ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-21 21:14:17 +02:00
Code Issues Projects Releases Packages Wiki Activity

fix: use identifier_uri as audience for Azure token validation (#3787)

Browse source 
* fix: use identifier_uri as audience for Azure token validation

* fix test expectations for identifier_uri audience
This commit is contained in:
Jeremiah Lowin 2026-04-07 18:37:52 -04:00 • committed by GitHub
commit 2b9d3eee0f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/fastmcp/server/auth/providers/azure.py
View file

@ -220,7 +220,7 @@ class AzureProvider(OAuthProxy):
token_verifier = JWTVerifier(
jwks_uri=jwks_uri,
issuer=issuer,
audience=client_id,
audience=self.identifier_uri,
algorithm="RS256",
required_scopes=validation_scopes, # Only validate non-OIDC scopes
http_client=http_client,
@ -627,7 +627,7 @@ class AzureJWTVerifier(JWTVerifier):
super().__init__(
jwks_uri=f"https://{base_authority}/{tenant_id}/discovery/v2.0/keys",
issuer=issuer,
audience=client_id,
audience=self._identifier_uri,
algorithm="RS256",
required_scopes=required_scopes,
)

2
tests/server/auth/providers/test_azure.py
View file

@ -211,7 +211,7 @@ class TestAzureProvider:
"https://login.microsoftonline.com/my-tenant/discovery/v2.0/keys"
)
assert verifier.issuer == "https://login.microsoftonline.com/my-tenant/v2.0"
assert verifier.audience == "test_client"
assert verifier.audience == "api://my-api"
# Scopes are stored unprefixed for token validation
# (Azure returns unprefixed scopes like ".default" in JWT tokens)
assert verifier.required_scopes == [".default"]

4
tests/server/auth/providers/test_azure_scopes.py
View file

@ -413,7 +413,7 @@ class TestAzureJWTVerifier:
== "https://login.microsoftonline.com/my-tenant-id/discovery/v2.0/keys"
)
assert verifier.issuer == "https://login.microsoftonline.com/my-tenant-id/v2.0"
assert verifier.audience == "my-client-id"
assert verifier.audience == "api://my-client-id"
assert verifier.algorithm == "RS256"
assert verifier.required_scopes == ["access_as_user"]
@ -431,7 +431,7 @@ class TestAzureJWTVerifier:
token = key_pair.create_token(
subject="test-user",
issuer="https://login.microsoftonline.com/my-tenant-id/v2.0",
audience="my-client-id",
audience="api://my-client-id",
additional_claims={"scp": "access_as_user"},
)
result = await verifier.load_access_token(token)