Set Up MCP Authentication
Last modified by Vincent Massol on 2026/09/04 18:05
Steps
Make connecting agents authenticate as real wiki users, so that what they may read and write is bounded by that user's rights (see MCP User Permissions). Until you do, the endpoint answers unauthenticated callers as guest.
- Install the OpenID Connect Provider extension.
- Open "Users & Rights > OpenID Connect" in the wiki's administration and set the clients to "Dynamic mode".
- Open "Users & Rights > Authentication" and set the authenticator to "Token based authenticator" (see "Select the Authenticator").
- Set up a fallback authenticator if the wiki still needs its own login form (see the OpenID Connect Provider documentation).
- Connect an agent and check that it is sent through the login flow. Guest access is now refused, and an unauthenticated caller receives HTTP 401 with a
WWW-Authenticateheader pointing at this wiki's OIDC provider metadata.
FAQ
What happens if I set up no authentication at all?
The endpoint uses whatever authentication XWiki is configured with and does not ask for any of its own, so an agent connects as guest and reaches only what guests may see. An authentication header, basic auth for instance, still authenticates the caller through XWiki's configured authenticator.
Which user is an agent then acting as?
The one it authenticated as, with that account's rights and nothing more, which is why the account you hand to an agent matters: see MCP User Permissions.
