Skip to content

OAuth2 / OIDC On-Behalf-Of (OBO) Dynamic Token Exchange #107

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
spelech wants to merge 1 commit into from
Closed

OAuth2 / OIDC On-Behalf-Of (OBO) Dynamic Token Exchange #107

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion Extensions/ServiceCollectionExtensions.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,8 @@ public static void AddMcpRouterServices(this WebApplicationBuilder builder)
));
builder.Services.AddSingleton<CompositeIdentityProvider>();

// Register Secret Retrievers (HashiCorp Vault, Windows Registry & Environment)
// Register HttpContextAccessor and Secret Retrievers (HashiCorp Vault, Windows Registry, Environment & OAuth2 Token Exchange)
builder.Services.AddHttpContextAccessor();
builder.Services.AddMemoryCache();
builder.Services.AddSingleton<ISecretRetriever>(sp =>
new VaultSecretRetriever(
Expand All @@ -126,6 +127,16 @@ public static void AddMcpRouterServices(this WebApplicationBuilder builder)
));
builder.Services.AddSingleton<ISecretRetriever, WindowsRegistrySecretRetriever>();
builder.Services.AddSingleton<ISecretRetriever, EnvironmentSecretRetriever>();
builder.Services.AddSingleton<ISecretRetriever>(sp =>
new TokenExchangeSecretRetriever(
sp.GetRequiredService<IHttpClientFactory>(),
sp.GetRequiredService<Microsoft.Extensions.Caching.Memory.IMemoryCache>(),
sp.GetService<Microsoft.AspNetCore.Http.IHttpContextAccessor>(),
sp.GetService<ISecretProviderRepository>(),
sp.GetService<IAuthProviderRepository>(),
sp.GetService<IConfiguration>(),
sp.GetService<ILogger<TokenExchangeSecretRetriever>>()
));
builder.Services.AddSingleton<CompositeSecretRetriever>();
builder.Services.AddSingleton<McpRouter.Infrastructure.Secrets.IUserSecretStore, McpRouter.Infrastructure.Secrets.DatabaseUserSecretStore>();

Expand Down
6 changes: 4 additions & 2 deletions Infrastructure/Persistence/DatabaseSeederService.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1023,7 +1023,8 @@ private static void EnsureDefaultRows(IDbConnection conn, string provider)
{
new { ProviderName = "Vault", DisplayName = "HashiCorp Vault (KV v2)", IsEnabled = 1 },
new { ProviderName = "WindowsRegistry", DisplayName = "Windows Registry (DPAPI)", IsEnabled = 1 },
new { ProviderName = "Environment", DisplayName = "Container Environment", IsEnabled = 1 }
new { ProviderName = "Environment", DisplayName = "Container Environment", IsEnabled = 1 },
new { ProviderName = "TokenExchange", DisplayName = "OAuth2 / OIDC Token Exchange (OBO)", IsEnabled = 1 }
};

foreach (var sp in secretProviders)
Expand All @@ -1039,7 +1040,8 @@ private static void EnsureDefaultRows(IDbConnection conn, string provider)
var authProviders = new[]
{
new { ProviderName = "ActiveDirectory", DisplayName = "Active Directory", UserHeader = "Remote-User", GroupsHeader = "Remote-Groups", IsEnabled = 1 },
new { ProviderName = "HeaderAuth", DisplayName = "Configurable Reverse Proxy Header Auth", UserHeader = "Remote-User", GroupsHeader = "Remote-Groups", IsEnabled = 1 }
new { ProviderName = "HeaderAuth", DisplayName = "Configurable Reverse Proxy Header Auth", UserHeader = "Remote-User", GroupsHeader = "Remote-Groups", IsEnabled = 1 },
new { ProviderName = "PocketID", DisplayName = "PocketID OIDC", UserHeader = "Remote-User", GroupsHeader = "Remote-Groups", IsEnabled = 1 }
};

foreach (var ap in authProviders)
Expand Down
9 changes: 8 additions & 1 deletion Infrastructure/Secrets/CompositeSecretRetriever.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,14 @@ public CompositeSecretRetriever(IEnumerable<ISecretRetriever> retrievers, IMemor
{
if (string.Equals(retriever.ProviderName, providerName, StringComparison.OrdinalIgnoreCase) ||
(providerName.Equals("Vault", StringComparison.OrdinalIgnoreCase) && retriever.ProviderName.Equals("HashiCorpVault", StringComparison.OrdinalIgnoreCase)) ||
(providerName.Equals("HashiCorpVault", StringComparison.OrdinalIgnoreCase) && retriever.ProviderName.Equals("Vault", StringComparison.OrdinalIgnoreCase)))
(providerName.Equals("HashiCorpVault", StringComparison.OrdinalIgnoreCase) && retriever.ProviderName.Equals("Vault", StringComparison.OrdinalIgnoreCase)) ||
(retriever.ProviderName.Equals("TokenExchange", StringComparison.OrdinalIgnoreCase) &&
(providerName.Equals("OBO", StringComparison.OrdinalIgnoreCase) ||
providerName.Equals("PocketID", StringComparison.OrdinalIgnoreCase) ||
providerName.Equals("OAuth2", StringComparison.OrdinalIgnoreCase) ||
providerName.Equals("OAuth2TokenExchange", StringComparison.OrdinalIgnoreCase) ||
providerName.Equals("AzureAD", StringComparison.OrdinalIgnoreCase) ||
providerName.Equals("Okta", StringComparison.OrdinalIgnoreCase))))
{
targetRetriever = retriever;
break;
Expand Down
Loading
Loading