feat(oauth): forward-mode OAuth broker with X-JWT-Assertion pass-through - #1
Open
BorisTyshkevich wants to merge 2 commits into
Open
feat(oauth): forward-mode OAuth broker with X-JWT-Assertion pass-through#1BorisTyshkevich wants to merge 2 commits into
BorisTyshkevich wants to merge 2 commits into
Conversation
…iterations Cross-compiles the mcp-grafana binary on the host (CGO_ENABLED=0), assembles the image with legacy `docker build` per arch, and stitches a multi-arch manifest. Sidesteps buildx, whose privileged builder is blocked by the sandbox docker proxy. Lets us push fork images to ghcr.io/altinity/mcp-grafana without round-tripping through upstream CI. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds an opt-in OAuth broker (--oauth-enabled) that validates inbound bearers against an upstream IdP, mounts /oauth/* + RFC 9728 discovery, and forwards the raw bearer to Grafana as X-JWT-Assertion. Grafana's [auth.jwt] block validates the assertion independently and maps it to a user, so per-user identity reaches Grafana while the existing service-account token continues to authorise the API call. Secret-bearing config (client secret, signing secret) is read from files / env only — never command-line flags — to avoid leaks into `ps eww`, shell history, or container metadata. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds an opt-in forward-mode OAuth broker (
--oauth-enabled) so the MCP server can validate inbound user bearers against an upstream IdP, mount/oauth/*+ RFC 9728 discovery, and forward the raw bearer to Grafana asX-JWT-Assertion. Grafana's[auth.jwt]block validates the assertion independently and maps it to a user, so per-user identity reaches Grafana while the existing service-account token continues to authorise the API call.Also includes a per-arch local build script +
Dockerfile.localfor iterating on the fork without round-tripping through upstream CI.What's in this PR
pkg/oauth/wiring.go+ tests — the broker itself: upstream IdP discovery, JWKS-backed bearer validation, audience/required-scope/email-domain/hosted-domain checks, stateless auth-code + pending-auth artifacts (HKDF-derived JWE keys), RFC 9728 protected-resource metadata.mcpgrafana.go—JWTAssertionfield onGrafanaConfigand a newJWTAssertionRoundTripperinstalled by default inBuildTransport. The round-tripper is purely additive: it setsX-JWT-Assertionif present on the request context, never touchesAuthorization, so the existing SA-token bearer continues to authorise the call.cmd/mcp-grafana/main.go—oauthFlagssurface with every secret-bearing field read from files / env only (never CLI flags), so they don't leak intops eww, shell history, or container metadata.Dockerfile.local+scripts/build-mcp-image.sh— cross-compile the binary on the host, build the image with legacydocker buildper arch, stitch a multi-arch manifest. Sidesteps buildx (whose privileged builder is blocked in our sandbox).Why
Per-user identity in OAuth-secured Grafana deployments — needed for downstream features (the vertamedia ClickHouse adapter in the follow-up PR depends on this).
Test plan
go test -tags unit ./...— green--oauth-enabled, sign in via the upstream IdP, hit an MCP tool, observeX-JWT-Assertionlands on Grafana and[auth.jwt]resolves the right user.JWTAssertion).🤖 Generated with Claude Code