* Fix Azure provider to handle OIDC scopes correctly
OIDC scopes (openid, profile, email, offline_access) were being
incorrectly prefixed with identifier_uri, causing Azure to reject
authorization requests. This fix:
- Detects OIDC scopes and sends them unprefixed to Azure
- Filters OIDC scopes from token validation (Azure doesn't include
them in access token scp claims)
- Still advertises OIDC scopes to clients via valid_scopes
- Also handles dot-notation scopes (e.g., User.Read) correctly
Fixes#2451, #2420
* Fix dot-notation scopes to be prefixed (custom scopes can have dots)
* Improve Azure scope handling docs with clear examples
* Add Discord OAuth provider and corresponding tests
* Update DiscordProvider client_secret and required_scopes documentation
* Add Discord to authentication support list in README
* Fix Discord token verifier to match actual API response format
Discord's /api/oauth2/@me endpoint returns:
- "scopes" as a list, not "scope" as a space-separated string
- "expires" as ISO timestamp, not "expires_in" as seconds
- "user" data directly in the response (no need for extra API call)
* Simplify Discord token verifier
---------
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
* sk-provider updates - aud not enforce, scopes enforce if present
* updating env_prefix, adding debug logs
* updating docs
* ruff formatting
* not changing prefix for backward compatiblity
* backward compatibility changes
* give more preference to base_url than mcp_url if both passed
* updating docs
* refactor
* updating example server
* updating readme of example
* updating docs
* updating tests to reflect what should ideally go in the parameter
Set access_type=offline and prompt=consent by default to ensure
refresh tokens are returned by Google. Also expose extra_authorize_params
so users can customize authorization behavior.
* Update docs for required scopes
* add scopes
* Fix Azure scope validation
Azure returns unprefixed scopes in JWT tokens but requires prefixed scopes in authorization requests. The previous implementation incorrectly validated tokens against prefixed scopes, causing "invalid_token" errors.
Simplified AzureProvider to use standard JWTVerifier with unprefixed scopes for validation. Scopes are only prefixed when building the Azure authorization URL via _build_upstream_authorize_url() override.
Closes#2263
* Checkpoint progress
* Checkpoint progress
* add derive b64 method
* PR clean-up
* refactor da proxy
* Updates to tests
* Make jwt_signing_key required for oauth proxy
* use typing_extensions and fix tests
* PR Cleanup
* also adjust integration tests
* Update docs, use client secret to derive jwt signing key
* You win some you lose some, gg claude
* check for both in derive
* update documentation / clean up
* Update http.mdx
---------
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
* Fix Azure scope mismatch causing MCP client validation errors
The AzureProvider was prefixing scopes during authorization but not in
token validation or Protected Resource Metadata, causing MCP clients to
reject tokens with "Server granted unauthorized scopes".
Changes:
- Prefix required_scopes once during __init__ and use consistently
- Pass prefixed scopes to JWTVerifier for token validation
- PRM now advertises prefixed scopes to MCP clients
- Remove unnecessary idempotent prefixing logic in authorize()
- Update comprehensive documentation explaining scope handling
- Update tests to reflect corrected behavior
Closes#2151
* Clarify that identifier_uri is optional in docstring
* Use anyio as testing backend
* Remove asyncio markers
* Update streamable http tests
* Replace all subprocess tests
* Replace anyio task groups with asyncio context managers in tests
- Convert run_server_async from anyio task group pattern to asyncio.create_task with async context manager
- Remove task_group fixture from conftest
- Update all test fixtures to use async with run_server_async pattern
- Remove TaskGroup imports from all test files
- Tests now work with pytest-asyncio instead of pytest-anyio
* Update test_github_provider_integration.py
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Ravi Madabhushi <ravi.madabhushi@scalekit.com>
Co-authored-by: Ravi Madabhushi <innovativeravi@gmail.com>
Co-authored-by: saif-at-scalekit <saif.shaik@scalekit.com>
