pomerium / pomerium / 33511398333

53%

Build Type

push

github

Committed by web-flow

Commit Message

fix(mcp/CIMD): negotiate supported token auth endpoint methods based on Oauth2 server metadata (#6700)

## Summary

Our CIMD flow fetches client side metadata and was using the default
advertised `token_endpoint_auth_method` metadata.

As per RFC 8414, Oauth 2 may also include an optional list of
`token_endpoint_auth_methods_supported`, which include a list of
supported methods.

ChatGPT exposes `private_key_jwt` as the default token endpoint auth
method, which Pomerium currently does not support. It also allows for
the `none` method which Pomerium does support (It's actually the only
method we currently support for this downstream CIMD flow).

This PR adds a negotiation layer for supported auth methods, to future
proof this downstream client flow, and returns a bad request error with
relevant information about the mismatch between auth methods, so that
the failure is clear.

I plan to look into the `private_key_jwt` mechanism in more detail and
see if we can implement it in Pomerium.

## Related issues

Addresses: https://github.com/pomerium/pomerium/issues/6692

## User Explanation

MCP Clients could break if they advertised default token auth methods
like `private_key_jwt` that Pomerium doesn't support in its flow.

## AI disclosure

I used claude Opus 5 to draft the log messages to fit the existing log
messages in `internal/mcp`. The fix, approach to the problem and code is
my own.

## Checklist

- [X] reference any related issues
- [X] updated unit tests
- [X] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [X] disclosed AI usage (or wrote "none") per AI_POLICY.md
- [X] ready for review

Coverage Stats

37 of 40 new or added lines in 1 file covered. (92.5%)

49 existing lines in 11 files now uncovered.

33489 of 63701 relevant lines covered (52.57%)

352.08 hits per line