Authorize performs the Enterprise Managed Authorization flow. It is called when a request fails with 401 or 403.
(ctx context.Context, req *http.Request, resp *http.Response)
| 137 | // Authorize performs the Enterprise Managed Authorization flow. |
| 138 | // It is called when a request fails with 401 or 403. |
| 139 | func (h *EnterpriseHandler) Authorize(ctx context.Context, req *http.Request, resp *http.Response) error { |
| 140 | defer resp.Body.Close() |
| 141 | defer io.Copy(io.Discard, resp.Body) |
| 142 | |
| 143 | httpClient := h.config.HTTPClient |
| 144 | if httpClient == nil { |
| 145 | httpClient = http.DefaultClient |
| 146 | } |
| 147 | |
| 148 | // Step 1: Get ID Token via the configured fetcher (e.g., OIDC login) |
| 149 | oidcToken, err := h.config.IDTokenFetcher(ctx) |
| 150 | if err != nil { |
| 151 | return fmt.Errorf("failed to obtain ID token: %w", err) |
| 152 | } |
| 153 | |
| 154 | // Extract ID token from the oauth2.Token |
| 155 | idToken, ok := oidcToken.Extra("id_token").(string) |
| 156 | if !ok || idToken == "" { |
| 157 | return fmt.Errorf("id_token not found in OIDC token response") |
| 158 | } |
| 159 | |
| 160 | // Step 2: Discover IdP token endpoint via OIDC discovery |
| 161 | idpMeta, err := auth.GetAuthServerMetadata(ctx, h.config.IdPIssuerURL, httpClient) |
| 162 | if err != nil { |
| 163 | return fmt.Errorf("failed to discover IdP metadata: %w", err) |
| 164 | } |
| 165 | if idpMeta == nil { |
| 166 | return fmt.Errorf("no authorization server metadata found for IdP: %s", h.config.IdPIssuerURL) |
| 167 | } |
| 168 | |
| 169 | // Step 3: Token Exchange (ID Token → ID-JAG) |
| 170 | tokenExchangeReq := &oauthex.TokenExchangeRequest{ |
| 171 | RequestedTokenType: oauthex.TokenTypeIDJAG, |
| 172 | Audience: h.config.MCPAuthServerURL, |
| 173 | Resource: h.config.MCPResourceURI, |
| 174 | Scope: h.config.MCPScopes, |
| 175 | SubjectToken: idToken, |
| 176 | SubjectTokenType: oauthex.TokenTypeIDToken, |
| 177 | } |
| 178 | |
| 179 | idJAGToken, err := oauthex.ExchangeToken( |
| 180 | ctx, |
| 181 | idpMeta.TokenEndpoint, |
| 182 | tokenExchangeReq, |
| 183 | h.config.IdPCredentials, |
| 184 | httpClient, |
| 185 | ) |
| 186 | if err != nil { |
| 187 | return fmt.Errorf("token exchange failed: %w", err) |
| 188 | } |
| 189 | |
| 190 | // Step 4: Discover MCP Server token endpoint |
| 191 | mcpMeta, err := auth.GetAuthServerMetadata(ctx, h.config.MCPAuthServerURL, httpClient) |
| 192 | if err != nil { |
| 193 | return fmt.Errorf("failed to discover MCP auth server metadata: %w", err) |
| 194 | } |
| 195 | if mcpMeta == nil { |
| 196 | return fmt.Errorf("no authorization server metadata found for MCP server: %s", h.config.MCPAuthServerURL) |