Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Unconditional `prompt=consent` (when `offline_access` in scope) blocks OAuth in Entra tenants with user consent disabled + admin consent granted

Abierto Apto para principiantes
  • ¿Algo no está bien?
#2,867 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
1/5
Tiempo estimado
Menos de una hora
Aptitud para principiantes
90/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
typescript
Área
authentication

Línea de trabajo

Abre packages/client/src/client/auth.ts e inspecciona startAuthorization, especialmente el manejo de offline_access que añade prompt=consent. Elimina la adición incondicional y verifica que una URL de autorización para offline_access ya no incluya prompt=consent, lo que permite que los tenants de Entra con concesiones de administrador existentes devuelvan tokens sin una pantalla de consentimiento.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

v1 v2

Symptom

packages/client/src/client/auth.ts, in startAuthorization:

if (scope?.split(' ').includes('offline_access')) {
    authorizationUrl.searchParams.append('prompt', 'consent');
}

In enterprise Entra tenants where:

  • User consent is disabled (Microsoft's recommended default)
  • Admin consent granted tenant-wide for the app (AllPrincipals OAuth2PermissionGrant present)

prompt=consent bypasses the existing admin grants and forces Entra to show the consent screen. Non-admin users hit AADSTS90095: Admin consent is required on every reconnect. Unrecoverable, since the admin already consented. Approving the resulting admin-consent request does not change tenant state; the next connect triggers another same consent request.

Verified in our tenant against a Microsoft-hosted MCP server (WorkIQ Mail Tool): manually removing &prompt=consent from the SDK-generated authorize URL and continuing the flow returns tokens immediately, no consent screen. Grants are respected; the SDK-added parameter is the sole blocker.

Repro

Cline (using this SDK): blocks with AADSTS90095:

https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize
  ?response_type=code
  &client_id=<redacted>
  &redirect_uri=http://127.0.0.1:1456/mcp/oauth/callback
  &scope=<resource>/.default+openid+profile+offline_access
  &prompt=consent   ← added by SDK, sole blocker
  &resource=<resource>

The &prompt=consent in this URL is what the SDK code shown above appends. Removing it manually (per the Symptom section above) returns tokens with no consent screen - confirming it as the sole blocker.

Fix

Drop the unconditional add.

Spec basis: OIDC Core §11's prompt=consent obligation is on the authorization server, not the client. §11 notes that prompt=consent "can be used" by the AS - not required to be sent by the client. #681 introduced the client-side add as a defensive measure; the underlying spec doesn't ask for it.

Precedent: Azure CLI, VS Code, and other established OAuth clients requesting offline_access against Entra don't force the prompt=consent parameter client-side and operate correctly in the same enterprise-tenant configuration where this SDK currently breaks.

Downstream clients that want to force re-consent for a specific high-risk flow can add the parameter themselves at the call site.

Impact

Blocks every non-admin end-user in enterprise Entra tenants for any MCP server the client OAuths against.

Related:

  • anthropics/claude-code#94804 (client-side symptom report; wrong repo for the fix)
  • #1958 (open PR; only de-dupes the parameter, still emits it every time)
  • #681 (original PR that introduced this behavior)
Lenguaje dominante
TypeScript
Estrellas
13.4k
Forks
2.2k
Merge medio
5 d 16 h
PR fusionados (30 d)
5

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de modelcontextprotocol/typescript-sdk

Todos los issues de modelcontextprotocol/typescript-sdk

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.