update

bookstack_mcp/config.py

@@ -59,6 +59,8 @@ class Settings:
     oidc_verify_id_token: bool = False
     oidc_groups_claim: str = "groups"
     oidc_scopes: list[str] = field(default_factory=list)
+    oidc_forward_resource: bool = True
+    oidc_required_scopes: list[str] = field(default_factory=list)
 
     # --- Who may use the server (applies to both GitHub and OIDC) ---
     allowed_users: list[str] = field(default_factory=list)
@@ -101,6 +103,8 @@ class Settings:
             oidc_verify_id_token=_bool("OIDC_VERIFY_ID_TOKEN", False),
             oidc_groups_claim=os.environ.get("OIDC_GROUPS_CLAIM", "groups"),
             oidc_scopes=_list("OIDC_SCOPES"),
+            oidc_forward_resource=_bool("OIDC_FORWARD_RESOURCE", True),
+            oidc_required_scopes=_list("OIDC_REQUIRED_SCOPES"),
             # GITHUB_ALLOWED_USERS is the old name, still honoured.
             allowed_users=[
                 u.lower() for u in (_list("MCP_ALLOWED_USERS") or _list("GITHUB_ALLOWED_USERS"))

bookstack_mcp/server.py

@@ -389,17 +389,33 @@ def _build_auth(settings: Settings):
             if settings.required_groups:
                 scopes.insert(3, settings.oidc_groups_claim)
 
+        # Two different things that are easy to conflate:
+        #   scopes           -> what we ASK the IdP for
+        #   required_scopes  -> what must be present on every incoming token
+        # FastMCP's issued token only carries the scopes the IdP echoes back in
+        # its token response. If a requested scope isn't echoed (Authelia does
+        # not always echo offline_access), enforcing the full request list
+        # rejects every call with invalid_token, and the client loops
+        # refreshing. So validation defaults to nothing unless explicitly set.
+        required = settings.oidc_required_scopes or []
+
         oauth = OIDCProxy(
             config_url=settings.oidc_config_url,
+            extra_authorize_params={"scope": " ".join(scopes)},
             client_id=settings.oidc_client_id,
             client_secret=settings.oidc_client_secret,
             base_url=settings.public_url,
             redirect_path="/auth/callback",
-            required_scopes=scopes,
+            required_scopes=required,
             # Some providers (Authelia, Okta) issue opaque access tokens that
             # can't be validated as JWTs. Setting OIDC_VERIFY_ID_TOKEN=true
             # verifies the ID token instead, which is always a signed JWT.
             verify_id_token=settings.oidc_verify_id_token,
+            # RFC 8707 resource indicators. Authelia validates the forwarded
+            # 'resource' against the client's audience whitelist and returns
+            # invalid_target if it isn't listed. Either whitelist it there or
+            # set OIDC_FORWARD_RESOURCE=false to stop sending it.
+            forward_resource=settings.oidc_forward_resource,
         )
 
     if oauth is None: