Package org.apache.juneau.rest.client.mcp.auth

package org.apache.juneau.rest.client.mcp.auth

Client-side OAuth 2.1 token acquisition for the Model Context Protocol 2026-07-28 revision.

This module supplies the token-provider implementations that plug into the McpAuthInterceptor seam of juneau-rest-client-mcp (its Supplier<String>). It deliberately does not depend on juneau-rest-server — the client-side flow/discovery helpers are relocated (see the flow and oidc sub-packages) rather than reused from juneau-rest-server-auth-oauth, which compile-depends on the server. A later auth-module de-layering is expected to rationalize this relocation.

What's here

• McpTokenProvider — a Supplier<String> token manager for pre-provisioned (static) tokens, the client-credentials grant, and the refresh-token grant (SEP-2207, with rotated-refresh-token capture); all requests carry the RFC 8707 resource indicator.
• McpProtectedResourceMetadataClient and WwwAuthenticateChallenge — the client half of the OAuth 2.1 baseline: consume a 401 WWW-Authenticate resource_metadata pointer, fetch the RFC 9728 PRM document, select an authorization server, and validate its issuer via RFC 8414 / OIDC discovery.
• McpAuthorizationCodeAcquirer and LoopbackRedirectReceiver — interactive authorization-code + PKCE (S256) acquisition over a loopback redirect for headless/CLI use, including the SEP-2468 iss check on the callback.

Adoption-focused documentation for this module is intentionally tracked as a separate follow-up.

Since:

10.0.0

Related Packages

Package	Description
org.apache.juneau.rest.client.mcp	Revision-neutral Model Context Protocol (MCP) client core - Streamable-HTTP transport orchestration, the auth-token seam, and the pluggable response cache that per-revision McpClient facades build on.
org.apache.juneau.rest.client.mcp.v20250618	Typed 2025-06-18 Model Context Protocol (MCP) client facade.
org.apache.juneau.rest.client.mcp.v20260728	Typed MCP client adapter for revision 2026-07-28.

Class	Description
EphemeralStore	Single-use, TTL-bounded store for the per-authorization state → (codeVerifier, expectedIssuer) association created when an interactive authorization-code + PKCE flow is started and consumed when the loopback redirect arrives.
EphemeralStore.PendingAuthorization	A pending-authorization association awaiting the IdP loopback callback.
InMemoryMcpClientRegistrationStore	Thread-safe, process-scoped default McpClientRegistrationStore keying registrations by issuer.toString() (SEP-2352 "separate registration state per authorization server").
LoopbackRedirectReceiver	A minimal loopback (http://127.0.0.1) HTTP listener that captures the single authorization-code redirect an IdP sends back to a native/CLI OAuth client (SEP-837 loopback redirect handling).
LoopbackRedirectUris	Builds the pair of loopback redirect URIs (SEP-837 loopback redirect handling) an MCP native/CLI client registers with an authorization server during Dynamic Client Registration.
McpApplicationType	The OIDC Dynamic Client Registration application_type (SEP-837) declared by an MCP client when it registers with an authorization server.
McpAuthException	Runtime exception raised by the MCP client-side auth layer when metadata discovery, PRM fetch/parse, an issuer (iss) validation check, or token acquisition fails.
McpAuthorizationCodeAcquirer	Interactive authorization-code + PKCE (S256) token acquisition for headless / CLI use.
McpAuthorizationCodeAcquirer.Builder	Builder.
McpClientRegistration	Immutable result of a Dynamic Client Registration (SEP-837) round-trip — the client credentials and metadata an authorization server issued, keyed by the AS issuer for SEP-2352 credential binding.
McpClientRegistrationManager	Orchestrates SEP-2352 registration-mechanism selection, issuer-keying, and re-registration on authorization-server migration, returning a usable McpClientRegistration for a discovered AS.
McpClientRegistrationManager.Builder	Builder.
McpClientRegistrations	Bridges a Dynamic-Client-Registration result (McpClientRegistration) into the existing token flows — the McpAuthorizationCodeAcquirer (interactive auth-code + PKCE) and McpTokenProvider (client-credentials / refresh).
McpClientRegistrationStore	SEP-2352 optional persistence SPI for Dynamic-Client-Registration / pre-registered credentials, keyed by the authorization server's issuer identifier.
McpDynamicClientRegistrar	Performs an RFC 7591 / OpenID Connect Dynamic Client Registration (SEP-837) round-trip against an authorization server's registration_endpoint, returning the issued credentials as a redaction-safe McpClientRegistration keyed by the AS issuer (the SEP-2352 binding key).
McpDynamicClientRegistrar.Builder	Builder.
McpInsufficientScopeException	Signals that an MCP call was rejected with a SEP-2350 401/403 insufficient_scope step-up challenge.
McpProtectedResourceMetadata	Immutable view of an RFC 9728 Protected Resource Metadata (PRM) document, as an MCP client consumes it to discover which authorization server(s) protect a given MCP server.
McpProtectedResourceMetadataClient	Fetches and parses an RFC 9728 Protected Resource Metadata (PRM) document, and resolves the authorization server a protected MCP resource delegates to.
McpProtectedResourceMetadataClient.Builder	Builder.
McpScopeAccumulator	Computes and tracks the SEP-2350 step-up scope union — the set of scopes a client re-authorizes with after a server emits a per-operation insufficient_scope challenge.
McpStepUpAuthorizer	Client-side SEP-2350 step-up state machine: wraps an MCP call so that, on a 401/403 insufficient_scope challenge, it computes the required-scope union (McpScopeAccumulator), drives (re-)authorization via a caller-supplied McpStepUpAuthorizer.Reauthorizer, and retries the original call — bounded by a hard attempt cap with per-(resource, operation) attempt tracking so a misconfigured server can't drive an unbounded re-authorization loop (spec "no more than a few times").
McpStepUpAuthorizer.Builder	Builder.
McpStepUpAuthorizer.Reauthorizer	Drives (re-)authorization with the computed scope union and installs the resulting token.
McpStepUpAuthorizer.ScopedCall<T>	A caller-supplied MCP call that throws McpInsufficientScopeException on a step-up challenge.
McpTokenProvider	A headless bearer-token provider that feeds the McpAuthInterceptor token seam (Supplier<String>).
McpTokenProvider.Builder	Builder.
WwwAuthenticateChallenge	A parsed WWW-Authenticate: Bearer ... challenge as returned by an OAuth 2.1 / MCP resource server on a 401/403 response (RFC 6750 §3, RFC 9728 §5.1).