via explicit configuration.

OAuth 2.1 Proxy

When OAuthConfig::proxy is set, the MCP server acts as an OAuth 2.1 authorization server facade, proxying /authorize and /token to an upstream identity provider (e.g. Keycloak). MCP clients discover this server as the authorization server via Protected Resource Metadata (RFC 9728) and perform the standard Authorization Code + PKCE flow transparently.

Structs

ClientCertConfig

Client certificate paths for mTLS-based client authentication at the token exchange endpoint.

ExchangedToken

Successful response from an RFC 8693 token exchange.

JwksCache

Thread-safe JWKS key cache with automatic refresh.

OAuthConfig

OAuth 2.1 JWT configuration.

OAuthConfigBuilder

Builder for OAuthConfig.

OAuthProxyConfig

Configuration for proxying OAuth 2.1 flows to an upstream identity provider.

OAuthProxyConfigBuilder

Builder for OAuthProxyConfig.

OauthHttpClient

HTTP client used by exchange_token and the OAuth 2.1 proxy handlers (handle_token, handle_introspect, handle_revoke).

RoleMapping

Maps a JWT claim value to an RBAC role name. Used with OAuthConfig::role_claim for non-scope-based role extraction (e.g. Keycloak realm_access.roles, Azure AD roles).

ScopeMapping

Maps an OAuth scope string to an RBAC role name.

TokenExchangeConfig

Configuration for RFC 8693 token exchange.

Enums

JwtValidationFailure

Coarse JWT validation failure classification for auth diagnostics.

Functions

authorization_server_metadata

Build the Authorization Server Metadata JSON response (RFC 8414).

exchange_token

Exchange an inbound access token for a downstream access token via RFC 8693 token exchange.

handle_authorize

Handle GET /authorize - redirect to the upstream authorize URL.

handle_introspect

Handle POST /introspect - RFC 7662 token introspection proxy.

handle_register

Handle POST /register - return the pre-configured client_id.

handle_revoke

Handle POST /revoke - RFC 7009 token revocation proxy.

handle_token

Handle POST /token - proxy the token request to the upstream provider.

looks_like_jwt

Returns true if the token looks like a JWT (3 dot-separated segments where the first segment decodes to JSON containing "alg").

protected_resource_metadata

Build the Protected Resource Metadata JSON response.