mirror of
https://github.com/openai/codex.git
synced 2026-09-14 11:57:03 +00:00
654b0a77d0
## Why Enterprise MCP authorization must remain controlled by host, user, or managed configuration. Project settings and plugin declarations must not redirect enterprise credentials or downgrade the selected authentication mode. ## What changed - Add `auth = "ema_auth"`, shared `mcp_enterprise_managed_auth` IdP configuration, and per-plugin enterprise registration settings. - Require enterprise registrations to come from one non-project configuration layer, preserve managed IdP precedence, and reject project overrides that change authorization or re-enable disabled enterprise servers. - Add the disabled-by-default `use_xaa` feature flag and require non-project opt-in or a managed requirement. - Reject plugin declarations that select `ema_auth`. Keep EMA connections unsupported and block ordinary MCP OAuth login and credential fallback for this mode. - Extend the configuration schema and serialization for the new settings. ## Testing Add coverage for IdP precedence, incomplete registrations, alternate credential validation, project-only opt-in, plugin self-declaration rejection, configuration round-tripping, and trusted-project attempts to downgrade enterprise auth to OAuth or ChatGPT auth. GitOrigin-RevId: f193bdfda74208c98e496a23bf2916955b131a1c