kKj\_dZddlmZddlmZmZddlZddlmZddl m Z m Z m Z ddl mZddlmZdd lmZdd lmZdd lmZdd lmZeeZd ZGdde ZGddeZy)aOIDC Proxy Provider for FastMCP. This provider acts as a transparent proxy to an upstream OIDC compliant Authorization Server. It leverages the OAuthProxy class to handle Dynamic Client Registration and forwarding of all OAuth flows. This implementation is based on: OpenID Connect Discovery 1.0 - https://openid.net/specs/openid-connect-discovery-1_0.html OAuth 2.0 Authorization Server Metadata - https://datatracker.ietf.org/doc/html/rfc8414 )Sequence)AnyLiteralN) AsyncKeyValue) AnyHttpUrl BaseModelmodel_validator)Self) TokenVerifier) OAuthProxy)UpstreamTokenSet) JWTVerifier) get_logger c eZdZUdZdZeed<dZee zdzed<dZ ee zdzed<dZ ee zdzed<dZ ee zdzed<dZ ee zdzed <dZee zdzed <dZee dzed <dZee dzed <dZee dzed <dZee dzed<dZee dzed<dZee dzed<dZee dzed<dZee dzed<dZee dzed<dZee dzed<dZee dzed<dZee dzed<dZee dzed<dZee dzed<dZee dzed<dZee dzed<dZ ee dzed<dZ!ee dzed<dZ"ee dzed<dZ#ee dzed<dZ$ee zdzed<dZ%ee dzed <dZ&ee dzed!<dZ'edzed"<dZ(edzed#<dZ)edzed$<dZ*edzed%<dZ+ee zdzed&<dZ,ee zdzed'<dZ-ee zdzed(<dZ.ee dzed)<dZ/ee dzed*<dZ0ee zdzed+<dZ1ee dzed,<dZ2ee dzed-<dZ3ee dzed.<dZ4e dzed/<e5d01d2e6fd3Z7e8d4ededzd5e9dzd2e6fd6Z:y)7OIDCConfigurationzOIDC Configuration. See: https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata https://datatracker.ietf.org/doc/html/rfc8414#section-2 TstrictNissuerauthorization_endpointtoken_endpointuserinfo_endpointjwks_uriregistration_endpointscopes_supportedresponse_types_supportedresponse_modes_supportedgrant_types_supportedacr_values_supportedsubject_types_supported%id_token_signing_alg_values_supported(id_token_encryption_alg_values_supported(id_token_encryption_enc_values_supported%userinfo_signing_alg_values_supported(userinfo_encryption_alg_values_supported(userinfo_encryption_enc_values_supported+request_object_signing_alg_values_supported.request_object_encryption_alg_values_supported.request_object_encryption_enc_values_supported%token_endpoint_auth_methods_supported0token_endpoint_auth_signing_alg_values_supporteddisplay_values_supportedclaim_types_supportedclaims_supportedservice_documentationclaims_locales_supportedui_locales_supportedclaims_parameter_supportedrequest_parameter_supportedrequest_uri_parameter_supported require_request_uri_registration op_policy_uri op_tos_urirevocation_endpoint*revocation_endpoint_auth_methods_supported5revocation_endpoint_auth_signing_alg_values_supportedintrospection_endpoint-introspection_endpoint_auth_methods_supported8introspection_endpoint_auth_signing_alg_values_supported code_challenge_methods_supportedsigned_metadataafter)modereturncjsSddtdtddffd }|dd|dd|d d|d d|d |d |d S)zEnforce strict rules.attris_urlrANct|d}|s%d|}tj|t||rt |t ry t |y#t $r+}d|}tj|t||d}~wwxYw)Nz)Missing required configuration metadata: z(Invalid URL for configuration metadata: )getattrloggererror ValueError isinstancer Exception)rCrDvaluemessageeselfs o/Users/ahmed/devFolder/Ultron/claude-voice/.venv/lib/python3.12/site-packages/fastmcp/server/auth/oidc_proxy.pyenforcez2OIDCConfiguration._enforce_strict..enforcezsD$-EEdVL W% ))Zz: 15! 1DTFK W% )q0 1s A B &BB rTrrrrrr )F)rstrbool)rOrQs` rP_enforce_strictz!OIDCConfiguration._enforce_stricttsw{{K 1# 1t 1 1" $($/ $' D!