feat: Add Enterprise Managed Authorization (SEP-990) support by prachi-okta · Pull Request #1 · prachi-okta/java-sdk

prachi-okta · 2026-03-02T05:38:50Z

Address PR review comments for Enterprise Managed Authorization (SEP-990)

Changes

EnterpriseAuth.java

Added encodeParam(key, value) utility method to replace inline encode(k) + "=" + encode(v) calls
Extracted validateJAGTokenExchangeResponse() method for JAG response validation
Relaxed token_type validation: removed strict "N_A" check per RFC 8693 §2.2.1 — token_type is informational when the issued token is not an access token; strict checking rejects conformant IdPs
Switched exchangeJwtBearerGrant to client_secret_basic: credentials now sent via Authorization: Basic header instead of request body, aligning with TypeScript SDK and SEP-990 conformance requirements
Added code comment explaining why refresh_token is intentionally ignored (RFC 7523 is stateless by design; using a refresh token would bypass IdP session/revocation policies)
Added code comment explaining the idpTokenEndpoint shortcut (skips RFC 8414 discovery when endpoint is already known)

DiscoverAndRequestJwtAuthGrantOptions.java

Now extends RequestJwtAuthGrantOptions, eliminating duplicated fields

EnterpriseAuthProvider.java

Renamed EXPIRY_BUFFER → TOKEN_EXPIRY_BUFFER for consistency
Added code comment explaining that the ID-JAG is not cached by the provider; callers can cache it in their assertionCallback to reduce IdP round-trips

ExchangeJwtBearerGrantOptions.java / JagTokenExchangeResponse.java

Updated Javadoc to reflect client_secret_basic auth method and relaxed token_type semantics

EnterpriseAuthTest.java

Added full unit test coverage for EnterpriseAuthProvider: header injection, token caching, cache invalidation, proactive expiry refresh, tokens without expires_in, discovery failure, assertion callback errors
Updated exchangeJwtBearerGrant test to assert Authorization: Basic header
Replaced wrongTokenType_emitsError test with nonStandardTokenType_succeeds to verify leniency

…ol#827) - Small javaformat fixes - Closes modelcontextprotocolgh-827 Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>

- The server-servlet app depends on mcp, which must be either installed or included in the compile artifact for `mvn exec:java` to pick it up. - Change the build instructions to build from root, use a `-pl` flag to target the servlet app. - Disable the exec plugin from the root pom. Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>

Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>

Clients can now subscribe to specific resources and receive targeted notifications when those resources change. Previously, calling `notifyResourceUpdated` on the server would broadcast the notification to every connected client regardless of interest — now only sessions that have explicitly subscribed to a given resource URI receive the update, making resource change propagation both correct and efficient. The subscription lifecycle is fully handled: clients can subscribe and unsubscribe at any time, and the server cleans up subscription state when a session closes. Supersedes modelcontextprotocol#838. Resolves modelcontextprotocol#837, modelcontextprotocol#776. --------- Signed-off-by: Dariusz Jędrzejczyk <dariusz.jedrzejczyk@broadcom.com>

…extprotocol#826) Also add a test simulating a different locale in an isolated process. Resolves modelcontextprotocol#295

Signed-off-by: Dariusz Jędrzejczyk <dariusz.jedrzejczyk@broadcom.com>

…odelcontextprotocol#843) Signed-off-by: Christian Tzolov <christian.tzolov@broadcom.com>

…ngle CPU (modelcontextprotocol#854) Signed-off-by: Dariusz Jędrzejczyk <dariusz.jedrzejczyk@broadcom.com>

…contextprotocol#861) HttpClientStreamHttpTransport: add authorization error handler - Closes modelcontextprotocol#240 Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>

…otocol#863) - Fix malformed SCM developerConnection URL (slash → colon) across all modules - Add mcp-json-jackson3 to mcp-bom dependency management - Update license URL to HTTPS - Fix POM's scm definitions Signed-off-by: Christian Tzolov <christian.tzolov@broadcom.com> Signed-off-by: Christian Tzolov <christian.tzolov@broadcom.com> --------- Signed-off-by: Christian Tzolov <christian.tzolov@broadcom.com>

Signed-off-by: Christian Tzolov <christian.tzolov@broadcom.com>

prasenjit-karmakar · 2026-03-13T12:42:44Z

mcp-core/src/main/java/io/modelcontextprotocol/client/auth/EnterpriseAuth.java

+	public static Mono<String> requestJwtAuthorizationGrant(RequestJwtAuthGrantOptions options, HttpClient httpClient) {
+		return Mono.defer(() -> {
+			List<String> params = new ArrayList<>();
+			params.add(encode("grant_type") + "=" + encode(GRANT_TYPE_TOKEN_EXCHANGE));


nit: We can have a utility method here to encode and append with "=" as well

Done. added a private encodeParam(String key, String value) helper that returns encode(key) + "=" + encode(value). Both requestJwtAuthorizationGrant and exchangeJwtBearerGrant now use it.

