Tags: jlowin/fastmcp
Tags
Fix Azure provider OIDC scope handling (#2506) * Fix Azure provider to handle OIDC scopes correctly OIDC scopes (openid, profile, email, offline_access) were being incorrectly prefixed with identifier_uri, causing Azure to reject authorization requests. This fix: - Detects OIDC scopes and sends them unprefixed to Azure - Filters OIDC scopes from token validation (Azure doesn't include them in access token scp claims) - Still advertises OIDC scopes to clients via valid_scopes - Also handles dot-notation scopes (e.g., User.Read) correctly Fixes #2451, #2420 * Fix dot-notation scopes to be prefixed (custom scopes can have dots) * Improve Azure scope handling docs with clear examples
Fix Azure scope validation (#2269) * Update docs for required scopes * add scopes * Fix Azure scope validation Azure returns unprefixed scopes in JWT tokens but requires prefixed scopes in authorization requests. The previous implementation incorrectly validated tokens against prefixed scopes, causing "invalid_token" errors. Simplified AzureProvider to use standard JWTVerifier with unprefixed scopes for validation. Scopes are only prefixed when building the Azure authorization URL via _build_upstream_authorize_url() override. Closes #2263
PreviousNext