feat: Add audience support during authorization #1752
Closed
+108
−11
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
marvin-context-protocol
bot
added
enhancement
|
I hit this issue with Auth0 too, so +1 for this. It'd be nice if it just worked automatically. FYI, if anyone else hits this. I worked around it by setting |
|
I don't like that this PR introduces a very tight but implicit coupling between the OAuthProxy and the TokenValidator, especially because the outcome sounds like it's highly vendor-specific. I'll open a PR to permit users to pass custom kwargs to the authorize call! |
jlowin
added a commit
that referenced
this pull request
Sep 6, 2025
Improves on #1752 by providing a cleaner, more flexible approach for forwarding provider-specific parameters. Instead of tightly coupling to token verifier attributes, this adds explicit configuration for extra parameters. - Add extra_authorize_params and extra_token_params configuration - Forward RFC 8707 resource parameter from AuthorizationParams - Remove tight coupling to token verifier internals - Add comprehensive tests for parameter forwarding
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Adds support for passing the audience to the upstream provider if it was specified on the token verifier. This is necessary when using a provider like
Auth0that requires audience scoping for the tokens.This was manually tested via
MCP Inspectoragainst anAuth0app for the positive case, and aGitHubapp for the negative case.This can be considered a smaller peer change to the recent PKCE forwarding changes (#1733).
Contributors Checklist
Review Checklist