Incorrect constructor for OAuth metadata URL #700

Activity

1. localden

   added

   bugSomething isn't workingSomething isn't working

   on Aug 12, 2025
2. sberyozkin commented on Aug 20, 2025

   

   sberyozkin

   on Aug 20, 2025

   Last edited by sberyozkin

   More actions

   MCP inspector seems to do it correctly per the protected resource metadata spec - sorry, my comment may be out of context, I thought you were referring to the resource idenitifier...
3. pcarleton commented on Aug 22, 2025

   

   pcarleton

   on Aug 22, 2025

   Member

   More actions

   The eternal debate 😭

   we've spelled it out in the draft spec here now that we support openid:
   https://modelcontextprotocol.io/specification/draft/basic/authorization#server-metadata-discovery

   For issuer URLs with path components (e.g., https://auth.example.com/tenant1), clients MUST try endpoints in the following priority order:

   1. OAuth 2.0 Authorization Server Metadata with path insertion: https://auth.example.com/.well-known/oauth-authorization-server/tenant1
   2. OpenID Connect Discovery 1.0 with path insertion: https://auth.example.com/.well-known/openid-configuration/tenant1
   3. OpenID Connect Discovery 1.0 path appending: https://auth.example.com/tenant1/.well-known/openid-configuration

   and then OAuth Metadata RFC 8414 (emphasis mine):

   Authorization servers supporting metadata MUST make a JSON document
   containing metadata as specified in Section 2 available at a path
   formed by inserting a well-known URI string into the authorization
   server's issuer identifier between the host component and the path
   component, if any. By default, the well-known URI string used is
   "/.well-known/oauth-authorization-server". This path MUST use the
   "https" scheme. The syntax and semantics of ".well-known" are
   defined in RFC 5785 [RFC5785]. The well-known URI suffix used MUST
   be registered in the IANA "Well-Known URIs" registry
   [IANA.well-known].

   Sticking it on the end is the "openid way", inserting it at the root is the OAuth metadata way.

   in general, Inspector uses the typescript SDK, so if we do want to change any of this, it will need to be fixed there.
4. olaservo

   added

   authIssues and PRs related to authorizationIssues and PRs related to authorization

   on Aug 23, 2025
5. olaservo

   marked Incorrect contructor for Okta Custom Authorization Server OAuth metadata URL #744 as a duplicate of this issue on Aug 23, 2025
6. olaservo commented on Aug 23, 2025

   

   olaservo

   on Aug 23, 2025

   Member

   More actions

   Should this be kept open as an Inspector bug, if this is behaving as expected according to the SDK?
7. olaservo

   added

   waiting on submitterWaiting for the submitter to provide more infoWaiting for the submitter to provide more info

   on Aug 23, 2025
8. olaservo commented on Oct 13, 2025

   

   olaservo

   on Oct 13, 2025

   Member

   More actions

   There hasn't been any activity on this issue for a while so I'm going to close it, since it seems to be expected behavior. Please feel free to re-open if we think it should be a bug. Thanks!
9. olaservo

   closed this as not plannedon Oct 13, 2025