Repository navigation
SDK Implementation of Authorization is not compatible with the specification. code_challenge_methods_supported is handled incorrectly #730
Description
Describe the bug
Authorization part of the C# SDK is not compatible with the spec.
This might create unneeded confusion and delay solving of the actual problems.
According to the spec
OAuth 2.0 Authorization Server Metadata: If code_challenge_methods_supported is absent, the authorization server does not support PKCE and MCP clients MUST refuse to proceed.
The implementation is not behaving as expected:
metadata.CodeChallengeMethodsSupported ??= ["S256"];
This might be related to Azure Entra ID and and Azure B2C not following rfc8414
see:
modelcontextprotocol/inspector#685
https://learn.microsoft.com/en-us/answers/questions/218113/openid-connect-authorization-code-flow-with-proof
The follow up question arises:
Do I understand it correctly that Azure Entra ID and Azure B2C can not be used as authorization servers for any spec compatible MCP client ?
I would really like to see Azure Entra ID on the list.
Could you please share what is the plan for this ?
I see only 2 options:
- Changing the MCP spec
- Fixing Azure Entra ID compliancy to https://datatracker.ietf.org/doc/html/rfc8414
Thank you !
Activity
kamranayub commentedon Oct 24, 2025
Just ran into this from the Inspector POV.
One note though is that it should work with Entra ID, with some heavy lifting done by APIM:
https://den.dev/blog/remote-mcp-server/#prerequisites
And there's also a non-DCR implementation here (that only works with VS Code right now):
https://github.com/Azure-Samples/mcp-sdk-functions-hosting-dotnet/tree/main?tab=readme-ov-file#server-authorization-using-azure-api-management-apim
Since I'm building a demo with Azure Functions and BYO MCP server (using this SDK), I'm still trying to figure this all out.
Edit: The custom patches to inspector are working.
I can use MCP Inspector to initiate and connect to the MCP server using an Entra ID flow. A few things I had to do:
sts.windows.net(even though the authorization server islogin.microsoftonline.com)api://{client_id}/mcp)Edit 2: The auth flow works in VS Code as well.
I did not have to change any C# SDK code to make this work -- only had to patch the inspector.
jeffhandley commentedon Jun 25, 2026
Thanks for your patience on this, @kamranayub. The pending 2.0.0 version of the SDK and the 2026-07-18 spec has a lot of changes around auth. We are going to review this to see if it's still relevant. If you have any updated info on it yourself, we'd appreciate your input.
Assigning to @PranavSenthilnathan for confirmation it's still relevant though. If so, we will look into fixing in as part of 2.x.
Enforce PKCE metadata compliance in OAuth client (#730) (#1700)