- Notifications
You must be signed in to change notification settings - Fork935
feat: implement OAuth2 dynamic client registration (RFC 7591/7592)#18645
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Uh oh!
There was an error while loading.Please reload this page.
Conversation
ThomasK33 commentedJun 27, 2025 • edited
Loading Uh oh!
There was an error while loading.Please reload this page.
edited
Uh oh!
There was an error while loading.Please reload this page.
3902793
tob37d850
Compareff83df4
to3665807
Compareb37d850
tocaf974c
Compare3665807
to56126dd
Comparecaf974c
to22b8b6d
Compare56126dd
tofca6b9a
Compare14c7196
toc43b551
Comparefca6b9a
to68baa21
Compare46d50e8
to61142ba
Comparea8a29d4
tof9e693d
Compare
Looking at the router/ Are you suggesting moving those handlers into a different package or moving the logic behind them into their own package, which then gets called from those API handlers? (I'm assuming the latter, but I want to be sure.) |
3760dd0
to2a41a65
Compare9629df1
todf790c7
Compare52c88e0
to4799b4b
Comparedf790c7
to17af791
Comparea07ba99
to5c1b9f6
Compare17af791
to3e15358
Compare3e15358
to6bea7a6
Compare6bea7a6
toe33d3d6
Compare… MCP compliance- Add comprehensive OAuth2 dynamic client registration support- Implement RFC 7591 client registration endpoint with proper validation- Implement RFC 7592 client management protocol (GET/PUT/DELETE)- Add RFC 6750 Bearer token authentication support- Fix authorization context issues with AsSystemRestricted- Add proper RBAC permissions for OAuth2 resources- Implement registration access token security per RFC 7592- Add comprehensive validation for redirect URIs, grant types, response types- Support custom schemes for native applications- Add database migration with all RFC-required fields- Add audit logging support for OAuth2 operations- Ensure full RFC compliance with proper error handling- Add comprehensive test coverage for all scenariosChange-Id: I36c711201d598a117f6bfc381fc74e07fc3cc365Signed-off-by: Thomas Kosiewski <tk@coder.com>
e33d3d6
to4f4e4f1
CompareAlright, so I did the refactoring in two PRs:
The main reason for this two PR approach was to make sure that the refactorings didn't break the tests, and that the test refactoring did not break the code. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
I don't have any further blocking comments, but would appreciate a second pair of eyes before merge in case I missed something.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
nit: the validation tests could probably live in codersdk alongside the func itself but open to it staying here either
74e1d5c
intomainUh oh!
There was an error while loading.Please reload this page.
Merge activity
|
Implement OAuth2 Dynamic Client Registration (RFC 7591/7592)
This PR implements OAuth2 Dynamic Client Registration according to RFC 7591 and Client Configuration Management according to RFC 7592. These standards allow OAuth2 clients to register themselves programmatically with Coder as an authorization server.
Key changes include:
Added database schema extensions to support RFC 7591/7592 fields in the
oauth2_provider_apps
tableImplemented
/oauth2/register
endpoint for dynamic client registration (RFC 7591)Added client configuration management endpoints (RFC 7592):
/oauth2/clients/{client_id}
Added comprehensive validation for OAuth2 client metadata:
Enhanced developer documentation with:
The implementation follows security best practices from the RFCs, including proper token handling, secure defaults, and appropriate error responses. This enables third-party applications to integrate with Coder's OAuth2 provider capabilities programmatically.