*+)*78 config_urltimeout_secondsci}|||d< tjt|fi|}|j|j }|||d<|j |S#t $rtjd|wxYw)zGet the OIDC configuration for the specified config URL. Args: config_url: The OIDC config URL strict: The strict flag for the configuration timeout_seconds: HTTP request timeout in seconds timeoutrz1Unable to get OIDC configuration for config url: ) httpxgetrRraise_for_statusjsonmodel_validaterKrG exception)clsrVrrW get_kwargsresponse config_datas rPget_oidc_configurationz(OIDCConfiguration.get_oidc_configurations&(  &$3Jy ! yyZ?J?H  % % '"--/K!(. H%%%k2 2    CJ<P    s AA""#B);__name__ __module__ __qualname____doc__rrS__annotations__rrrRrrrrrrrrrrrrr r!r"r#r$r%r&r'r(r)r*r+r,r-r.r/r0r1r2r3r4r5r6r7r8r9r:r;r<r=r>r r rT classmethodintrdrUrPrr#sFD'+FJ t #*6:J,t3:.2NJ$t+215zC'$.5(,Hj3%,59:+d29-1hsmd*159hsmd2959hsmd29268C=4/615(3-$.548Xc]T18BF)8C=4+?FEI,hsmd.BIEI,hsmd.BIBF)8C=4+?FEI,hsmd.BIEI,hsmd.BIHL/#1ELKO2HSMD4HOKO2HSMD4HOBF)8C=4+?FMQ4hsmd6JQ59hsmd29268C=4/6-1hsmd*159:+d2959hsmd2915(3-$.5.2t 2/3337#TD[748$dTk8-1M:#d*1*.J S 4'.48c)D07GK. 0DKRV98C=4;OV6:J,t3:JN18C=43GN =hsmd>R>B$hsmd&:A"&OS4Z&'"#@#04t NQTXj rUrc;(eZdZUdZeed<dddedddddddddddddddddddddddeezd e dzd ed edzd edzd e dzde dzdedzde edzde deezdeezdzdeezdzdedzde edzde dzdeezdzdedzde edzdedzde deeefdzdeeefdzd e dzd!e dzd"e dzd#e d$e d%df:fd&Zd'ed%edzfd(Zd%e fd)Zded e dzd e dzd%efd*Zddddd+dedzd edzde edzd e dzd%e f d,ZxZS)- OIDCProxyaOAuth provider that wraps OAuthProxy to provide configuration via an OIDC configuration URL. This provider makes it easier to add OAuth protection for any upstream provider that is OIDC compliant. Example: ```python from fastmcp import FastMCP from fastmcp.server.auth.oidc_proxy import OIDCProxy # Simple OIDC based protection auth = OIDCProxy( config_url="https://oidc.config.url", client_id="your-oidc-client-id", client_secret="your-oidc-client-secret", base_url="https://your.server.url", ) mcp = FastMCP("My Protected Server", auth=auth) ``` oidc_configNFTr)r client_secretaudiencerWtoken_verifier algorithmrequired_scopesverify_id_tokenresource_base_url issuer_url redirect_pathallowed_client_redirect_urisclient_storagejwt_signing_keytoken_endpoint_auth_methodrequire_authorization_consentconsent_csp_policyforward_resourceextra_authorize_paramsextra_token_params$fallback_access_token_expiry_seconds%fallback_refresh_token_expiry_seconds#fastmcp_access_token_expiry_secondstoken_expiry_threshold_seconds enable_cimdrVr client_idrprqrWrrrsrtrubase_urlrvrwrxryrzr{r|r})rememberexternalr~rrrrrrrrrAc|s td|s td|s |s td| s td|| td| tdt|tr t|}|j ||||_|j j r|j js-tjd|j td |j jrt|j jnd}|!| r|n|}| rdn| }|j|||| }id t|j j d t|j jd |d|d|d|d| d| d| xs| d|j jd|d|d|d|d|d|d||||||d} |r|| d<i}!i}"|r ||!d<||"d<|r|!j||r|"j||!r|!| d<|"r|"| d <t#|<d!i| | |_| r| r| |_|j%| yyy)"uInitialize the OIDC proxy provider. Args: config_url: URL of upstream configuration strict: Optional strict flag for the configuration client_id: Client ID registered with upstream server client_secret: Client secret for upstream server. Optional for PKCE public clients or when using alternative credentials. When omitted, jwt_signing_key must be provided. audience: Audience for upstream server timeout_seconds: Timeout, in seconds, for the OIDC discovery request made during construction. Defaults to 10 seconds so a slow or unreachable issuer cannot block server startup indefinitely. Pass None to fall back to the HTTP client's own default timeout. token_verifier: Optional custom token verifier (e.g., IntrospectionTokenVerifier for opaque tokens). If not provided, a JWTVerifier will be created using the OIDC configuration. Cannot be used with algorithm or required_scopes parameters (configure these on your verifier instead). algorithm: Token verifier algorithm (only used if