Package com.xebialabs.xlrelease.mcp.oauth

Class McpAuthenticationEntryPoint

java.lang.Object
org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint
com.xebialabs.deployit.plumbing.authentication.Http401AuthenticationEntryPoint
com.xebialabs.xlrelease.mcp.oauth.McpAuthenticationEntryPoint
All Implemented Interfaces:
org.springframework.beans.factory.InitializingBean, org.springframework.security.web.AuthenticationEntryPoint
public class McpAuthenticationEntryPoint extends com.xebialabs.deployit.plumbing.authentication.Http401AuthenticationEntryPoint
Entry point for the MCP endpoint's security chain: behaves like Http401AuthenticationEntryPoint, but additionally advertises the RFC 9728 protected resource metadata on the 401 via a WWW-Authenticate: Bearer resource_metadata="..." challenge. This is the discovery hint that lets MCP clients (Claude, etc.) locate the OIDC authorization server and start the OAuth 2.1 + PKCE flow. Clients that authenticate with a PAT or basic auth never see a 401, so they are unaffected.

  • Constructor Summary

    Constructors
    Constructor
    Description
    McpAuthenticationEntryPoint(Supplier<Optional<String>> resourceMetadataUrl)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    commence(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, org.springframework.security.core.AuthenticationException authException)
     

    Methods inherited from class org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint

    afterPropertiesSet, getRealmName, setRealmName

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • McpAuthenticationEntryPoint

      public McpAuthenticationEntryPoint(Supplier<Optional<String>> resourceMetadataUrl)
      Parameters:
      resourceMetadataUrl - supplier of the absolute protected-resource-metadata URL; empty when discovery should not be advertised (no OIDC issuer configured or MCP server disabled) — then the parent's plain 401 is sent.

  • Method Details

    • commence

      public void commence(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, org.springframework.security.core.AuthenticationException authException) throws IOException
      Specified by:
      commence in interface org.springframework.security.web.AuthenticationEntryPoint
      Overrides:
      commence in class com.xebialabs.deployit.plumbing.authentication.Http401AuthenticationEntryPoint
      Throws:
      IOException