Skip to content

Use Basic auth for OAuth2 upstreams #6543

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jhrozek merged 1 commit into from
Sep 9, 2026
Merged

Use Basic auth for OAuth2 upstreams #6543

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions cmd/thv-operator/api/v1beta1/mcpexternalauthconfig_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1654,6 +1654,15 @@ type OAuth2UpstreamConfig struct {
// +optional
ClientSecretRef *SecretKeyRef `json:"clientSecretRef,omitempty"`

// TokenEndpointAuthMethod selects how the client authenticates at the OAuth token
// endpoint. When empty and a client secret is configured, client_secret_basic is
// used, matching the RFC 7591 default for confidential clients. Set this to
// client_secret_post only for providers that require credentials in the request body.
// Public clients without a secret use the "none" method.
// +kubebuilder:validation:Enum=none;client_secret_basic;client_secret_post
// +optional
TokenEndpointAuthMethod string `json:"tokenEndpointAuthMethod,omitempty"`

// RedirectURI is the callback URL where the upstream IdP will redirect after authentication.
// When not specified, defaults to `{resourceUrl}/oauth/callback` where `resourceUrl` is the
// URL associated with the resource (e.g., MCPServer or vMCP) using this config.
Expand Down
1 change: 1 addition & 0 deletions cmd/thv-operator/pkg/controllerutil/authserver.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1369,6 +1369,7 @@ func buildOAuth2UpstreamRunConfig(
AuthorizationEndpoint: cfg.AuthorizationEndpoint,
TokenEndpoint: cfg.TokenEndpoint,
ClientID: cfg.ClientID,
TokenEndpointAuthMethod: cfg.TokenEndpointAuthMethod,
RedirectURI: redirectURI,
Scopes: cfg.Scopes,
AdditionalAuthorizationParams: cfg.AdditionalAuthorizationParams,
Expand Down
29 changes: 29 additions & 0 deletions cmd/thv-operator/pkg/controllerutil/authserver_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2062,6 +2062,35 @@ func TestBuildOAuth2UpstreamRunConfig_TransportOptions(t *testing.T) {
assert.True(t, runConfig.AllowPrivateIPs)
}

func TestBuildOAuth2UpstreamRunConfig_TokenEndpointAuthMethod(t *testing.T) {
t.Parallel()

tests := []struct {
name string
method string
}{
{name: "empty passes through unset", method: ""},
{name: "client_secret_basic propagates", method: "client_secret_basic"},
{name: "client_secret_post propagates", method: "client_secret_post"},
{name: "none propagates", method: "none"},
}

for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
t.Parallel()

runConfig, err := buildOAuth2UpstreamRunConfig(&mcpv1beta1.OAuth2UpstreamConfig{
AuthorizationEndpoint: "http://dex.default.svc.cluster.local/auth",
TokenEndpoint: "http://dex.default.svc.cluster.local/token",
ClientID: "client-id",
TokenEndpointAuthMethod: tt.method,
}, "", "", 0, "")
require.NoError(t, err)
assert.Equal(t, tt.method, runConfig.TokenEndpointAuthMethod)
})
}
}

func TestDelegateClientsConversionAndEnvVars(t *testing.T) {
t.Parallel()

