Skip to content

SEP-2352: Clarify authorization server binding and migration#2352

Merged
mcp-commander[bot] merged 13 commits into
mainfrom
den/as
Mar 28, 2026
Merged

SEP-2352: Clarify authorization server binding and migration#2352
mcp-commander[bot] merged 13 commits into
mainfrom
den/as

Conversation

@dend

@dend dend commented Mar 4, 2026

Copy link
Copy Markdown
Contributor

Summary

Test plan

  • npx prettier --check passes
  • npm run check:docs:js-comments passes
  • Review rendered docs for correct formatting

🤖 Generated with Claude Code

@dend dend requested a review from a team as a code owner March 4, 2026 22:42
Add guidance for clients on binding persisted client credentials to
specific authorization servers and handling AS changes. Clarifies
multi-AS behavior when multiple servers are listed in
authorization_servers.

Closes #1349

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@dend dend changed the title docs: clarify authorization server binding and migration SEP-2352: Clarify authorization server binding and migration Mar 4, 2026
@dend dend self-assigned this Mar 4, 2026
@dend dend added auth security SEP draft SEP proposal with a sponsor. labels Mar 4, 2026
@dend dend moved this to In Review in SEP Review Pipeline Mar 4, 2026

@pcarleton pcarleton left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a good change. Both typescript and python will need to adjustments.

Should be straightforward to conformance test as well, and key it on DCR support.

Comment thread docs/specification/draft/basic/authorization.mdx Outdated
localden and others added 2 commits March 5, 2026 08:15
Co-authored-by: Kaixuan Luo <30545735+KevinLuo2000@users.noreply.github.com>
Co-authored-by: Kaixuan Luo <30545735+KevinLuo2000@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Comment thread docs/specification/draft/basic/authorization.mdx Outdated
Co-authored-by: Max Gerber <89937743+max-stytch@users.noreply.github.com>
Comment thread docs/specification/draft/basic/authorization.mdx Outdated
Comment thread docs/specification/draft/basic/authorization.mdx Outdated
Comment thread docs/specification/draft/basic/authorization.mdx Outdated
dend and others added 3 commits March 6, 2026 14:29
Co-authored-by: Wils Dawson <wils.dawson@gmail.com>
Co-authored-by: Wils Dawson <wils.dawson@gmail.com>
Co-authored-by: Wils Dawson <wils.dawson@gmail.com>
@guglielmo-san

Copy link
Copy Markdown

I am implementing this SEP in the Go SDK and would like to clarify a couple of cases regarding client credential management:

  1. The SEP states that clients that persist client credentials obtained via DCR must associate them with the specific AS keyed by the issuer identifier. Go SDK does not persist credentials but performs DCR dynamically on-demand (e.g., every time authorization is needed or after a token expires). Is persistence of DCR credentials considered a MUST or a SHOULD for compliance with this SEP?
  2. The SEP states clients MUST maintain separate registration state per authorization server. RFC 9728 Section 7.6 defers server selection to the client. Is a client that always selects only the first AS from authorization_servers (and never attempts others) considered compliant? Or is there an expectation that clients should attempt alternative servers on authorization failure?

@localden localden added final SEP finalized. and removed accepted SEP accepted by core maintainers, but still requires final wording and reference implementation. labels Jun 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

Status: Accepted

Development

Successfully merging this pull request may close these issues.

The authorization spec is unclear when multiple Authorization servers are involved

10 participants