Oxidaner opened a new issue, #1580:
URL: https://github.com/apache/dubbo-admin/issues/1580
Parent: #1491
Phase 5 — business MCP runtime and authentication. This is the phase that
makes the backend loop callable end to end.
### Scope
**Runtime (PR-7)**
- A dedicated RouterGroup; each Published Server gets its own stateless
Streamable HTTP endpoint.
- Official MCP Go SDK in stateless mode, supporting `initialize`,
`tools/list` and `tools/call`.
- Each request reads the current Published snapshot.
**Authentication (PR-8)**
- Two Bearer token types accepted on the same endpoint:
1. Dubbo Admin-issued API Key (high-entropy secret hash, expiry, revoke).
2. OAuth JWT access token issued by an external Authorization Server,
verified through OIDC discovery/JWKS.
- Verifier checks signature, issuer, audience, expiration, not-before and
required scopes.
- RFC 9728 Protected Resource Metadata is served.
- Both authentication methods map to a unified internal `MCPPrincipal` used
for authorization and audit.
- Admin is an OAuth **Resource Server** only: no login page, no
Authorization Endpoint, no Token Endpoint. Authorization Code + PKCE and Client
Credentials live entirely in the external Authorization Server.
### Acceptance criteria
- API Key and OAuth JWT can call the same endpoint; a wrong audience, an
expired token or a missing scope is rejected.
- An OAuth request fails closed when the verifier or Authorization Server is
unavailable, and the independently validated API Keys keep working — the two
paths never fall back to each other.
- MCP access tokens are never forwarded to the Dubbo provider.
- Degradation is per-Tool fail-closed: one broken binding does not zero out
the whole server's capability set.
- `tools/list` returns the Published schema; `tools/call` returns
`not-executed` when the target is known to be down.
- Stateless mode is accepted: there is no `tools/list_changed` push, so
clients discover staleness on the next list or on a failed call.
- Existing `/api/mcp` and Console authentication are untouched —
authentication uses a separate route and Bearer middleware.
### PR
- PR-7 — MCP handler/runtime.
- PR-8 — dual Bearer verifier, principal, metadata, authentication tests.
(PR-7 and PR-8 may be developed in parallel but must merge within the same
runtime acceptance phase.)
Dependency: Phase 3–4 (PR-4, PR-5, PR-6).
Detailed design: [proposal §15 (line
1243)](https://github.com/Oxidaner/dubbo-admin/blob/213bd38dbcfbe0c5bac64c7c8b949651f1633ca9/docs/proposal/mcp-server-proposal.md?plain=1#L1243)
— design PR #1541.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
