Skip to content

Add IncludeResourceIndicator option for OAuth and DI client sample#1402

Open
Varun6578 wants to merge 2 commits intomodelcontextprotocol:mainfrom
Varun6578:fix/oauth-resource-indicator-and-di-sample
Open

Add IncludeResourceIndicator option for OAuth and DI client sample#1402
Varun6578 wants to merge 2 commits intomodelcontextprotocol:mainfrom
Varun6578:fix/oauth-resource-indicator-and-di-sample

Conversation

@Varun6578
Copy link

Summary

This PR addresses two issues from the Backlog milestone:

Fix #648: OAuth authentication fails with MS Entra-ID

The SDK sends a resource parameter (RFC 8707) in OAuth authorization, token exchange, and token refresh requests. MS Entra-ID v2.0 does not support this parameter and returns AADSTS901002.

Changes:

  • Added IncludeResourceIndicator property to ClientOAuthOptions (defaults to true for backward compatibility)
  • When set to false, the resource parameter is omitted from all OAuth requests
  • Added test verifying the authorization URL omits the resource parameter when the option is disabled

Usage:

OAuth = new()
{
    ClientId = "my-client",
    RedirectUri = new Uri("http://localhost:1179/callback"),
    IncludeResourceIndicator = false, // For Entra-ID compatibility
    AuthorizationRedirectDelegate = HandleAuthorizationUrlAsync,
}

Fix #147: Add client sample with DI guidance

  • Created samples/DependencyInjectionClient showing how to register McpClient as a singleton via IServiceCollection and consume it from an IHostedService
  • Added DI wiring + Docker transport guidance section to docs/concepts/getting-started.md
  • Added new sample project to the solution file

Testing

  • All 49 OAuth tests pass across net8.0, net9.0, and net10.0
  • New test CanAuthenticate_WithoutResourceIndicator validates the feature
  • DI sample compiles and builds successfully

Varun Sharma and others added 2 commits February 28, 2026 14:31
Fix modelcontextprotocol#648: Add IncludeResourceIndicator option to ClientOAuthOptions to
allow suppressing the RFC 8707 'resource' parameter in OAuth requests.
This enables compatibility with OAuth providers like MS Entra-ID (Azure
AD v2.0) that do not support the resource parameter.

Fix modelcontextprotocol#147: Add DependencyInjectionClient sample project demonstrating
how to wire up MCP clients with Microsoft.Extensions.DependencyInjection
and IHostedService. Add DI guidance section to getting-started docs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…doc warning

- GetAccessTokenSilentAsync now omits the resource parameter from token
  refresh requests when IncludeResourceIndicator is false, matching the
  behavior of the 401 handler and authorization URL paths.
- Added warning comment in getting-started.md about .GetAwaiter().GetResult()
  deadlock risk in SynchronizationContext environments.
- Added end-to-end tests with mock Entra ID server (ExpectResource=false)
  validating full auth flow and token refresh without resource parameter.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Varun6578 Varun6578 force-pushed the fix/oauth-resource-indicator-and-di-sample branch from 5819a96 to b653294 Compare February 28, 2026 10:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

OAuth authentication request fails with MS Entra-ID Add client sample w/ guidance on wiring up dependency injection

1 participant