Nick Steele 9b4a0f8a0a Add enterprise IdP identity resolution for MCP OAuth (#40739) ...

## What changed

- Resolve stored enterprise IdP sessions against discovered authorization
  metadata, requiring the configured issuer, public-client authentication, and
  supported ID-JAG token exchange capabilities.
- Bind OIDC identity claims and MCP resource indicators to their configured
  issuer, client, and server, and require reauthentication when pinned keyring
  credentials are removed or replaced.
- Hold the credential lock while rereading refresh tokens, and isolate
  enterprise credentials by reserved namespace and Codex home.

## Testing

- Cover metadata and claim validation, resource binding, credential replacement
  and keyring failures, refresh locking, expired ID tokens, and credential
  namespace isolation.

GitOrigin-RevId: edce3c6159f7d6831edf72e9608b3fc3f5823c83

2026-08-25 23:51:57 +00:00

..

src

Add enterprise IdP identity resolution for MCP OAuth (#40739)

2026-08-25 23:51:57 +00:00

tests

Harden MCP OAuth callback handling (#40691)

2026-08-25 20:26:23 +00:00

BUILD.bazel

[3/4] Add executor-backed RMCP HTTP client (#18583)

2026-04-22 17:38:04 -07:00

Cargo.toml

Harden MCP OAuth fallback credential writes (#39611)

2026-08-20 06:17:48 +00:00