Wiki source code of Set Up MCP Authentication
Last modified by Vincent Massol on 2026/09/04 18:05
Show last authors
| author | version | line-number | content |
|---|---|---|---|
| 1 | Make connecting agents authenticate as real wiki users, so that what they may read and write is bounded by that user's rights (see [[MCP User Permissions>>doc:documentation.extensions.admin.llm.mcp-server.user-permissions.WebHome]]). Until you do, the endpoint answers unauthenticated callers as guest. | ||
| 2 | |||
| 3 | 1. Install the [[OpenID Connect Provider>>doc:extensions:Extension.OpenID Connect.OpenID Connect Provider.WebHome]] extension. | ||
| 4 | 1. Open "Users & Rights > OpenID Connect" in the wiki's administration and set the clients to "Dynamic mode".((( | ||
| 5 | {{image reference="oidc-dynamic-mode.png" size="large" alt="The Clients part of the OpenID Connect administration section, with the Dynamic mode option highlighted and selected"/}} | ||
| 6 | ))) | ||
| 7 | 1. Open "Users & Rights > Authentication" and set the authenticator to "Token based authenticator" (see "[[Select the Authenticator>>doc:documentation.xs.admin.authentication.select-authenticator.WebHome]]").((( | ||
| 8 | {{image reference="token-authenticator.png" size="large" alt="The Authentication service administration section, with Token based authenticator highlighted in the list of authentication services"/}} | ||
| 9 | ))) | ||
| 10 | 1. Set up a fallback authenticator if the wiki still needs its own login form (see the [[OpenID Connect Provider>>doc:extensions:Extension.OpenID Connect.OpenID Connect Provider.WebHome||anchor="HToken-basedaccess"]] documentation). | ||
| 11 | 1. Connect an agent and check that it is sent through the login flow. Guest access is now refused, and an unauthenticated caller receives HTTP 401 with a {{code}}WWW-Authenticate{{/code}} header pointing at this wiki's OIDC provider metadata.((( | ||
| 12 | {{image reference="oidc-consent.png" size="large" alt="The consent screen the wiki shows the connecting agent, listing what the client is requesting access to, with the Accept button highlighted"/}} | ||
| 13 | ))) |
