kKj zdZddlmZddlmZddlmZmZddlm Z ddl m Z ddl m Z e eZGdd eZy ) z-Keycloak authentication provider for FastMCP.) annotations) AnyHttpUrl)RemoteAuthProvider TokenVerifier) JWTVerifier) parse_scopes) get_loggerc@eZdZdZdddd dfdZxZS)KeycloakAuthProviderafKeycloak authentication provider using Dynamic Client Registration (DCR). Requires Keycloak 26.6.0 or later, which includes the fix for DCR compatibility with MCP clients (https://github.com/keycloak/keycloak/pull/45309). Example: ```python from fastmcp import FastMCP from fastmcp.server.auth.providers.keycloak import KeycloakAuthProvider auth = KeycloakAuthProvider( realm_url="https://keycloak.example.com/realms/myrealm", base_url="https://my-mcp-server.example.com", ) mcp = FastMCP("My App", auth=auth) ``` N)required_scopesaudiencetoken_verifierc Dt|jd|_| t|ndg}|'t |jd|jd||}t ||t|jgtt|jdy)aInitialize the Keycloak auth provider. Args: realm_url: Keycloak realm URL (e.g., "https://keycloak.example.com/realms/myrealm") base_url: Public URL of this FastMCP server required_scopes: Scopes to require on incoming tokens. Defaults to ["openid"], which ensures the `sub` claim (user identifier) is present in the access token. Override to require additional scopes. audience: Optional audience(s) for JWT validation. Recommended for production. token_verifier: Optional custom token verifier. Defaults to a JWTVerifier configured for Keycloak's JWKS endpoint and issuer. /Nopenidz/protocol/openid-connect/certsRS256)jwks_uriissuer algorithmr r )rauthorization_serversbase_url)strrstrip realm_urlrrsuper__init__r)selfrrr r r parsed_scopes __class__s w/Users/ahmed/devFolder/Ultron/claude-voice/.venv/lib/python3.12/site-packages/fastmcp/server/auth/providers/keycloak.pyrzKeycloakAuthProvider.__init__#s*Y..s3-<-HL )xj   !( NN++IJ~~! -! N )#-dnn#=">H 4 4S 9:  ) rAnyHttpUrl | strrr"r zlist[str] | str | Noner zstr | list[str] | NonerzTokenVerifier | None)__name__ __module__ __qualname____doc__r __classcell__)rs@r r r sO037+//3' $' # ' 0 ' ) ' -' ' r!r N)r& __future__rpydanticrfastmcp.server.authrr!fastmcp.server.auth.providers.jwtrfastmcp.utilities.authrfastmcp.utilities.loggingr r#loggerr r!r r0s13"A9/0 H ; -; r!