token_verifier is not provided) required_scopes: Required scopes for token validation (only used if token_verifier is not provided) verify_id_token: If True, verify the OIDC id_token instead of the access_token. Useful for providers that issue opaque (non-JWT) access tokens, since the id_token is always a standard JWT verifiable via the provider's JWKS. base_url: Public URL where OAuth endpoints will be accessible (includes any mount path) resource_base_url: Optional public base URL for the protected resource metadata and token audience. Defaults to ``base_url``. issuer_url: Issuer URL for OAuth metadata (defaults to base_url). Use root-level URL to avoid 404s during discovery when mounting under a path. redirect_path: Redirect path configured in upstream OAuth app (defaults to "/auth/callback") allowed_client_redirect_uris: List of allowed redirect URI patterns for MCP clients. Patterns support wildcards (e.g., "http://localhost:*", "https://*.example.com/*"). If None (default), DCR clients use registered redirect URIs, with loopback ports allowed to vary for MCP compatibility. Unsafe browser schemes are rejected. If empty list, no redirect URIs are allowed. These are for MCP clients performing loopback redirects, NOT for the upstream OAuth app. client_storage: Storage backend for OAuth state (client registrations, encrypted tokens). If None, an encrypted file store will be created in the data directory (derived from `platformdirs`). jwt_signing_key: Secret for signing FastMCP JWT tokens (any string or bytes). If bytes are provided, they will be used as is. If a string is provided, it will be derived into a 32-byte key. If not provided, the upstream client secret will be used to derive a 32-byte key using PBKDF2. token_endpoint_auth_method: Token endpoint authentication method for upstream server. Common values: "client_secret_basic", "client_secret_post", "none". If None, authlib will use its default (typically "client_secret_basic"). require_authorization_consent: Whether to require user consent before authorizing clients (default True). When True, users see a consent screen before being redirected to the upstream IdP. When False, authorization proceeds directly without user confirmation. When "external", the built-in consent screen is skipped but no warning is logged, indicating that consent is handled externally (e.g. by the upstream IdP). SECURITY WARNING: Only set to False for local development or testing environments. consent_csp_policy: Content Security Policy for the consent page. If None (default), uses the built-in CSP policy with appropriate directives. If empty string "", disables CSP entirely (no meta tag is rendered). If a non-empty string, uses that as the CSP policy value. extra_authorize_params: Additional parameters to forward to the upstream authorization endpoint. Useful for provider-specific parameters like prompt=consent or access_type=offline. Example: {"prompt": "consent", "access_type": "offline"} extra_token_params: Additional parameters to forward to the upstream token endpoint. Useful for provider-specific parameters during token exchange. fallback_access_token_expiry_seconds: Expiry time to use when upstream provider doesn't return `expires_in` in the token response. If not set, uses smart defaults: 1 hour if a refresh token is available (since we can refresh), or 1 year if no refresh token (for API-key-style tokens like GitHub OAuth Apps). fallback_refresh_token_expiry_seconds: Expiry time to use when upstream