Gate the RFC 8707 resource parameter on advertised authorization-server support

Author: RhysSullivan

.changeset/oauth-resource-indicator-capability-gate.md

@@ -0,0 +1,19 @@
+---
+"executor": patch
+---
+
+**The RFC 8707 `resource` parameter is now gated on what the authorization server advertises**
+
+Executor sent `resource` unconditionally on every authorization, code exchange, refresh, and client-credentials request whenever an OAuth app had a resource configured. Microsoft Entra v2 rejects that: a request carrying both `resource` and a v2 `scope` such as `https://api.fabric.microsoft.com/.default` fails with `AADSTS9010010` before the consent screen, so the Microsoft Fabric Core MCP server could not be connected at all.
+
+The rule now applied on all four grants, in full:
+
+- **No authorization-server metadata was discovered → send `resource`.** Nothing is known about the server, and the MCP authorization spec expects resource indicators. This is the previous behavior, unchanged, and it covers every manually configured provider.
+- **Metadata was discovered and advertises `resource_indicators_supported: true` → send `resource`.**
+- **Metadata was discovered and the flag is absent or `false` → omit `resource`.** RFC 8414 §2 makes an omitted metadata field mean "not advertised", and RFC 8707 §2 makes `resource` optional for clients, so omitting it is conformant.
+
+The decision reads only what a server publishes about itself — there is no Microsoft special case and no host allowlist. `resource_indicators_supported` is not in the IANA authorization-server metadata registry (RFC 8707 registered no discovery parameter), but it is the only machine-readable signal a server gives, so discovery now parses it and threads it to the grant helpers.
+
+The protected resource is still discovered, validated against the requested endpoint, and retained in the flow state for MCP binding when the parameter itself is withheld. The `executor.oauth.has_resource` span attribute now reports what actually went on the wire rather than what was configured.
+
+Providers whose authorization server advertises the capability, and providers reached without any metadata discovery, are unaffected.

packages/core/sdk/src/oauth-discovery.test.ts

@@ -369,6 +369,9 @@ describe("beginDynamicAuthorization", () => {
             scopes_supported: ["openid", "profile", "email", "offline_access", "workspace:member"],
             response_types_supported: ["code"],
             code_challenge_methods_supported: ["S256"],
+            // An MCP-profile server implements RFC 8707, so it advertises it —
+            // that is what earns the `resource` parameter asserted below.
+            resource_indicators_supported: true,
           });
         }
         if (request.url === "/oauth/register") {
@@ -624,6 +627,7 @@ describe("beginDynamicAuthorization", () => {
               registration_endpoint: `${baseUrl}/register`,
               response_types_supported: ["code"],
               code_challenge_methods_supported: ["S256"],
+              resource_indicators_supported: true,
             });
           }
           if (request.url === "/register") {
@@ -652,6 +656,61 @@ describe("beginDynamicAuthorization", () => {
       ),
   );
 
+  // #1789 — Microsoft Entra v2 publishes authorization-server metadata, does
+  // NOT advertise RFC 8707, and rejects `resource` alongside a v2 `scope` with
+  // AADSTS9010010. Metadata that stays silent on the capability means "not
+  // advertised" (RFC 8414 §2), so the resource indicator is withheld — while
+  // the protected resource itself is still discovered and kept in the state
+  // for MCP binding.
+  it.effect("omits the resource parameter when the AS metadata does not advertise RFC 8707", () =>
+    withOAuthFixture(
+      (request, baseUrl) => {
+        if (request.url === "/.well-known/oauth-protected-resource/v1/mcp/core") {
+          return sendJson({
+            resource: baseUrl,
+            authorization_servers: [baseUrl],
+            scopes_supported: [`${baseUrl}/.default`],
+          });
+        }
+        if (request.url === "/.well-known/oauth-authorization-server") {
+          return sendJson({
+            issuer: baseUrl,
+            authorization_endpoint: `${baseUrl}/oauth2/v2.0/authorize`,
+            token_endpoint: `${baseUrl}/oauth2/v2.0/token`,
+            registration_endpoint: `${baseUrl}/register`,
+            response_types_supported: ["code"],
+            code_challenge_methods_supported: ["S256"],
+          });
+        }
+        if (request.url === "/register") {
+          return sendJson(
+            {
+              client_id: "entra-client",
+              redirect_uris: ["https://app/cb"],
+              token_endpoint_auth_method: "none",
+            },
+            201,
+          );
+        }
+        return notFound();
+      },
+      ({ baseUrl }) =>
+        Effect.gen(function* () {
+          const result = yield* beginDynamicAuthorization({
+            endpoint: `${baseUrl}/v1/mcp/core`,
+            redirectUrl: "https://app/cb",
+            state: "s",
+          });
+
+          const authUrl = new URL(result.authorizationUrl);
+          expect(authUrl.searchParams.has("resource")).toBe(false);
+          expect(authUrl.searchParams.get("scope")).toBe(`${baseUrl}/.default`);
+          // Withheld from the wire, still retained for MCP discovery/binding.
+          expect(result.state.resource).toBe(baseUrl);
+        }),
+    ),
+  );
+
   it.effect("includes client_uri in the DCR body", () =>
     withOAuthFixture(
       (request, baseUrl) => {

packages/core/sdk/src/oauth-discovery.ts

@@ -82,6 +82,14 @@ export const OAuthAuthorizationServerMetadataSchema = Schema.Struct({
   introspection_endpoint: Schema.optional(Schema.String),
   userinfo_endpoint: Schema.optional(Schema.String),
   id_token_signing_alg_values_supported: Schema.optional(StringArray),
+  /** Whether this server implements RFC 8707 resource indicators. RFC 8707
+   *  registered no metadata parameter, so this is a de-facto field rather than
+   *  an IANA-registered one — but it is the only machine-readable signal a
+   *  server gives, and `shouldSendResourceIndicator` reads it to decide whether
+   *  `resource` goes on authorization and token requests. An absent field means
+   *  "not advertised" (RFC 8414 §2), NOT "unknown": a server that publishes
+   *  metadata and stays silent here gets no `resource`. */
+  resource_indicators_supported: Schema.optional(Schema.Boolean),
   /** draft-ietf-oauth-identity-assertion-authz-grant-04 §7.2 — the
    *  authorization grant profiles this Resource Authorization Server
    *  implements. Advertising a profile says only that the server implements
@@ -898,6 +906,10 @@ export const beginDynamicAuthorization = (
       state: input.state,
       codeChallenge,
       resource: resourceValue,
+      // The AS metadata was just discovered, so its RFC 8707 capability is
+      // known: send `resource` only if it advertises support. Entra v2 rejects
+      // `resource` alongside a v2 `scope` (AADSTS9010010).
+      authorizationServerMetadata: authServer.metadata,
       endpointUrlPolicy: options.endpointUrlPolicy,
     });
 

packages/core/sdk/src/oauth-helpers.test.ts

@@ -26,7 +26,10 @@ import {
   isUnusableSuccessTokenResponse,
   refreshAccessToken,
   shouldRefreshToken,
+  shouldSendResourceIndicator,
+  type ResourceIndicatorSupport,
 } from "./oauth-helpers";
+import type { OAuthAuthorizationServerMetadata } from "./oauth-discovery";
 import { serveTestHttpApp } from "./testing";
 
 interface TokenCall {
@@ -1423,6 +1426,233 @@ describe("refreshAccessToken", () => {
   );
 });
 
