update

2026-08-17 11:19:05 -07:00
parent ca0f89a671
commit cf87fdba1a
6 changed files with 199 additions and 5 deletions
@@ -75,6 +75,16 @@ identity_providers:
        redirect_uris:
          - 'https://mcp.example.com/auth/callback'

+        # RFC 8707 resource indicators. The MCP server sends a 'resource'
+        # parameter identifying itself; Authelia validates it against this
+        # whitelist and returns 'invalid_target' if it isn't listed.
+        # Alternative: set OIDC_FORWARD_RESOURCE=false on the MCP server to
+        # stop sending it at all.
+        audience:
+          - 'https://mcp.example.com'
+          - 'https://mcp.example.com/mcp'
+        requested_audience_mode: 'implicit'
+
        # offline_access is what gets you a refresh token. Without it the
        # connector dies when the access token expires.
        scopes: