Nick Steele f6805328c4 Add enterprise ID-JAG exchange for MCP OAuth (#40722) ...

## What changed

- Add a non-interactive two-step exchange that obtains an ID-JAG from an
  enterprise identity provider and trades it for a resource-bound MCP bearer
  token.
- Validate trusted endpoint URLs, request inputs, ID-JAG claims, resource and
  scope bindings, and token responses before credentials are forwarded or a
  bearer token is returned.
- Expose structured authentication failures while redacting credentials and
  provider-controlled error details from diagnostics.

## Testing

- Cover successful exchanges, signed scope narrowing, invalid claims and token
  responses, request validation, and error redaction.

GitOrigin-RevId: d716e0e1c2dc6b230cecbc0e9cc09afeee81d599

2026-08-25 22:12:41 +00:00

..

src

Add enterprise ID-JAG exchange for MCP OAuth (#40722)

2026-08-25 22:12:41 +00:00

tests

Harden MCP OAuth callback handling (#40691)

2026-08-25 20:26:23 +00:00

BUILD.bazel

[3/4] Add executor-backed RMCP HTTP client (#18583)

2026-04-22 17:38:04 -07:00

Cargo.toml

Harden MCP OAuth fallback credential writes (#39611)

2026-08-20 06:17:48 +00:00