provider doesn't return `refresh_expires_in` (e.g. Cognito, GitHub, many OIDC IdPs). Defaults to 1 year. The actual upstream refresh remains the source of truth — if upstream rejects the refresh, the client gets `invalid_grant` and re-auths. fastmcp_access_token_expiry_seconds: Lifetime for the FastMCP-issued access token (JWT), decoupling it from the upstream provider's `expires_in`. By default (None) the FastMCP access token mirrors the upstream access token lifetime. The FastMCP JWT is a reference token re-validated against upstream on every request, so a longer FastMCP lifetime does not extend upstream access — a revoked or expired upstream session still fails validation. Set this for bridges whose upstream issues short-lived access tokens that some MCP clients can't refresh gracefully (e.g. `mcp-remote`). token_expiry_threshold_seconds: Number of seconds before actual expiry to consider a token as expired (default 0). Prevents race conditions where a token passes the expiry check but expires before the next operation completes. enable_cimd: Whether to enable CIMD (Client ID Metadata Document) client support. When True, clients can use their metadata document URL as client_id instead of Dynamic Client Registration. Default is True. zMissing required config URLzMissing required client idzEither client_secret or jwt_signing_key must be provided. jwt_signing_key is required when client_secret is omitted (e.g., for PKCE public clients).zMissing required base URLNzzCannot specify 'algorithm' when providing a custom token_verifier. Configure the algorithm on your token verifier instead.zCannot specify 'required_scopes' when providing a custom token_verifier. Configure required scopes on your token verifier instead.zInvalid OIDC Configuration: zMissing required OIDC endpointsrsrqrtrWupstream_authorization_endpointupstream_token_endpointupstream_client_idupstream_client_secretupstream_revocation_endpointrrrrvrwservice_documentation_urlryrzr{r|r}r~r)rrrrrrxrqrrrl)rIrJrRrrdrorrrGdebugr7get_token_verifierr.updatesuper__init___verify_id_tokenrtupdate_default_scopes)$rOrVrrrprqrWrrrsrtrurrvrwrxryrzr{r|r}r~rrrrrrrrr7verifier_audienceverifier_scopes init_kwargsfinal_authorize_paramsfinal_token_params __class__s$ rPrzOIDCProxy.__init__sC~:; ;9: :_3  89 9  %$ N* P j# &#J/J66    77##22 LL78H8H7IJ K>? ?33   44 5   !.= ( &5d?O!44#* / / 5N* -s  770*  &s4+;+;+J+J'K * !) * %m *  +,?*  n*  *  !2*  *0*  ()9)9)O)O*  +,H*  n*  * )*D!* " ,-J#* $ !"4%* &  0'* (5Y5Z3V.L&1* 6 +8K (24-/ 19 ": .-5 z * ! " ) )*@ A   % %&8 9 !4JK0 1 0BK, - ';' / #2D  & & 7 /?rUupstream_token_setc|jr4|jjd}|tj d|S|j S)zGet the token to verify from the upstream token set. When verify_id_token is enabled, returns the id_token from the upstream token response instead of the access_token. id_tokenzKverify_id_token is enabled but no id_token found in upstream token response)rraw_token_datar[rGwarning access_token)rOrrs rP_get_verification_tokenz!OIDCProxy._get_verification_tokensM  )88<./ W|8$ |8 t |8|8Tz|8*|8t|8&,|8:|8cT)|8|8"s"#|8$&+d2%|8&$t+'|8(Tz)|8,'+3i$&6-|8.&,/|82ut+3|86%($J7|8:(,g6L.M'M;|8< $J=|8>?|8B!%S#X 5C|8D!cNT1E|8H/2DjI|8J03TzK|8N.14ZO|8R),S|8VW|8X Y|8|/"2/ t/$%d%  t  t    (!%#,0&*  : *  cT)  t    rUrn)rhcollections.abcrtypingrrrZkey_value.aio.protocolsrpydanticrrr typing_extensionsr fastmcp.server.authr fastmcp.server.auth.oauth_proxyr &fastmcp.server.auth.oauth_proxy.modelsr !fastmcp.server.auth.providers.jwtrfastmcp.utilities.loggingrrerGrrrnrlrUrPrs_ % 1;;"-6C90 H  *,&N NbY Y rU