Package org.apache.juneau.rest.client.mcp.auth

Class McpClientRegistrationManager

java.lang.Object
org.apache.juneau.rest.client.mcp.auth.McpClientRegistrationManager
public class McpClientRegistrationManager extends Object
Orchestrates SEP-2352 registration-mechanism selection, issuer-keying, and re-registration on authorization-server migration, returning a usable McpClientRegistration for a discovered AS.

Given a discovered OidcMetadata (whose issuer identifies the AS and whose extras carry the RFC 7591 registration_endpoint), resolve(OidcMetadata) selects credentials per the SEP-2352 rules:

  • Pre-registered credentials (McpClientRegistrationManager.Builder.preRegistered(McpClientRegistration)) are used only when their bound issuer matches the discovered AS; a mismatch (the AS migrated) surfaces an McpAuthException rather than silently reusing cross-AS credentials (SEP-2352 SHOULD).
  • With a store (McpClientRegistrationManager.Builder.store(McpClientRegistrationStore)) the issuer-keyed entry is reused without a second DCR round-trip; on migration to a different issuer the store has no entry for the new AS, so the manager re-registers via DCR and stores under the new issuer — the old AS's entry is never reused (SEP-2352 "MUST NOT reuse client credentials from a different authorization server").
  • On-demand mode (no store) performs a fresh DCR on every resolve(OidcMetadata) call — fully compliant (persisting a registration is optional).
  • If the AS advertises no registration_endpoint and no matching pre-registered credentials exist, an McpAuthException is thrown (no way to obtain a client_id; CIMD is a tracked fast-follow).
Since:
10.0.0

  • Constructor Details

  • Method Details

    • create

      public static McpClientRegistrationManager.Builder create()
      Static creator.
      Returns:
      A new builder.

    • resolve

      public McpClientRegistration resolve(OidcMetadata as)
      Resolves a usable client registration for the discovered authorization server, applying the SEP-2352 selection, issuer-keying, and migration rules (see the class javadoc).
      Parameters:
      as - The discovered authorization-server metadata. Must not be null.
      Returns:
      A usable registration bound to as.issuer(). Never null.
      Throws:
      McpAuthException - If credentials cannot be obtained (AS migrated away from pre-registered creds, or the AS advertises no registration_endpoint and no matching pre-registered creds exist).