-
Notifications
You must be signed in to change notification settings - Fork 6.2k
Description
Expected Behavior
Spring authorization server supports "OAuth Client ID Metadata Document" described in https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-00. As it's still a draft document, it would also appreciated that, documentation describes how to extend the Client repository to support Client ID Metadata documents
Current Behavior
Spring authorization server does not have support for https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-00.
Context
I'm working on using Spring Authorization server as AS in MCP Authentication protocol.
My organization decided to not use DCR because of security risks (publicly available endpoints). Also MCP specification: https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization mentions "OAuth Client ID Metadata Document" as primary way of "registering" the client and DCR as fallback being there mainly for backward compatibility reasons
I also reported that ticket in Spring authorization server board: spring-projects/spring-authorization-server#2270