Package org.apache.juneau.rest.client.mcp.auth

Class McpDynamicClientRegistrar

java.lang.Object
org.apache.juneau.rest.client.mcp.auth.McpDynamicClientRegistrar
public class McpDynamicClientRegistrar extends Object
Performs an RFC 7591 / OpenID Connect Dynamic Client Registration (SEP-837) round-trip against an authorization server's registration_endpoint, returning the issued credentials as a redaction-safe McpClientRegistration keyed by the AS issuer (the SEP-2352 binding key).

The registration declares an application_type (SEP-837 MUST) — McpApplicationType.NATIVE for CLI/desktop/loopback clients, McpApplicationType.WEB for remote browser apps — along with the caller-supplied redirect URIs (see LoopbackRedirectUris), grant/response types, scope, and token_endpoint_auth_method (none for a public/native client by default; McpDynamicClientRegistrar.Builder.confidential(boolean) switches to client_secret_basic). A protected registration endpoint's RFC 7591 §3 initial access token is attached when McpDynamicClientRegistrar.Builder.initialAccessToken(String) is set.

The DCR-issued client_id/secret then feed the existing flows unchanged — DCR changes only how the client_id was obtained, not the resource= (RFC 8707) or iss (RFC 9207 / SEP-2468) enforcement; see McpClientRegistrations for the bridge to McpAuthorizationCodeAcquirer / McpTokenProvider.

register() is the single public round-trip entry point. Internally it is split into a request-build step and a response-parse step (both package-private, so the module's own tests can drive them without a network) — those helpers deliberately traffic in Nimbus provided-scope types and are not part of the public API. A registration failure (e.g. invalid_redirect_uri) surfaces as an McpAuthException carrying the AS error code (SEP-837 "clients MUST be prepared to handle registration failures").

Security

The registration endpoint MUST originate from validated AS metadata (OidcDiscoveryClient enforces the RFC 8414 / OIDC issuer-identity check) and MUST be https (loopback exempt for local testing, matching McpProtectedResourceMetadataClient.requireSecure). Client secrets are never logged — toString() discloses only non-secret configuration and McpClientRegistration redacts its secret-bearing fields.

Since:
10.0.0