Describe the bug
Earlier, #4490 was closed but I tested with the 1.0.81 prerelease and for our case the same error persists:
Authentication failed: MCPOAuthError: Incompatible authorization server: authorization server advertised an issuer that does not match the URL its metadata was discovered from (RFC 8414 §3.3); refusing to connect
This issuer mismatch is introduced by agentgateway/agentgateway#2408 that works around several MCP OAuth & Entra ID incompatibilities at the cost of introducing an authorization server discovery proxy.
This works fine with Copilot version 1.0.78. The error occurs with GitHub Copilot CLI 1.0.80 and GitHub Copilot CLI 1.0.81-8 preview.
Can you please implement a skipIssuerValidation configuration option to make this work again?
Affected version
GitHub Copilot CLI 1.0.81-8
Steps to reproduce the behavior
Try to authenticate to MCP server configured on agentgateway with Entra ID following the documentation.
The https://agentgateway.domain/.well-known/oauth-authorization-server/mcp resource returns the original Entra ID issuer:
"issuer": "https://login.microsoftonline.com/tenant-id/v2.0"
Expected behavior
Copilot can authenticate to MCP OAuth server with agentgateway authorization server proxy and Entra ID again.
Describe the bug
Earlier, #4490 was closed but I tested with the 1.0.81 prerelease and for our case the same error persists:
Authentication failed: MCPOAuthError: Incompatible authorization server: authorization server advertised an issuer that does not match the URL its metadata was discovered from (RFC 8414 §3.3); refusing to connectThis issuer mismatch is introduced by agentgateway/agentgateway#2408 that works around several MCP OAuth & Entra ID incompatibilities at the cost of introducing an authorization server discovery proxy.
This works fine with Copilot version 1.0.78. The error occurs with GitHub Copilot CLI 1.0.80 and GitHub Copilot CLI 1.0.81-8 preview.
Can you please implement a skipIssuerValidation configuration option to make this work again?
Affected version
GitHub Copilot CLI 1.0.81-8
Steps to reproduce the behavior
Try to authenticate to MCP server configured on agentgateway with Entra ID following the documentation.
The https://agentgateway.domain/.well-known/oauth-authorization-server/mcp resource returns the original Entra ID issuer:
"issuer": "https://login.microsoftonline.com/tenant-id/v2.0"Expected behavior
Copilot can authenticate to MCP OAuth server with agentgateway authorization server proxy and Entra ID again.