SEP-2207: Refresh token guidance - #2039
Conversation
Sorry, something went wrong.
|
This is ready for review now that the SEP is accepted. There is also a pending conformance test PR that we can wait for if desired: modelcontextprotocol/conformance#166 Edit: The conformance test has been merged |
Sorry, something went wrong.
pcarleton
left a comment
There was a problem hiding this comment.
overall lgtm. if you could run it against the conformance test to make sure it passes, that'd be 💯
Again, we can bump the conformance version in the repo in a follow up, just want to make sure this impl passes
Sorry, something went wrong.
|
Conformance tests on the main branch pass (except cross-app-access, which is unrelated, I think). === SUITE SUMMARY ===
✓ initialize: 1 passed, 0 failed
✓ tools_call: 1 passed, 0 failed
✓ elicitation-sep1034-client-defaults: 5 passed, 0 failed
✓ sse-retry: 3 passed, 0 failed
✓ auth/metadata-default: 13 passed, 0 failed
✓ auth/metadata-var1: 13 passed, 0 failed
✓ auth/metadata-var2: 13 passed, 0 failed
✓ auth/metadata-var3: 13 passed, 0 failed
✓ auth/basic-cimd: 13 passed, 0 failed
✓ auth/scope-from-www-authenticate: 14 passed, 0 failed
✓ auth/scope-from-scopes-supported: 14 passed, 0 failed
✓ auth/scope-omitted-when-undefined: 14 passed, 0 failed
✓ auth/scope-step-up: 20 passed, 0 failed
✓ auth/scope-retry-limit: 10 passed, 0 failed
✓ auth/token-endpoint-auth-basic: 18 passed, 0 failed
✓ auth/token-endpoint-auth-post: 18 passed, 0 failed
✓ auth/token-endpoint-auth-none: 18 passed, 0 failed
✓ auth/pre-registration: 13 passed, 0 failed
✓ auth/2025-03-26-oauth-metadata-backcompat: 12 passed, 0 failed
✓ auth/2025-03-26-oauth-endpoint-fallback: 7 passed, 0 failed
✓ auth/resource-mismatch: 2 passed, 0 failed
✓ auth/offline-access-scope: 13 passed, 0 failed
✓ auth/offline-access-not-supported: 14 passed, 0 failed
✓ auth/client-credentials-jwt: 8 passed, 0 failed
✓ auth/client-credentials-basic: 8 passed, 0 failed
✗ auth/cross-app-access-complete-flow: 8 passed, 2 failed
|
Sorry, something went wrong.
pcarleton
left a comment
There was a problem hiding this comment.
LGTM, thank you!
Sorry, something went wrong.
Implement OIDC-flavored refresh token guidance (SEP-2207) in the Python SDK client.
Motivation and Context
MCP clients interacting with OIDC-flavored Authorization Servers often don't receive refresh tokens because they aren't requesting offline_access. This leads to poor UX (frequent re-authentication). SEP-2207 provides guidance for how MCP clients should handle this.
The Python SDK's default OAuthClientMetadata already includes refresh_token in grant_types, but the client was not augmenting authorization request scopes with offline_access when the Authorization Server advertises support for it. This change brings the Python SDK in line with the TypeScript SDK's implementation.
How Has This Been Tested?
Breaking Changes
None. This is additive behavior. Clients that previously did not request offline_access will now request it automatically when the AS advertises it in scopes_supported and the client supports the refresh_token grant. Authorization Servers that don't recognize offline_access will simply ignore it per OAuth 2.1.
Types of changes
Checklist
Additional context