mirror of
https://github.com/suitenumerique/docs.git
synced 2026-09-26 11:35:05 +02:00
Anthony LC
de94df3fe7
The Django side of the MCP auth chain is already settings-driven, but the docs-mcp server was tied to Keycloak: KEYCLOAK_* env vars and a mandatory `aud=docs-mcp`, which needs a Keycloak audience mapper. The provider settings are now MCP_OIDC_ISSUER, MCP_OIDC_JWKS_URL and MCP_OIDC_DISCOVERY_URL. The audience check mirrors the backend's OIDC_RS_AUDIENCE_CLAIM: MCP_AUDIENCE_CLAIM picks the claim to check (`aud` by default, or `client_id` / `azp`) and MCP_ALLOWED_AUDIENCES lists the accepted values. The Keycloak-only `docs-mcp` scope is no longer hardcoded in the protected resource metadata; it moves to MCP_EXTRA_SCOPES. The documentation now lists what any OIDC provider must provide, with the Keycloak realm kept as the development example.
28 lines
1.4 KiB
Plaintext
28 lines
1.4 KiB
Plaintext
# docs-mcp: remote MCP server for Docs.
|
|
# See documentation/mcp_server.md.
|
|
|
|
MCP_HOST=0.0.0.0
|
|
MCP_PORT=4455
|
|
MCP_RESOURCE_URL=http://localhost:4455/mcp
|
|
|
|
# OIDC provider (the dev Keycloak realm here; any provider issuing JWT access tokens works).
|
|
# MCP_OIDC_ISSUER is the externally-visible issuer (used to validate the `iss` claim and in
|
|
# metadata); the *_URL vars are the network-reachable endpoints from inside Docker.
|
|
# This server only reads the provider's JWKS and discovery document — it holds no credentials
|
|
# and performs no token exchange; it forwards the caller's access token to Django as-is.
|
|
MCP_OIDC_ISSUER=http://localhost:8083/realms/impress
|
|
MCP_OIDC_JWKS_URL=http://nginx:8083/realms/impress/protocol/openid-connect/certs
|
|
MCP_OIDC_DISCOVERY_URL=http://nginx:8083/realms/impress/.well-known/openid-configuration
|
|
|
|
# Django is reached directly (not through nginx, which only proxies to Keycloak on :8083).
|
|
DOCS_API_URL=http://app-dev:8000
|
|
|
|
# Tokens must carry aud=docs-mcp, which the dev realm only adds when the `docs-mcp` optional
|
|
# scope is requested (so it is advertised to clients too). For a provider that cannot add a
|
|
# custom audience, allow-list the MCP client instead, e.g.:
|
|
# MCP_AUDIENCE_CLAIM=client_id (RFC 9068 providers; Keycloak user tokens carry `azp`)
|
|
# MCP_ALLOWED_AUDIENCES=docs-mcp-client
|
|
MCP_AUDIENCE_CLAIM=aud
|
|
MCP_ALLOWED_AUDIENCES=docs-mcp
|
|
MCP_EXTRA_SCOPES=docs-mcp
|