+// ---------------------------------------------------------------------------
+// RFC 8707 resource indicators — the AS capability gate (#1789)
+//
+// THE RULE under test, on every grant that can carry `resource`:
+//   no metadata            → send    (unchanged; MCP's default expectation)
+//   metadata + flag true   → send
+//   metadata + flag absent → omit    (RFC 8414 §2: not advertised)
+//   metadata + flag false  → omit
+//
+// The "metadata + flag absent" row is the bug: Microsoft Entra v2 publishes
+// metadata, does not advertise resource indicators, and rejects `resource`
+// alongside a v2 `scope` with AADSTS9010010.
+// ---------------------------------------------------------------------------
+
+const RESOURCE = "https://api.example.com/v1/mcp";
+const AS_SUPPORTED: ResourceIndicatorSupport = { resource_indicators_supported: true };
+const AS_UNSUPPORTED: ResourceIndicatorSupport = { resource_indicators_supported: false };
+/** Metadata that exists but never mentions resource indicators — the Entra
+ *  shape. Typed as the whole discovered document, not just the one flag, so
+ *  this fixture stays honest about what a real caller threads through. */
+const AS_SILENT: OAuthAuthorizationServerMetadata = {
+  issuer: "https://login.microsoftonline.com/tenant/v2.0",
+  authorization_endpoint: "https://login.microsoftonline.com/tenant/oauth2/v2.0/authorize",
+  token_endpoint: "https://login.microsoftonline.com/tenant/oauth2/v2.0/token",
+};
+
+describe("shouldSendResourceIndicator", () => {
+  it("sends when no metadata was discovered", () => {
+    expect(shouldSendResourceIndicator()).toBe(true);
+    expect(shouldSendResourceIndicator(undefined)).toBe(true);
+    expect(shouldSendResourceIndicator(null)).toBe(true);
+  });
+
+  it("sends only when the server advertises support", () => {
+    expect(shouldSendResourceIndicator(AS_SUPPORTED)).toBe(true);
+    expect(shouldSendResourceIndicator(AS_UNSUPPORTED)).toBe(false);
+    expect(shouldSendResourceIndicator(AS_SILENT)).toBe(false);
+    expect(shouldSendResourceIndicator({})).toBe(false);
+  });
+});
+
+describe("buildAuthorizationUrl resource-indicator gating", () => {
+  const baseInput = {
+    authorizationUrl: "https://example.com/authorize",
+    clientId: "client-123",
+    redirectUrl: "https://app.example.com/callback",
+    scopes: ["https://api.fabric.microsoft.com/.default"] as const,
+    state: "state-abc",
+    codeChallenge: "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
+    resource: RESOURCE,
+  };
+
+  it("sends resource when no authorization-server metadata is known", () => {
+    const url = new URL(buildAuthorizationUrl(baseInput));
+    expect(url.searchParams.get("resource")).toBe(RESOURCE);
+  });
+
+  it("sends resource when the server advertises resource_indicators_supported", () => {
+    const url = new URL(
+      buildAuthorizationUrl({ ...baseInput, authorizationServerMetadata: AS_SUPPORTED }),
+    );
+    expect(url.searchParams.get("resource")).toBe(RESOURCE);
+  });
+
+  it("omits resource when the server publishes metadata without the capability", () => {
+    for (const metadata of [AS_UNSUPPORTED, AS_SILENT]) {
+      const url = new URL(
+        buildAuthorizationUrl({ ...baseInput, authorizationServerMetadata: metadata }),
+      );
+      expect(url.searchParams.has("resource")).toBe(false);
+      // The scope the AS DOES accept must survive the veto untouched.
+      expect(url.searchParams.get("scope")).toBe("https://api.fabric.microsoft.com/.default");
+    }
+  });
+});
+
+describe("exchangeAuthorizationCode resource-indicator gating", () => {
+  const exchange = (
+    tokenUrl: string,
+    authorizationServerMetadata?: ResourceIndicatorSupport | null,
+  ) =>
+    exchangeAuthorizationCode({
+      tokenUrl,
+      clientId: "cid",
+      redirectUrl: "https://app.example.com/cb",
+      codeVerifier: "verifier",
+      code: "abc",
+      resource: RESOURCE,
+      authorizationServerMetadata,
+    });
+
+  it.effect("sends resource when no authorization-server metadata is known", () =>
+    withTokenEndpoint(tokenResponse(validCodeBody), ({ tokenUrl, calls }) =>
+      Effect.gen(function* () {
+        yield* exchange(tokenUrl);
+        expect((yield* calls)[0]!.body.get("resource")).toBe(RESOURCE);
+      }),
+    ),
+  );
+
+  it.effect("sends resource when the server advertises support", () =>
+    withTokenEndpoint(tokenResponse(validCodeBody), ({ tokenUrl, calls }) =>
+      Effect.gen(function* () {
+        yield* exchange(tokenUrl, AS_SUPPORTED);
+        expect((yield* calls)[0]!.body.get("resource")).toBe(RESOURCE);
