Repository navigation
Enterprise-managed auth: ID-JAG resource claim should be optional #1404
Description
IdJagClaims.resource in transport/auth/enterprise.rs is required, so an ID-JAG without a resource claim fails with "malformed ID-JAG claims".
The spec makes it optional. The MCP EMA extension §4.3 says the claim "MUST contain the Resource Identifier of the MCP Server if present", and ID-JAG draft-04 §3.1 lists it as OPTIONAL. Some enterprise IdPs omit it, so rmcp-based clients such as Codex reject valid assertions.
Proposed fix: make the claim Option<Resource>. Exact-match it when present (as today); when absent, rely on the existing aud check. Still reject an explicit null, "" or [].
Happy to send a PR with tests.
Activity
github-actions commentedon Oct 28, 2026
@gocamille is on triage rotation this week and is the reviewer for this one.
Codex labeled this bug / P1 (T-security, T-transport). Please confirm or correct those labels.
Automated triage. Labels are a first pass and the assigned maintainer has the final say.
daviddanialy commentedon Oct 28, 2026
Confirmed with Okta Cross App Access (their enterprise-managed auth implementation): its ID-JAGs omit
resourceeven when the token exchange request includesresource=. So rmcp-based clients can't use Okta-issued ID-JAGs today.