https://descope.com logo
Join Slack
Powered by
I have created a test MCP server that uses Descope...
# ask-a-descoper
b
I have created a test MCP server that uses Descope for oAuth 2.1 use authentication and I am registering it as a Microsoft foundry tool and I am having some issues with the authorization redirect url not running the correct flow. Anyone know anything about that
k
Hi @Bob Maurer! What is the error that you're getting exactly as a query param?
b
So, I created a client entry under my mcp server and in foundry I created a tool and configured it's authorization values. I set the auth url to 
<https://descope.dev.insight2profit.com/login/P2tH1KiC5FmCxsuZRvfliS2aAaPH?flow=sign-in-use-s[…]f-enabled&tenant=7ca94846-d9f1-4260-b666-24ee494fb96f>
but, when I try to use the too and authorize, it seems to be opening a window to 
<https://descope.dev.insight2profit.com/login/P2tH1KiC5FmCxsuZRvfliS2aAaPH>
, which doesn't have the tenant or the flow
k
Ah so you're manually hardcoding a tenant to the flow hosting URL?
image.png
What is the flow you're using?
Can you paste the flow ID here?
b
MCP Sign In
So, I have to fill in the values manually in the azure foundry. I did that by browsing to my own well known endpoint. It gave me this:
Copy code
{
  "issuer": "<https://descope.dev.insight2profit.com/v1/apps/agentic/P2tH1KiC5FmCxsuZRvfliS2aAaPH/MS39cWHKuftLDuFtQLLRHpatBAlou>",
  "jwks_uri": "<https://descope.dev.insight2profit.com/P2tH1KiC5FmCxsuZRvfliS2aAaPH/.well-known/jwks.json>",
  "authorization_endpoint": "<https://descope.dev.insight2profit.com/oauth2/v1/apps/agentic/P2tH1KiC5FmCxsuZRvfliS2aAaPH/MS39cWHKuftLDuFtQLLRHpatBAlou/authorize>",
  "response_types_supported": [
    "code"
  ],
  "subject_types_supported": [
    "public"
  ],
  "id_token_signing_alg_values_supported": [
    "RS256"
  ],
  "token_endpoint": "<https://descope.dev.insight2profit.com/oauth2/v1/apps/agentic/P2tH1KiC5FmCxsuZRvfliS2aAaPH/MS39cWHKuftLDuFtQLLRHpatBAlou/token>",
  "userinfo_endpoint": "<https://descope.dev.insight2profit.com/oauth2/v1/apps/userinfo>",
  "claims_supported": [
    "iss",
    "aud",
    "iat",
    "exp",
    "sub",
    "name",
    "email",
    "email_verified",
    "phone_number",
    "phone_number_verified",
    "picture",
    "family_name",
    "given_name"
  ],
  "revocation_endpoint": "<https://descope.dev.insight2profit.com/oauth2/v1/apps/revoke>",
  "registration_endpoint": "<https://descope.dev.insight2profit.com/v1/mgmt/mcp/client/P2tH1KiC5FmCxsuZRvfliS2aAaPH/MS39cWHKuftLDuFtQLLRHpatBAlou/register>",
  "code_challenge_methods_supported": [
    "S256"
  ]
}
I took the token and authorization endpoint from that doc.
k
So it looks like you're using 
sign-in-use-sso-if-enabled
as a flow for this client right?
b
And, no, I should not be configuring some things manually. I might have said something incorrect to you
k
Let me see check your MCP configuration
b
Yes. I did in fact make a copy and paste error to you. In microsoft foundry, I am setting the auth url to 
<https://descope.dev.insight2profit.com/oauth2/v1/apps/agentic/P2tH1KiC5FmCxsuZRvfliS2aAaPH/MS39cWHKuftLDuFtQLLRHpatBAlou/authorize>
So, either there is a problem on your side or in the foundry. I am guessing it is in the foundry, but I have no other client to test my MCP server with that supports auth, at the moment
k
Hi @Bob Maurer are you able to hop on a call?
b
yes
k
I sent you a DM for the zoom link 🙂
Let us know if you have any more issues @Bob Maurer!
b
Still having issues. I responded to your thread
👍🏼 1
@Kevin Gao I tried to register my mcp server in MCPJam with a pre-created client, so using client id and secret, and it still gets the invalid client while trying to authenticate.
2 Views
Open in Slack
PreviousNext
Powered by