prasenjit-karmakar · 2026-03-13T12:42:55Z

mcp-core/src/main/java/io/modelcontextprotocol/client/auth/EnterpriseAuth.java

+			HttpClient httpClient) {
+		return Mono.defer(() -> {
+			List<String> params = new ArrayList<>();
+			params.add(encode("grant_type") + "=" + encode(GRANT_TYPE_JWT_BEARER));


nit: We can have a utility method here to encode and with "=" append as well

Done. added a private encodeParam(String key, String value) helper that returns encode(key) + "=" + encode(value). Both requestJwtAuthorizationGrant and exchangeJwtBearerGrant now use it.

prasenjit-karmakar · 2026-03-13T12:43:16Z

...src/main/java/io/modelcontextprotocol/client/auth/DiscoverAndRequestJwtAuthGrantOptions.java

+ *
+ * @author MCP SDK Contributors
+ */
+public class DiscoverAndRequestJwtAuthGrantOptions {


Can it not just extend RequestJwtAuthGrantOptions ?

Done. DiscoverAndRequestJwtAuthGrantOptions now extends RequestJwtAuthGrantOptions. The duplicated fields were removed and the nested Builder extends RequestJwtAuthGrantOptions.Builder, with idpTokenEndpoint mapped directly to the inherited tokenEndpoint.

prasenjit-karmakar · 2026-03-13T12:43:34Z

mcp-core/src/main/java/io/modelcontextprotocol/client/auth/EnterpriseAuthProvider.java

+	 * Proactive refresh buffer: treat a token as expired this many seconds before its
+	 * actual expiry to avoid using a token that expires mid-flight.
+	 */
+	private static final Duration EXPIRY_BUFFER = Duration.ofSeconds(30);


Can we rename EXPIRY_BUFFER to EXPIRY_BUFFER_IN_SEC or something ?

Added the TOKEN_ prefix instead for consistency with the other constants TOKEN_EXPIRY_BUFFER.

prasenjit-karmakar · 2026-03-13T12:46:58Z

mcp-core/src/main/java/io/modelcontextprotocol/client/auth/EnterpriseAuth.java

+				if (!TOKEN_TYPE_ID_JAG.equalsIgnoreCase(tokenResponse.getIssuedTokenType())) {
+					return Mono.error(new EnterpriseAuthException("Unexpected issued_token_type in JAG response: "
+							+ tokenResponse.getIssuedTokenType() + " (expected " + TOKEN_TYPE_ID_JAG + ")"));
+				}
+				if (!"N_A".equalsIgnoreCase(tokenResponse.getTokenType())) {
+					return Mono.error(new EnterpriseAuthException("Unexpected token_type in JAG response: "
+							+ tokenResponse.getTokenType() + " (expected N_A per RFC 8693 §2.2.1)"));
+				}
+				if (tokenResponse.getAccessToken() == null || tokenResponse.getAccessToken().isBlank()) {
+					return Mono
+						.error(new EnterpriseAuthException("JAG token exchange response is missing access_token"));
+				}


nit: We may extract to validateJAGTokenExchangeResponse

Done. the validation block is extracted into a private validateJAGTokenExchangeResponse(JagTokenExchangeResponse) method.

prasenjit-karmakar · 2026-03-13T17:24:46Z

mcp-core/src/main/java/io/modelcontextprotocol/client/auth/EnterpriseAuthProvider.java

+ *                 DiscoverAndRequestJwtAuthGrantOptions.builder()
+ *                     .idpUrl(ctx.getAuthorizationServerUrl().toString())
+ *                     .idToken(myIdTokenSupplier.get())
+ *                     .clientId("idp-client-id")


Don't we need to pass client_secret here for ID_JAG exchange ?

updated to include .clientSecret("idp-client-secret")

prasenjit-karmakar · 2026-03-13T17:28:30Z

mcp-core/src/main/java/io/modelcontextprotocol/client/auth/EnterpriseAuth.java

+		if (options.getIdpTokenEndpoint() != null) {
+			tokenEndpointMono = Mono.just(options.getIdpTokenEndpoint());
+		}


Is this to handle a case where IDP authorization server metadata is already discovered in a separate step ?

Yes so if the caller has already performed RFC 8414 discovery (or simply knows the IdP token endpoint ahead of time), they can set idpTokenEndpoint to skip the discovery round-trip

prasenjit-karmakar · 2026-03-13T17:33:27Z

mcp-core/src/main/java/io/modelcontextprotocol/client/auth/EnterpriseAuthProvider.java

+			return options.getAssertionCallback().apply(assertionContext).flatMap(assertion -> {
+				ExchangeJwtBearerGrantOptions exchangeOptions = ExchangeJwtBearerGrantOptions.builder()
+					.tokenEndpoint(metadata.getTokenEndpoint())
+					.assertion(assertion)


Can it happen that the Access Token from the resource server is expired , but the ID-JAG from IDP for the resource server is still valid and the same can be reused while exchanging access token from a resource server ?

Yes, it can
The ID-JAG may outlive the access token depending on the IdP's configuration. EnterpriseAuthProvider intentionally does not cache the JAG itself - each access token refresh calls the assertionCallback to get a fresh JAG. If callers want to avoid the extra IdP round-trip, they can implement JAG caching inside their own assertionCallback

prasenjit-karmakar · 2026-03-13T17:36:28Z

mcp-core/src/main/java/io/modelcontextprotocol/client/auth/EnterpriseAuthProvider.java

+ * @see EnterpriseAuth
+ * @see EnterpriseAuthProviderOptions
+ */
+public class EnterpriseAuthProvider implements McpAsyncHttpClientRequestCustomizer {


Can we write unit tests for this as well ?

prasenjit-karmakar · 2026-03-13T17:42:12Z

mcp-core/src/main/java/io/modelcontextprotocol/client/auth/EnterpriseAuth.java

+				JwtBearerAccessTokenResponse tokenResponse = mapper.readValue(response.body(),
+						JwtBearerAccessTokenResponse.class);
+
+				if (tokenResponse.getAccessToken() == null || tokenResponse.getAccessToken().isBlank()) {


Can we assume that the resource authorization server will never return a refresh token here ? And if it happens , does in increase security risk ?

RFC 7523 is a stateless grant so no refresh token is involved by design, so we don't expect one. If the AS returns one anyway, we ignore it, since using it would let the client skip re-validating the user's identity with the IdP and bypass session/revocation policies. Added a code comment for this.

prasenjit-karmakar

LGTM, One Minor comment

mcp-core/src/test/java/io/modelcontextprotocol/client/auth/EnterpriseAuthTest.java

…P-990)

Kehrlann and others added 11 commits March 2, 2026 11:33

Client Auth Conformance Tests - change parent POM (modelcontextprotoc…

81a18ed

…ol#827) - Small javaformat fixes - Closes modelcontextprotocolgh-827 Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>

Bump spring-javaformat 0.0.43 -> 0.0.47

ce2c747

Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>

Use explicit UTF-8 charset in StdioServerTransportProvider (modelcont…

05f37ad

…extprotocol#826) Also add a test simulating a different locale in an isolated process. Resolves modelcontextprotocol#295

Update dependabot PR labels

ed02736

Signed-off-by: Dariusz Jędrzejczyk <dariusz.jedrzejczyk@broadcom.com>

Document resource subscription support in server and client guides (m…

26304a7

…odelcontextprotocol#843) Signed-off-by: Christian Tzolov <christian.tzolov@broadcom.com>

Fix elicitation and resource subscription tests that deadlock on a si…

6e4ce1c

…ngle CPU (modelcontextprotocol#854) Signed-off-by: Dariusz Jędrzejczyk <dariusz.jedrzejczyk@broadcom.com>

HttpClientStreamHttpTransport: add authorization error handler (model…

abcd19c

…contextprotocol#861) HttpClientStreamHttpTransport: add authorization error handler - Closes modelcontextprotocol#240 Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>

Next development version

cbb235f

Signed-off-by: Christian Tzolov <christian.tzolov@broadcom.com>

prasenjit-karmakar reviewed Mar 13, 2026

View reviewed changes

prasenjit-karmakar approved these changes Mar 16, 2026

View reviewed changes

mcp-core/src/test/java/io/modelcontextprotocol/client/auth/EnterpriseAuthTest.java Outdated Show resolved Hide resolved

prachi-okta added 3 commits March 17, 2026 00:31

feat: Add Enterprise Managed Authorization (SEP-990) support

665ed51

Address PR review comments for enterprise managed authorization

443e6e5

Split EnterpriseAuthProvider tests into separate test class

649a426

prachi-okta force-pushed the feature/enterprise-managed-authorization branch from 26a6fc6 to 649a426 Compare March 16, 2026 19:01

Add auth/cross-app-access-complete-flow to JDK conformance client (SE…

20c5628

…P-990)

Conversation

prachi-okta commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

prasenjit-karmakar left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

prachi-okta commented Mar 2, 2026 •

edited

Loading