Class McpOAuthPolicy

java.lang.Object
com.mcpdbwizard.pub.McpOAuthPolicy
public final class McpOAuthPolicy extends Object
OAuth 2.1 resource-server behaviour for a generated MCP server: validating access tokens, and telling clients where to get one.

MCP's authorization spec makes a protected server a resource server and nothing more — the authorization server is somebody else's (Entra, Okta, Keycloak, Auth0). So this does the four things the spec requires of that role, and deliberately none of the things it requires of an authorization server:

  1. publish Protected Resource Metadata (RFC 9728) naming the authorization server;
  2. validate the access token's signature against the authorization server's JWKS;
  3. validate that the token was issued for this server (RFC 8707 audience binding) — the requirement that stops a token minted for some other API being replayed here;
  4. answer 401 with a WWW-Authenticate challenge pointing at the metadata, and 403 with error="insufficient_scope" when the token is valid but too weak.

Why a library does the signature check

Verification is delegated to Nimbus rather than hand-rolled. The classic JWT failures — an "alg":"none" token accepted, an HMAC token verified against the public key, expiry never checked, kid ignored — all turn the control silently into a no-op. The accepted algorithms here are declared up front and are asymmetric only, which is what closes the confusion cases. Copyright 2003-2026 ATB Consultancy Services Ltd (formerly Orinda Software Ltd, Dublin, Ireland)

  • Field Details

    • ISSUER_VARIABLE

      public static final String ISSUER_VARIABLE
      Issuer URL of the authorization server that mints tokens for this server.
      See Also:

    • RESOURCE_VARIABLE

      public static final String RESOURCE_VARIABLE
      This server's canonical URI — the audience a token must carry to be accepted here.
      See Also:

    • JWKS_URI_VARIABLE

      public static final String JWKS_URI_VARIABLE
      Optional explicit JWKS URI; derived from the issuer when unset.
      See Also:

    • SCOPES_VARIABLE

      public static final String SCOPES_VARIABLE
      Optional space- or comma-separated scopes a token must carry.
      See Also:

    • METADATA_PATH

      public static final String METADATA_PATH
      Where the metadata document is served, per RFC 9728.
      See Also:

  • Method Details

    • fromEnvironment

      public static McpOAuthPolicy fromEnvironment() throws CSException
      Build from the environment; fails closed if the required variables are absent.
      Throws:
      CSException

    • authorize

      public McpOAuthPolicy.Decision authorize(String theAuthorizationHeader)
      Whether this request carries an acceptable access token.
      Parameters:
      theAuthorizationHeader - the raw Authorization header, or null

    • protectedResourceMetadataJson

      public String protectedResourceMetadataJson()
      The RFC 9728 document, served at METADATA_PATH.

    • metadataUrl

      public String metadataUrl()
      Absolute URL of the metadata document, for the challenge header.