+      }),
+    ),
+  );
+
+  it.effect("omits resource when the server publishes metadata without the capability", () =>
+    withTokenEndpoint(tokenResponse(validCodeBody), ({ tokenUrl, calls }) =>
+      Effect.gen(function* () {
+        yield* exchange(tokenUrl, AS_SILENT);
+        yield* exchange(tokenUrl, AS_UNSUPPORTED);
+        const bodies = (yield* calls).map((call) => call.body);
+        expect(bodies).toHaveLength(2);
+        for (const body of bodies) {
+          expect(body.has("resource")).toBe(false);
+          // The grant itself is untouched — only `resource` is withheld.
+          expect(body.get("grant_type")).toBe("authorization_code");
+          expect(body.get("code_verifier")).toBe("verifier");
+        }
+      }),
+    ),
+  );
+});
+
+describe("exchangeClientCredentials resource-indicator gating", () => {
+  const exchange = (
+    tokenUrl: string,
+    authorizationServerMetadata?: ResourceIndicatorSupport | null,
+  ) =>
+    exchangeClientCredentials({
+      tokenUrl,
+      clientId: "cid",
+      clientSecret: "secret",
+      scopes: ["https://api.fabric.microsoft.com/.default"],
+      resource: RESOURCE,
+      authorizationServerMetadata,
+    });
+
+  it.effect("sends resource when no authorization-server metadata is known", () =>
+    withTokenEndpoint(tokenResponse(validRefreshBody), ({ tokenUrl, calls }) =>
+      Effect.gen(function* () {
+        yield* exchange(tokenUrl);
+        expect((yield* calls)[0]!.body.get("resource")).toBe(RESOURCE);
+      }),
+    ),
+  );
+
+  it.effect("sends resource when the server advertises support", () =>
+    withTokenEndpoint(tokenResponse(validRefreshBody), ({ tokenUrl, calls }) =>
+      Effect.gen(function* () {
+        yield* exchange(tokenUrl, AS_SUPPORTED);
+        expect((yield* calls)[0]!.body.get("resource")).toBe(RESOURCE);
+      }),
+    ),
+  );
+
+  it.effect("omits resource when the server publishes metadata without the capability", () =>
+    withTokenEndpoint(tokenResponse(validRefreshBody), ({ tokenUrl, calls }) =>
+      Effect.gen(function* () {
+        yield* exchange(tokenUrl, AS_SILENT);
+        yield* exchange(tokenUrl, AS_UNSUPPORTED);
+        const bodies = (yield* calls).map((call) => call.body);
+        expect(bodies).toHaveLength(2);
+        for (const body of bodies) {
+          expect(body.has("resource")).toBe(false);
+          expect(body.get("grant_type")).toBe("client_credentials");
+          expect(body.get("scope")).toBe("https://api.fabric.microsoft.com/.default");
+        }
+      }),
+    ),
+  );
+});
+
+describe("refreshAccessToken resource-indicator gating", () => {
+  const refresh = (
+    tokenUrl: string,
+    authorizationServerMetadata?: ResourceIndicatorSupport | null,
+  ) =>
+    refreshAccessToken({
+      tokenUrl,
+      clientId: "cid",
+      refreshToken: "old",
+      resource: RESOURCE,
+      authorizationServerMetadata,
+    });
+
+  it.effect("sends resource when no authorization-server metadata is known", () =>
+    withTokenEndpoint(tokenResponse(validRefreshBody), ({ tokenUrl, calls }) =>
+      Effect.gen(function* () {
+        yield* refresh(tokenUrl);
+        expect((yield* calls)[0]!.body.get("resource")).toBe(RESOURCE);
+      }),
+    ),
+  );
+
+  it.effect("sends resource when the server advertises support", () =>
+    withTokenEndpoint(tokenResponse(validRefreshBody), ({ tokenUrl, calls }) =>
+      Effect.gen(function* () {
+        yield* refresh(tokenUrl, AS_SUPPORTED);
+        expect((yield* calls)[0]!.body.get("resource")).toBe(RESOURCE);
+      }),
+    ),
+  );
+
+  // Refresh builds its extra params conditionally and passes `undefined` when
+  // the set is empty, so the veto must leave a well-formed refresh request
+  // rather than an empty `additionalParameters` bag.
+  it.effect("omits resource when the server publishes metadata without the capability", () =>
+    withTokenEndpoint(tokenResponse(validRefreshBody), ({ tokenUrl, calls }) =>
+      Effect.gen(function* () {
+        yield* refresh(tokenUrl, AS_SILENT);
+        yield* refresh(tokenUrl, AS_UNSUPPORTED);
+        const bodies = (yield* calls).map((call) => call.body);
+        expect(bodies).toHaveLength(2);
+        for (const body of bodies) {
+          expect(body.has("resource")).toBe(false);
+          expect(body.get("grant_type")).toBe("refresh_token");
+          expect(body.get("refresh_token")).toBe("old");
+        }
+      }),
+    ),
+  );
+});
+
 describe("shouldRefreshToken", () => {
   it("never refreshes when expiresAt is null", () => {
     expect(shouldRefreshToken({ expiresAt: null })).toBe(false);