Expand Down
24 changes: 24 additions & 0 deletions deploy/charts/operator-crds/files/crds/toolhive.stacklok.dev_mcpexternalauthconfigs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1769,6 +1769,18 @@ spec:
token endpoint.
pattern: ^https?://.*$
type: string
tokenEndpointAuthMethod:
description: |-
TokenEndpointAuthMethod selects how the client authenticates at the OAuth token
endpoint. When empty and a client secret is configured, client_secret_basic is
used, matching the RFC 7591 default for confidential clients. Set this to
client_secret_post only for providers that require credentials in the request body.
Public clients without a secret use the "none" method.
enum:
- none
- client_secret_basic
- client_secret_post
type: string
tokenResponseMapping:
description: |-
TokenResponseMapping configures custom field extraction from non-standard token responses.
Expand Down Expand Up @@ -4457,6 +4469,18 @@ spec:
token endpoint.
pattern: ^https?://.*$
type: string
tokenEndpointAuthMethod:
description: |-
TokenEndpointAuthMethod selects how the client authenticates at the OAuth token
endpoint. When empty and a client secret is configured, client_secret_basic is
used, matching the RFC 7591 default for confidential clients. Set this to
client_secret_post only for providers that require credentials in the request body.
Public clients without a secret use the "none" method.
enum:
- none
- client_secret_basic
- client_secret_post
type: string
tokenResponseMapping:
description: |-
TokenResponseMapping configures custom field extraction from non-standard token responses.
Expand Down
24 changes: 24 additions & 0 deletions deploy/charts/operator-crds/files/crds/toolhive.stacklok.dev_virtualmcpservers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1645,6 +1645,18 @@ spec:
token endpoint.
pattern: ^https?://.*$
type: string
tokenEndpointAuthMethod:
description: |-
TokenEndpointAuthMethod selects how the client authenticates at the OAuth token
endpoint. When empty and a client secret is configured, client_secret_basic is
used, matching the RFC 7591 default for confidential clients. Set this to
client_secret_post only for providers that require credentials in the request body.
Public clients without a secret use the "none" method.
enum:
- none
- client_secret_basic
- client_secret_post
type: string
tokenResponseMapping:
description: |-
TokenResponseMapping configures custom field extraction from non-standard token responses.
Expand Down Expand Up @@ -6495,6 +6507,18 @@ spec:
token endpoint.
pattern: ^https?://.*$
type: string
tokenEndpointAuthMethod:
description: |-
TokenEndpointAuthMethod selects how the client authenticates at the OAuth token
endpoint. When empty and a client secret is configured, client_secret_basic is
used, matching the RFC 7591 default for confidential clients. Set this to
client_secret_post only for providers that require credentials in the request body.
Public clients without a secret use the "none" method.
enum:
- none
- client_secret_basic
- client_secret_post
type: string
tokenResponseMapping:
description: |-
TokenResponseMapping configures custom field extraction from non-standard token responses.
Expand Down
24 changes: 24 additions & 0 deletions deploy/charts/operator-crds/templates/toolhive.stacklok.dev_mcpexternalauthconfigs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1772,6 +1772,18 @@ spec:
token endpoint.
pattern: ^https?://.*$
type: string
tokenEndpointAuthMethod:
description: |-
TokenEndpointAuthMethod selects how the client authenticates at the OAuth token
endpoint. When empty and a client secret is configured, client_secret_basic is
used, matching the RFC 7591 default for confidential clients. Set this to
client_secret_post only for providers that require credentials in the request body.
Public clients without a secret use the "none" method.
enum:
- none
- client_secret_basic
- client_secret_post
type: string
tokenResponseMapping:
description: |-
TokenResponseMapping configures custom field extraction from non-standard token responses.
Expand Down Expand Up @@ -4460,6 +4472,18 @@ spec:
token endpoint.
pattern: ^https?://.*$
type: string
tokenEndpointAuthMethod:
description: |-
TokenEndpointAuthMethod selects how the client authenticates at the OAuth token
endpoint. When empty and a client secret is configured, client_secret_basic is
used, matching the RFC 7591 default for confidential clients. Set this to
client_secret_post only for providers that require credentials in the request body.
Public clients without a secret use the "none" method.
enum:
- none
- client_secret_basic
- client_secret_post
type: string
tokenResponseMapping:
description: |-
TokenResponseMapping configures custom field extraction from non-standard token responses.
Expand Down
24 changes: 24 additions & 0 deletions deploy/charts/operator-crds/templates/toolhive.stacklok.dev_virtualmcpservers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1648,6 +1648,18 @@ spec:
token endpoint.
pattern: ^https?://.*$
type: string
tokenEndpointAuthMethod:
description: |-
TokenEndpointAuthMethod selects how the client authenticates at the OAuth token
endpoint. When empty and a client secret is configured, client_secret_basic is
used, matching the RFC 7591 default for confidential clients. Set this to
client_secret_post only for providers that require credentials in the request body.
Public clients without a secret use the "none" method.
enum:
- none
- client_secret_basic
- client_secret_post
type: string
tokenResponseMapping:
description: |-
TokenResponseMapping configures custom field extraction from non-standard token responses.
Expand Down Expand Up @@ -6498,6 +6510,18 @@ spec:
token endpoint.
pattern: ^https?://.*$
type: string
tokenEndpointAuthMethod:
description: |-
TokenEndpointAuthMethod selects how the client authenticates at the OAuth token
endpoint. When empty and a client secret is configured, client_secret_basic is
used, matching the RFC 7591 default for confidential clients. Set this to
client_secret_post only for providers that require credentials in the request body.
Public clients without a secret use the "none" method.
enum:
- none
- client_secret_basic
- client_secret_post
type: string
tokenResponseMapping:
description: |-
TokenResponseMapping configures custom field extraction from non-standard token responses.
Expand Down
1 change: 1 addition & 0 deletions docs/operator/crd-api.md
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 4 additions & 0 deletions docs/server/docs.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 4 additions & 0 deletions docs/server/swagger.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 8 additions & 0 deletions docs/server/swagger.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading