update

server.py

@@ -81,10 +81,21 @@ def create_server(settings: Settings) -> FastMCP:
         lifespan=lifespan,
     )
 
-    if settings.github_allowed_users:
-        from .authz import GitHubAllowlistMiddleware
+    if settings.allowed_users or settings.required_groups:
+        from .authz import IdentityAllowlistMiddleware
 
-        mcp.add_middleware(GitHubAllowlistMiddleware(settings.github_allowed_users))
+        mcp.add_middleware(
+            IdentityAllowlistMiddleware(
+                allowed_users=settings.allowed_users,
+                required_groups=settings.required_groups,
+                groups_claim=settings.oidc_groups_claim,
+            )
+        )
+    elif settings.auth_mode not in {"none", "token"}:
+        logger.warning(
+            "OAuth is enabled but MCP_ALLOWED_USERS and MCP_REQUIRED_GROUPS are both "
+            "empty: anyone who can log in to your identity provider can use this server."
+        )
 
     # ------------------------------------------------------------------ read
 
@@ -351,22 +362,51 @@ def _build_auth(settings: Settings):
             }
         )
 
-    if "github" not in mode:
+    oauth = None
+
+    if "github" in mode:
+        from fastmcp.server.auth.providers.github import GitHubProvider
+
+        oauth = GitHubProvider(
+            client_id=settings.github_client_id,
+            client_secret=settings.github_client_secret,
+            base_url=settings.public_url,
+            redirect_path="/auth/callback",
+            required_scopes=["read:user"],
+        )
+
+    elif "oidc" in mode:
+        from fastmcp.server.auth.oidc_proxy import OIDCProxy
+
+        # OIDC_SCOPES overrides this entirely when a provider needs something
+        # specific. Otherwise: identify the user, ask for groups only when group
+        # checks are configured (some providers reject unknown scopes), and
+        # request offline_access so the connection survives token expiry.
+        if settings.oidc_scopes:
+            scopes = settings.oidc_scopes
+        else:
+            scopes = ["openid", "profile", "email", "offline_access"]
+            if settings.required_groups:
+                scopes.insert(3, settings.oidc_groups_claim)
+
+        oauth = OIDCProxy(
+            config_url=settings.oidc_config_url,
+            client_id=settings.oidc_client_id,
+            client_secret=settings.oidc_client_secret,
+            base_url=settings.public_url,
+            redirect_path="/auth/callback",
+            required_scopes=scopes,
+            # Some providers (Authelia, Okta) issue opaque access tokens that
+            # can't be validated as JWTs. Setting OIDC_VERIFY_ID_TOKEN=true
+            # verifies the ID token instead, which is always a signed JWT.
+            verify_id_token=settings.oidc_verify_id_token,
+        )
+
+    if oauth is None:
         return verifier
-
-    from fastmcp.server.auth.providers.github import GitHubProvider
-
-    github = GitHubProvider(
-        client_id=settings.github_client_id,
-        client_secret=settings.github_client_secret,
-        base_url=settings.public_url,
-        redirect_path="/auth/callback",
-        required_scopes=["read:user"],
-    )
-
     if verifier is None:
-        return github
+        return oauth
 
     from fastmcp.server.auth import MultiAuth
 
-    return MultiAuth(server=github, verifiers=[verifier], base_url=settings.public_url)
+    return MultiAuth(server=oauth, verifiers=[verifier], base_url=settings.public_url)