• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

stacklok / toolhive / 18115880722
50%

Build:
DEFAULT BRANCH: main
Ran 30 Sep 2025 01:40AM UTC
Jobs 1
Files 272
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

30 Sep 2025 01:36AM UTC coverage: 45.27% (+0.2%) from 45.101%
18115880722

push

github

web-flow
Fix remote MCP server authentication with issuer mismatch (#1980)

This fixes authentication failures when remote MCP servers return a
different issuer URL than their public-facing URL in the OIDC discovery
response.

The fix adds a new priority level to the issuer discovery algorithm,
placing well-known endpoint discovery before URL derivation. This allows
accepting the authoritative issuer from the .well-known/openid-configuration
endpoint even when it differs from the server URL, complying with RFC 8414.

New discovery priority chain:
1. Configured issuer (if provided)
2. Realm-derived issuer (RFC 8414)
3. Resource metadata discovery (RFC 9728)
4. Well-known endpoint discovery (NEW - accepts actual issuer)
5. URL-derived issuer (fallback)

Changes:
- Add tryDiscoverFromWellKnown to attempt discovery before URL derivation
- Accept the actual issuer from ValidateAndDiscoverAuthServer
- Preserve HTTP scheme for localhost URLs in DeriveIssuerFromURL
- Add path normalization to DeriveIssuerFromRealm for security
- Add comprehensive test coverage for discovery priority chain
- Fix linting issues with constants and parallel test execution

The fix maintains backward compatibility while supporting real-world
OAuth deployments where the issuer differs from the server endpoint.

Fixes #1957

Signed-off-by: Juan Antonio Osorio <ozz@stacklok.com>

42 of 46 new or added lines in 2 files covered. (91.3%)

9 existing lines in 3 files now uncovered.

16162 of 35701 relevant lines covered (45.27%)

15.5 hits per line

New Missed Lines in Diff

Lines Coverage ∆ File
4
62.69
0.12% pkg/auth/discovery/discovery.go

Uncovered Existing Lines

Lines Coverage ∆ File
1
94.29
1.43% pkg/secrets/keyring/composite.go
2
44.56
-0.26% pkg/workloads/manager.go
6
64.89
-6.38% pkg/secrets/keyring/keyctl_linux.go
Jobs
ID Job ID Ran Files Coverage
1 18115880722.1 30 Sep 2025 01:40AM UTC 272
45.27
GitHub Action Run
Source Files on build 18115880722
  • Tree
  • List 272
  • Changed 5
  • Source Changed 2
  • Coverage Changed 5
Coverage ∆ File Lines Relevant Covered Missed Hits/Line
  • Back to Repo
  • Github Actions Build #18115880722
  • f89b1031 on github
  • Prev Build on main (#18115859093)
  • Next Build on main (#18122126797)
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc