Repository navigation
fix(auth): accept ID-JAGs without a resource claim - #1406
daviddanialy wants to merge 2 commits into
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
github-actions
Bot
added
T-test
|
@gocamille is on triage rotation this week and is the reviewer for this one. Labels come from the PR labeler. Please review the change. Automated triage. Labels are a first pass and the assigned maintainer has the final say. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 51e8177fc5
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Fixes #1404
The ID-JAG validation in
transport/auth/enterprise.rsrequired aresourceclaim, but the claim is optional in draft-ietf-oauth-identity-assertion-authz-grant, and the MCP EMA extension only constrains it when present. Okta Cross App Access omits it, so rmcp clients couldn't use Okta-issued ID-JAGs.IdJagClaims.resourceis nowOption<Resource>. An omitted claim is accepted; an explicitnullis still rejected.resource) must still exactly match the requested resource. Without it, the ID-JAG is bound to the resource AS byaud.nullcases, and an end-to-end redemption without the claim.