Authorization server: narrow a JWT-bearer access token to one MCP call with authorization_details

Aperta
  • Qualcosa non va?
#7,061 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
go
Ambito
api, authentication, security

Direzione di ricerca

Start at the authorization server’s RFC 7523 JWT-bearer grant handling and token issuance path; the issue does not name files or tests. Read RFC 9396 and the linked #6886, #6887, and #7030 for the surrounding requirements, then trace how client token lifetimes are configured. Done means the acceptance cases pass, including rejection reasons, narrowing, per-client lifetime, and unchanged behavior without authorization_details.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

needs-triage

Part of #6886. Related: #6887 (returns the granted authorization_details in the token response; does not accept or narrow a request), #6909, #6910, #6912.

Problem: a client that redeems an ID-JAG at the gateway's authorization server (RFC 7523 JWT-bearer grant) gets an access token good for any call to the resource until it expires. A client that sends tool calls on behalf of a separate, more trusted authorizer (Mecatl: the harness sends the call, its identity broker authorizes it and redeems the ID-JAG) should hold a token that serves only the call the authorizer approved. Today the token cannot be narrowed to one call.

Today: the server already parses the authorization_details entry, but keeps it out of the issued JWT.

Change: on the JWT-bearer grant, accept an RFC 9396 authorization_details request with one entry of a new type, and copy it into the issued access token.

  • Entry type https://toolhive.dev/mcp_tool_call, one of:
    • a tool call: server, tool (the name the vMCP routes by, as in params.name), arguments_sha256 (lowercase hex SHA-256 of the RFC 8785 serialization of params.arguments, or of {} when absent), operation_id;
    • a list call: server, method (tools/list or another list method).
  • Narrowing only: the entry can only restrict the token, never widen what the grant, client, or resource would otherwise allow. Exactly one entry; a malformed entry, an unknown field, or more than one entry is refused with invalid_authorization_details (RFC 9396 §5).
  • In the token: the entry is copied unchanged into the access token's authorization_details claim, and returned in the token response (with #6887).
  • Lifetime per client: a configurable access-token lifetime for a client (here, Mecatl's mecatl client), so these tokens can live seconds while other clients keep the default.
  • Reason code: refusals carry a reason code in error_description, in the grammar of #7030.

Acceptance:

  • a JWT-bearer redemption with a valid tool-call or list-call entry returns a token whose authorization_details equals the requested entry;
  • a malformed entry, two entries, or an unknown type is refused with invalid_authorization_details and its reason;
  • the entry never adds a resource, scope, or audience the redemption would not otherwise grant;
  • a client with a configured lifetime gets tokens with that lifetime; other clients are unaffected;
  • a redemption without authorization_details behaves exactly as today.

Context: Mecatl agent identity design, credentials-and-lifecycle.md step (8) ("The argument hash") and implementation.md "ToolHive work list". Tracked in stacklok/mecatl#2570 (phase 2).

Lingua principale
Go
Stelle
2.3k
Fork
326
Merge medio
1g 53m
PR unite (30g)
155

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di stacklok/toolhive

Tutte le issue di stacklok/toolhive

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.