ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-09 07:09:11 +02:00
Code Issues Projects Releases Packages Wiki Activity

Keep ID-JAG audience on base_url, out of scope for issuer identity

Browse source
This commit is contained in:
Jeremiah Lowin 2026-07-26 17:48:01 -04:00
commit 98ac0402df
No known key found for this signature in database
4 changed files with 39 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

11
tests/server/auth/test_issuer_url_identity.py
View file

@ -200,12 +200,17 @@ class TestOAuthProxyIssuerIdentity:
@pytest.mark.parametrize(
"issuer_url, expected",
[(ISSUER_URL, ISSUER), (None, BASE_URL_ISSUER)],
[(ISSUER_URL, BASE_URL_ISSUER), (None, BASE_URL_ISSUER)],
)
def test_identity_assertion_audience_is_issuer_identifier(
def test_identity_assertion_audience_stays_on_base_url(
self, issuer_url: str | None, expected: str
):
"""SEP-990: an ID-JAG is bound to the server's advertised issuer."""
"""The ID-JAG audience is intentionally not moved to issuer_url.
Changing it would reject assertions an IdP is already minting, and the
operator could only recover by reconfiguring the IdP. Tracked as
separate work from the issuer identity fix.
"""
proxy = OAuthProxy(
upstream_authorization_endpoint="https://upstream.example.com/authorize",
upstream_token_endpoint="https://upstream.example.com/token",