Unconditional `prompt=consent` (when `offline_access` in scope) blocks OAuth in Entra tenants with user consent disabled + admin consent granted
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 1/5
- 预计耗时
- 1 小时以内
- 新手友好度
- 90/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- typescript
调研方向
打开 packages/client/src/client/auth.ts 并检查 startAuthorization，尤其是会附加 prompt=consent 的 offline_access 处理逻辑。移除无条件添加的逻辑，并验证 offline_access 的授权 URL 不再包含 prompt=consent，从而允许已有管理员授权的 Entra 租户在没有同意屏面的情况下返回令牌。
由索引模型根据 Issue 内容生成。
描述
Symptom
packages/client/src/client/auth.ts, in startAuthorization:
if (scope?.split(' ').includes('offline_access')) {
authorizationUrl.searchParams.append('prompt', 'consent');
}
In enterprise Entra tenants where:
- User consent is disabled (Microsoft's recommended default)
- Admin consent granted tenant-wide for the app (AllPrincipals OAuth2PermissionGrant present)
prompt=consent bypasses the existing admin grants and forces Entra to show the consent screen. Non-admin users hit AADSTS90095: Admin consent is required on every reconnect. Unrecoverable, since the admin already consented. Approving the resulting admin-consent request does not change tenant state; the next connect triggers another same consent request.
Verified in our tenant against a Microsoft-hosted MCP server (WorkIQ Mail Tool): manually removing &prompt=consent from the SDK-generated authorize URL and continuing the flow returns tokens immediately, no consent screen. Grants are respected; the SDK-added parameter is the sole blocker.
Repro
Cline (using this SDK): blocks with AADSTS90095:
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize
?response_type=code
&client_id=<redacted>
&redirect_uri=http://127.0.0.1:1456/mcp/oauth/callback
&scope=<resource>/.default+openid+profile+offline_access
&prompt=consent ← added by SDK, sole blocker
&resource=<resource>
The &prompt=consent in this URL is what the SDK code shown above appends. Removing it manually (per the Symptom section above) returns tokens with no consent screen - confirming it as the sole blocker.
Fix
Drop the unconditional add.
Spec basis: OIDC Core §11's prompt=consent obligation is on the authorization server, not the client. §11 notes that prompt=consent "can be used" by the AS - not required to be sent by the client. #681 introduced the client-side add as a defensive measure; the underlying spec doesn't ask for it.
Precedent: Azure CLI, VS Code, and other established OAuth clients requesting offline_access against Entra don't force the prompt=consent parameter client-side and operate correctly in the same enterprise-tenant configuration where this SDK currently breaks.
Downstream clients that want to force re-consent for a specific high-risk flow can add the parameter themselves at the call site.
Impact
Blocks every non-admin end-user in enterprise Entra tenants for any MCP server the client OAuths against.
Related:
- anthropics/claude-code#94804 (client-side symptom report; wrong repo for the fix)
- #1958 (open PR; only de-dupes the parameter, still emits it every time)
- #681 (original PR that introduced this behavior)
- 主要语言
- TypeScript
- 星标
- 13.4k
- 派生
- 2.2k
- 平均合并
- 5 天 3 小时
- 30 天内合并 PR
- 4
环境准备
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
modelcontextprotocol/typescript-sdk 的其他 Issue
-
v2
难度 2/5 1-3 小时 新手友好度 90/100
modelcontextprotocol/typescript-sdk#2861 · 1 条评论 ·
维护者通常 1 天内回复
-
v1 v2
难度 2/5 1-3 小时 新手友好度 70/100
modelcontextprotocol/typescript-sdk#2854 · 1 条评论 ·
维护者通常 1 天内回复
-
v1 v2
难度 2/5 1-3 小时 新手友好度 65/100
modelcontextprotocol/typescript-sdk#2843 · 3 条评论 ·
维护者通常 1 天内回复
-
Auth metadata discovery: fallback URL built on resource host instead of authorization-server host未关闭v1 v2
难度 2/5 1-3 小时 新手友好度 74/100
modelcontextprotocol/typescript-sdk#2784 ·
维护者通常 1 天内回复
-
v1 v2
难度 2/5 1-3 小时 新手友好度 82/100
modelcontextprotocol/typescript-sdk#2783 · 1 条评论 ·
维护者通常 1 天内回复
查看 modelcontextprotocol/typescript-sdk 的全部 Issue
相似的 Issue
-
module-request
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 90/100
appandflow/stim#1604 · 1 条评论 ·
维护者通常 1 天内回复
-
community first-timers-only good first issue hacktoberfest help wanted low hanging fruit up-for-grabs
难度 1/5 1 小时以内 新手友好度 92/100
lingdojo/kana-dojo#31060 · 1 条评论 · 5 个 reaction ·
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 90/100
paperclipai/paperclip#14173 ·
维护者通常 1 天内回复
-
needs-triage
难度 2/5 1-3 小时 新手友好度 85/100
维护者通常 1 天内回复