Skip to content

Authserver DCR integration (Phase 2, Steps 2a-2g) #4978

Description

@jhrozek

Description

Phase 2 of the DCR story (#4976). Wire RFC 7591 Dynamic Client Registration into pkg/authserver/ upstream initialization so an OAuth2 upstream can be configured without a pre-issued client_id.

This issue has been broken into four sub-issues, each targeting a ≤1000 line PR, with CRD changes deferred to the last PR so the operator API evolves only after the authserver plumbing is fully merged and stable.

Sub-Issues

Dependency Chain

#4977 (Phase 1 rename, pkg/oauthproto exists)
  └─► #5037 (discovery fn + authserver config structs)
        └─► #5038 (credential store + resolver)
              └─► #5039 (wiring + logs + integration tests)
                    └─► #5040 (operator CRD surface — CRD changes last)
                          └─► #4979 (Phase 3 persistent backends)

Out of Scope

  • Persistent DCRCredentialStore backends (memory + Redis) — Phase 3, Persistent DCRCredentialStore backends (memory + Redis) #4979.
  • Authserver OTEL metrics + tracing.
  • Automatic re-register on invalid_client at the upstream token endpoint.
  • CLI persistence of registration_client_uri in pkg/auth/remote/config.go.
  • RFC 8707 resource-indicator confirmation for the existing upstream flow.
  • RFC 7592 client_secret rotation via PUT.
  • Provider-specific quirks (login.microsoftonline.com resource param, mcp.zoho.com access_type).
  • Initial access token rotation / refresh.
  • Any change to CommonOAuthConfig.Validate().
  • Any change to pkg/authserver/server/handlers/dcr.go beyond the single log-level upgrade at line 98.

References

  • Parent story: Authserver-driven DCR for upstream OAuth 2.1 MCP servers #4976 — "Authserver-driven DCR for upstream OAuth 2.1 MCP servers".
  • Upstream dependency: Rename pkg/oauth to pkg/oauthproto and relocate DCR primitives #4977 (Phase 1 rename must land first).
  • Downstream consumer: Persistent DCRCredentialStore backends (memory + Redis) #4979 (Phase 3 persistent backends drop in behind the DCRCredentialStore interface).
  • .claude/rules/go-style.md — SPDX headers, copy-before-mutate, drain-response-body, write-durable-first, no-secrets-in-logs, constructor fail-loud validation.
  • .claude/rules/testing.md — testify over t.Fatal, t.Cleanup over defer, no Ginkgo in this area.
  • .claude/rules/pr-creation.md — 400-LOC / 10-file PR cap.
  • CLAUDE.md — always use task (never go test / golangci-lint directly).
  • RFC 7591 (Dynamic Client Registration); RFC 7592 (DCR Management Protocol); RFC 8414 (OAuth 2.0 Authorization Server Metadata); RFC 6749 §5.2 (invalid_client error); RFC 8252 (loopback redirect URIs).

Metadata

Metadata

Assignees

Labels

authenhancementNew feature or requestgoPull requests that update go code

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions