Allow MCPRemoteProxy to work without upstream or client auth

cmd/thv-operator/api/v1beta1/mcpexternalauthconfig_types.go

@@ -279,6 +279,21 @@ type EmbeddedAuthServerConfig struct {
 	// +optional
 	Storage *AuthServerStorageConfig `json:"storage,omitempty"`
 
+	// DisableUpstreamTokenInjection prevents the embedded auth server from injecting
+	// upstream IdP tokens into requests forwarded to the backend MCP server.
+	// When true, the embedded auth server still handles OAuth flows for clients,
+	// but instead of swapping ToolHive JWTs for upstream tokens the proxy STRIPS
+	// the client's credential headers (Authorization, Cookie, Proxy-Authorization)
+	// after validating the JWT — the backend receives an unauthenticated request.
+	// Use headerForward to attach static credentials (e.g. an API key) if the
+	// backend needs them. Cannot be combined with token exchange or AWS STS,
+	// which would re-add credentials after the strip.
+	// This is useful when the backend MCP server does not require authentication
+	// (e.g., public documentation servers) but you still want client authentication.
+	// +kubebuilder:default=false
+	// +optional
+	DisableUpstreamTokenInjection bool `json:"disableUpstreamTokenInjection,omitempty"`
+
 	// BaselineClientScopes is a baseline set of OAuth 2.0 scopes guaranteed to be
 	// included in every client registration. The embedded auth server unions these
 	// scopes into the registered set returned by RFC 7591 Dynamic Client

cmd/thv-operator/pkg/controllerutil/authserver.go

@@ -582,6 +582,9 @@ func BuildAuthServerRunConfig(
 	}
 	config.Storage = storageCfg
 
+	// Wire through upstream token injection flag
+	config.DisableUpstreamTokenInjection = authConfig.DisableUpstreamTokenInjection
+
 	// Build CIMD configuration. CacheFallbackTTL is passed as-is (string);
 	// resolveCIMDConfig in the runner parses it to time.Duration at startup.
 	if authConfig.CIMD != nil && authConfig.CIMD.Enabled {

cmd/thv-operator/pkg/controllerutil/authserver_test.go

@@ -1538,6 +1538,45 @@ func TestBuildAuthServerRunConfig(t *testing.T) {
 					"IdentityFromToken must be nil when not configured")
 			},
 		},
+		{
+			name: "DisableUpstreamTokenInjection is wired through",
+			authConfig: &mcpv1beta1.EmbeddedAuthServerConfig{
+				Issuer: "https://auth.example.com",
+				SigningKeySecretRefs: []mcpv1beta1.SecretKeyRef{
+					{Name: "signing-key", Key: "private.pem"},
+				},
+				HMACSecretRefs: []mcpv1beta1.SecretKeyRef{
+					{Name: "hmac-secret", Key: "hmac"},
+				},
+				DisableUpstreamTokenInjection: true,
+			},
+			allowedAudiences: defaultAudiences,
+			scopesSupported:  defaultScopes,
+			checkFunc: func(t *testing.T, config *authserver.RunConfig) {
+				t.Helper()
+				assert.True(t, config.DisableUpstreamTokenInjection,
+					"DisableUpstreamTokenInjection should be wired from CRD to RunConfig")
+			},
+		},
+		{
+			name: "DisableUpstreamTokenInjection defaults to false",
+			authConfig: &mcpv1beta1.EmbeddedAuthServerConfig{
+				Issuer: "https://auth.example.com",
+				SigningKeySecretRefs: []mcpv1beta1.SecretKeyRef{
+					{Name: "signing-key", Key: "private.pem"},
+				},
+				HMACSecretRefs: []mcpv1beta1.SecretKeyRef{
+					{Name: "hmac-secret", Key: "hmac"},
+				},
+			},
+			allowedAudiences: defaultAudiences,
+			scopesSupported:  defaultScopes,
+			checkFunc: func(t *testing.T, config *authserver.RunConfig) {
+				t.Helper()
+				assert.False(t, config.DisableUpstreamTokenInjection,
+					"DisableUpstreamTokenInjection should default to false")
+			},
+		},
 	}
 
 	for _, tt := range tests {

deploy/charts/operator-crds/files/crds/toolhive.stacklok.dev_mcpexternalauthconfigs.yaml

@@ -269,6 +269,21 @@ spec:
                     required:
                     - enabled
                     type: object
+                  disableUpstreamTokenInjection:
+                    default: false
+                    description: |-
+                      DisableUpstreamTokenInjection prevents the embedded auth server from injecting
+                      upstream IdP tokens into requests forwarded to the backend MCP server.
+                      When true, the embedded auth server still handles OAuth flows for clients,
+                      but instead of swapping ToolHive JWTs for upstream tokens the proxy STRIPS
+                      the client's credential headers (Authorization, Cookie, Proxy-Authorization)
+                      after validating the JWT — the backend receives an unauthenticated request.
+                      Use headerForward to attach static credentials (e.g. an API key) if the
+                      backend needs them. Cannot be combined with token exchange or AWS STS,
+                      which would re-add credentials after the strip.
+                      This is useful when the backend MCP server does not require authentication
+                      (e.g., public documentation servers) but you still want client authentication.
+                    type: boolean
                   hmacSecretRefs:
                     description: |-
                       HMACSecretRefs references Kubernetes Secrets containing symmetric secrets for signing
@@ -1578,6 +1593,21 @@ spec:
                     required:
                     - enabled
                     type: object
+                  disableUpstreamTokenInjection:
+                    default: false
+                    description: |-
+                      DisableUpstreamTokenInjection prevents the embedded auth server from injecting
+                      upstream IdP tokens into requests forwarded to the backend MCP server.
+                      When true, the embedded auth server still handles OAuth flows for clients,
+                      but instead of swapping ToolHive JWTs for upstream tokens the proxy STRIPS
+                      the client's credential headers (Authorization, Cookie, Proxy-Authorization)
+                      after validating the JWT — the backend receives an unauthenticated request.
+                      Use headerForward to attach static credentials (e.g. an API key) if the
+                      backend needs them. Cannot be combined with token exchange or AWS STS,
+                      which would re-add credentials after the strip.
+                      This is useful when the backend MCP server does not require authentication
+                      (e.g., public documentation servers) but you still want client authentication.
+                    type: boolean
                   hmacSecretRefs:
                     description: |-
                       HMACSecretRefs references Kubernetes Secrets containing symmetric secrets for signing

deploy/charts/operator-crds/files/crds/toolhive.stacklok.dev_virtualmcpservers.yaml

@@ -142,6 +142,21 @@ spec:
                     required:
                     - enabled
                     type: object
+                  disableUpstreamTokenInjection:
+                    default: false
+                    description: |-
+                      DisableUpstreamTokenInjection prevents the embedded auth server from injecting
+                      upstream IdP tokens into requests forwarded to the backend MCP server.
+                      When true, the embedded auth server still handles OAuth flows for clients,
+                      but instead of swapping ToolHive JWTs for upstream tokens the proxy STRIPS
+                      the client's credential headers (Authorization, Cookie, Proxy-Authorization)
+                      after validating the JWT — the backend receives an unauthenticated request.
+                      Use headerForward to attach static credentials (e.g. an API key) if the
+                      backend needs them. Cannot be combined with token exchange or AWS STS,
+                      which would re-add credentials after the strip.
+                      This is useful when the backend MCP server does not require authentication
+                      (e.g., public documentation servers) but you still want client authentication.
+                    type: boolean
                   hmacSecretRefs:
                     description: |-
                       HMACSecretRefs references Kubernetes Secrets containing symmetric secrets for signing
@@ -3122,6 +3137,21 @@ spec:
                     required:
                     - enabled
                     type: object
+                  disableUpstreamTokenInjection:
+                    default: false
+                    description: |-
+                      DisableUpstreamTokenInjection prevents the embedded auth server from injecting
+                      upstream IdP tokens into requests forwarded to the backend MCP server.
+                      When true, the embedded auth server still handles OAuth flows for clients,
+                      but instead of swapping ToolHive JWTs for upstream tokens the proxy STRIPS
+                      the client's credential headers (Authorization, Cookie, Proxy-Authorization)
+                      after validating the JWT — the backend receives an unauthenticated request.
+                      Use headerForward to attach static credentials (e.g. an API key) if the
+                      backend needs them. Cannot be combined with token exchange or AWS STS,
+                      which would re-add credentials after the strip.
+                      This is useful when the backend MCP server does not require authentication
+                      (e.g., public documentation servers) but you still want client authentication.
+                    type: boolean
                   hmacSecretRefs:
                     description: |-
                       HMACSecretRefs references Kubernetes Secrets containing symmetric secrets for signing

deploy/charts/operator-crds/templates/toolhive.stacklok.dev_mcpexternalauthconfigs.yaml

@@ -272,6 +272,21 @@ spec:
                     required:
                     - enabled
                     type: object
+                  disableUpstreamTokenInjection:
+                    default: false
+                    description: |-
+                      DisableUpstreamTokenInjection prevents the embedded auth server from injecting
+                      upstream IdP tokens into requests forwarded to the backend MCP server.
+                      When true, the embedded auth server still handles OAuth flows for clients,
+                      but instead of swapping ToolHive JWTs for upstream tokens the proxy STRIPS
+                      the client's credential headers (Authorization, Cookie, Proxy-Authorization)
+                      after validating the JWT — the backend receives an unauthenticated request.
+                      Use headerForward to attach static credentials (e.g. an API key) if the
+                      backend needs them. Cannot be combined with token exchange or AWS STS,
+                      which would re-add credentials after the strip.
+                      This is useful when the backend MCP server does not require authentication
+                      (e.g., public documentation servers) but you still want client authentication.
+                    type: boolean
                   hmacSecretRefs:
                     description: |-
                       HMACSecretRefs references Kubernetes Secrets containing symmetric secrets for signing
@@ -1581,6 +1596,21 @@ spec:
                     required:
                     - enabled
                     type: object
+                  disableUpstreamTokenInjection:
+                    default: false
+                    description: |-
+                      DisableUpstreamTokenInjection prevents the embedded auth server from injecting
+                      upstream IdP tokens into requests forwarded to the backend MCP server.
+                      When true, the embedded auth server still handles OAuth flows for clients,
+                      but instead of swapping ToolHive JWTs for upstream tokens the proxy STRIPS
+                      the client's credential headers (Authorization, Cookie, Proxy-Authorization)
+                      after validating the JWT — the backend receives an unauthenticated request.
+                      Use headerForward to attach static credentials (e.g. an API key) if the
+                      backend needs them. Cannot be combined with token exchange or AWS STS,
+                      which would re-add credentials after the strip.
+                      This is useful when the backend MCP server does not require authentication
+                      (e.g., public documentation servers) but you still want client authentication.
+                    type: boolean
                   hmacSecretRefs:
                     description: |-
                       HMACSecretRefs references Kubernetes Secrets containing symmetric secrets for signing

deploy/charts/operator-crds/templates/toolhive.stacklok.dev_virtualmcpservers.yaml

@@ -145,6 +145,21 @@ spec:
                     required:
                     - enabled
                     type: object
+                  disableUpstreamTokenInjection:
+                    default: false
+                    description: |-
+                      DisableUpstreamTokenInjection prevents the embedded auth server from injecting
+                      upstream IdP tokens into requests forwarded to the backend MCP server.
+                      When true, the embedded auth server still handles OAuth flows for clients,
+                      but instead of swapping ToolHive JWTs for upstream tokens the proxy STRIPS
+                      the client's credential headers (Authorization, Cookie, Proxy-Authorization)
+                      after validating the JWT — the backend receives an unauthenticated request.
+                      Use headerForward to attach static credentials (e.g. an API key) if the
+                      backend needs them. Cannot be combined with token exchange or AWS STS,
+                      which would re-add credentials after the strip.
+                      This is useful when the backend MCP server does not require authentication
+                      (e.g., public documentation servers) but you still want client authentication.
+                    type: boolean
                   hmacSecretRefs:
                     description: |-
                       HMACSecretRefs references Kubernetes Secrets containing symmetric secrets for signing
@@ -3125,6 +3140,21 @@ spec:
                     required:
                     - enabled
                     type: object
+                  disableUpstreamTokenInjection:
+                    default: false
+                    description: |-
+                      DisableUpstreamTokenInjection prevents the embedded auth server from injecting
+                      upstream IdP tokens into requests forwarded to the backend MCP server.
+                      When true, the embedded auth server still handles OAuth flows for clients,
+                      but instead of swapping ToolHive JWTs for upstream tokens the proxy STRIPS
+                      the client's credential headers (Authorization, Cookie, Proxy-Authorization)
+                      after validating the JWT — the backend receives an unauthenticated request.
+                      Use headerForward to attach static credentials (e.g. an API key) if the
+                      backend needs them. Cannot be combined with token exchange or AWS STS,
+                      which would re-add credentials after the strip.
+                      This is useful when the backend MCP server does not require authentication
+                      (e.g., public documentation servers) but you still want client authentication.
+                    type: boolean
                   hmacSecretRefs:
                     description: |-
                       HMACSecretRefs references Kubernetes Secrets containing symmetric secrets for signing