feat: add OAuth2 protected resource metadata endpoint for RFC 9728 #18643
+233
−2
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This was referenced Jun 27, 2025
ThomasK33
force-pushed
the
thomask33/06-27-feat_oauth2_implement_rfc_9728_protected_resource_metadata_endpoint
branch
2 times, most recently
from
5be6c6a to
fded148
Compare
ThomasK33
force-pushed
the
thomask33/feat_add_Go_LSP_configuration_and_code_navigation_documentation
branch
from
1e2bc51 to
3de973b
Compare
ThomasK33
force-pushed
the
thomask33/feat_add_Go_LSP_configuration_and_code_navigation_documentation
branch
from
3de973b to
9f159b0
Compare
ThomasK33
force-pushed
the
thomask33/06-27-feat_oauth2_implement_rfc_9728_protected_resource_metadata_endpoint
branch
2 times, most recently
from
9b7f5d9 to
7ef25b1
Compare
ThomasK33
force-pushed
the
thomask33/feat_add_Go_LSP_configuration_and_code_navigation_documentation
branch
2 times, most recently
from
47d9a0a to
bffc160
Compare
ThomasK33
force-pushed
the
thomask33/06-27-feat_oauth2_implement_rfc_9728_protected_resource_metadata_endpoint
branch
from
7ef25b1 to
f0608bc
Compare
ThomasK33
force-pushed
the
thomask33/feat_add_Go_LSP_configuration_and_code_navigation_documentation
branch
from
bffc160 to
e733c7b
Compare
ThomasK33
force-pushed
the
thomask33/06-27-feat_oauth2_implement_rfc_9728_protected_resource_metadata_endpoint
branch
2 times, most recently
from
c68a923 to
f55771a
Compare
ThomasK33
force-pushed
the
thomask33/feat_add_Go_LSP_configuration_and_code_navigation_documentation
branch
from
e733c7b to
70e8be9
Compare
ThomasK33
force-pushed
the
thomask33/06-27-feat_oauth2_implement_rfc_9728_protected_resource_metadata_endpoint
branch
from
f55771a to
34af681
Compare
ThomasK33
force-pushed
the
thomask33/feat_add_Go_LSP_configuration_and_code_navigation_documentation
branch
from
70e8be9 to
476c079
Compare
ThomasK33
force-pushed
the
thomask33/06-27-feat_oauth2_implement_rfc_9728_protected_resource_metadata_endpoint
branch
from
34af681 to
e72476e
Compare
ThomasK33
force-pushed
the
thomask33/feat_add_Go_LSP_configuration_and_code_navigation_documentation
branch
from
476c079 to
d2eb876
Compare
ThomasK33
force-pushed
the
thomask33/feat_add_Go_LSP_configuration_and_code_navigation_documentation
branch
from
d2eb876 to
bb57d1e
Compare
ThomasK33
force-pushed
the
thomask33/06-27-feat_oauth2_implement_rfc_9728_protected_resource_metadata_endpoint
branch
from
e72476e to
1a99f3c
Compare
johnstcn
reviewed
Jun 30, 2025
ThomasK33
changed the base branch from
thomask33/feat_add_Go_LSP_configuration_and_code_navigation_documentation
to
graphite-base/18643
ThomasK33
force-pushed
the
graphite-base/18643
branch
from
bb57d1e to
8949808
Compare
ThomasK33
force-pushed
the
thomask33/06-27-feat_oauth2_implement_rfc_9728_protected_resource_metadata_endpoint
branch
from
1a99f3c to
01a10ef
Compare
ThomasK33
changed the base branch from
graphite-base/18643
to
thomask33/feat_add_Go_LSP_configuration_and_code_navigation_documentation
johnstcn
approved these changes
Jul 1, 2025
ThomasK33
force-pushed
the
thomask33/06-27-feat_oauth2_implement_rfc_9728_protected_resource_metadata_endpoint
branch
from
01a10ef to
3b6d8ba
Compare
ThomasK33
force-pushed
the
thomask33/feat_add_Go_LSP_configuration_and_code_navigation_documentation
branch
from
8949808 to
373faa2
Compare
ThomasK33
force-pushed
the
thomask33/06-27-feat_oauth2_implement_rfc_9728_protected_resource_metadata_endpoint
branch
from
3b6d8ba to
dac326d
Compare
ThomasK33
force-pushed
the
thomask33/feat_add_Go_LSP_configuration_and_code_navigation_documentation
branch
from
373faa2 to
79a40a3
Compare
ThomasK33
force-pushed
the
thomask33/feat_add_Go_LSP_configuration_and_code_navigation_documentation
branch
from
79a40a3 to
2621adf
Compare
- Add OAuth2ProtectedResourceMetadata struct in codersdk/oauth2.go - Implement /.well-known/oauth-protected-resource endpoint handler - Register route in coderd.go for Protected Resource Metadata discovery - Add comprehensive test coverage in oauth2_metadata_test.go - Update OpenAPI documentation and generated API types - Correctly omit bearer_methods_supported field (Coder uses custom auth) - Support MCP OAuth2 compliance requirement for resource server metadata This implements RFC 9728 OAuth 2.0 Protected Resource Metadata to enable MCP clients to discover resource server capabilities and authorization servers. Change-Id: I089232ae755acf13eb0a7be46944c9eeaaafb75b Signed-off-by: Thomas Kosiewski <tk@coder.com>
ThomasK33
force-pushed
the
thomask33/06-27-feat_oauth2_implement_rfc_9728_protected_resource_metadata_endpoint
branch
from
dac326d to
1858134
Compare
Emyrk
approved these changes
Jul 1, 2025
| defer cancel() | ||
|
|
||
| // Use a plain HTTP client since this endpoint doesn't require authentication | ||
| req, err := http.NewRequestWithContext(ctx, http.MethodGet, serverURL.String()+"/.well-known/oauth-protected-resource", nil) |
There was a problem hiding this comment.
I prefer using something that handles a trailing slash on serverURL. Just a nit though, your call 👍
endpoint := serverURL.ResolveReference(&url.URL{Path: "/.well-known/oauth-authorization-server"}).String()
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add OAuth2 Protected Resource Metadata Endpoint
This PR implements the OAuth2 Protected Resource Metadata endpoint according to RFC 9728. The endpoint is available at
/.well-known/oauth-protected-resourceand provides information about Coder as an OAuth2 protected resource.Key changes:
/.well-known/oauth-protected-resourcethat returns metadata about Coder as an OAuth2 protected resourceOAuth2ProtectedResourceMetadatastruct in the SDKThe implementation currently returns basic metadata including the resource identifier and authorization server URL. The
scopes_supportedfield is empty until a scope system based on RBAC permissions is implemented. Thebearer_methods_supportedfield is omitted as Coder uses custom authentication methods rather than standard RFC 6750 bearer tokens.A TODO has been added to implement RFC 6750 bearer token support in the future.