kKj֛ddZddlmZddlZddlmZddlmZmZm Z m Z ddl Z ddl m Z ddlmZddlmZdd lmZdd lmZdd lmZmZdd lmZerdd lmZddlmZddlm Z ddl!m"Z"ddlm#Z#ee$Z%e&hdZ'GddeZ(GddeZ)ddZ*ddZ+Gddee,Z-ddZ.y)zAzure (Microsoft Entra) OAuth provider for FastMCP. This provider implements Azure/Microsoft Entra ID OAuth authentication using the OAuth Proxy pattern for non-DCR OAuth flows. ) annotationsN) OrderedDict) TYPE_CHECKINGAnyLiteralcast) AsyncKeyValue) Dependency) MultiAuth) OAuthProxy) JWTVerifier)decode_jwt_payload parse_scopes) get_loggerOnBehalfOfCredential)AuthorizationParams)OAuthClientInformationFull) AnyHttpUrl) AuthProvider>emailopenidprofileoffline_accesscdeZdZdZdddddddddddddddddddd dfdZeddddd dd Z dfd Zdd Zdd Z dfd Z ddZ ddZ ddZ ddZddZxZS) AzureProvideru Azure (Microsoft Entra) OAuth provider for FastMCP. This provider implements Azure/Microsoft Entra ID authentication using the OAuth Proxy pattern. It supports both organizational accounts and personal Microsoft accounts depending on the tenant configuration. Scope Handling: - required_scopes: Provide unprefixed scope names (e.g., ["read", "write"]) → Automatically prefixed with identifier_uri during initialization → Validated on all tokens and advertised to MCP clients - additional_authorize_scopes: Provide full format (e.g., ["User.Read"]) → NOT prefixed, NOT validated, NOT advertised to clients → Used to request Microsoft Graph or other upstream API permissions Features: - OAuth proxy to Azure/Microsoft identity platform - JWT validation using tenant issuer and JWKS - Supports tenant configurations: specific tenant ID, "organizations", or "consumers" - Custom API scopes and Microsoft Graph scopes in a single provider Setup: 1. Create an App registration in Azure Portal 2. Configure Web platform redirect URI: http://localhost:8000/auth/callback (or your custom path) 3. Add an Application ID URI under "Expose an API" (defaults to api://{client_id}) 4. Add custom scopes (e.g., "read", "write") under "Expose an API" 5. Set access token version to 2 in the App manifest: "requestedAccessTokenVersion": 2 6. Create a client secret 7. Get Application (client) ID, Directory (tenant) ID, and client secret Example: ```python from fastmcp import FastMCP from fastmcp.server.auth.providers.azure import AzureProvider # Standard Azure (Public Cloud) auth = AzureProvider( client_id="your-client-id", client_secret="your-client-secret", tenant_id="your-tenant-id", required_scopes=["read", "write"], # Unprefixed scope names additional_authorize_scopes=["User.Read", "Mail.Read"], # Optional Graph scopes base_url="http://localhost:8000", # identifier_uri defaults to api://{client_id} ) # Azure Government auth_gov = AzureProvider( client_id="your-client-id", client_secret="your-client-secret", tenant_id="your-tenant-id", required_scopes=["read", "write"], base_authority="login.microsoftonline.us", # Override for Azure Gov base_url="http://localhost:8000", ) mcp = FastMCP("My App", auth=auth) ``` NTrlogin.microsoftonline.com) client_secretresource_base_urlidentifier_uri issuer_url redirect_pathadditional_authorize_scopesallowed_client_redirect_urisclient_storagejwt_signing_keyrequire_authorization_consentconsent_csp_policyforward_resource%fallback_refresh_token_expiry_seconds#fastmcp_access_token_expiry_secondstoken_expiry_threshold_secondsbase_authority token_issuer http_client enable_cimdct|}| rt| xsgng}d|vrg|d}||_||_t|_d|_d|_|xsd||_||_|xs d|d|d}d|d|d}|xsgDcgc] }|tvs |}}|s td t||||jgd || }d|d|d }d|d|d } t"|5|| |||||| |xs|| | | ||||||||d}!|dk7rd|}!tjd|||jrd|j|!yd|!ycc}w)u4Initialize Azure OAuth provider. Args: client_id: Azure application (client) ID from your App registration client_secret: Azure client secret from your App registration. Optional when using alternative credentials (e.g., managed identity with a custom _create_upstream_oauth_client override). When omitted, jwt_signing_key must be provided. tenant_id: Azure tenant ID (specific tenant GUID, "organizations", or "consumers") identifier_uri: Optional Application ID URI for your custom API (defaults to api://{client_id}). This URI is automatically prefixed to all required_scopes during initialization. Example: identifier_uri="api://my-api" + required_scopes=["read"] → tokens validated for "api://my-api/read" base_url: Public URL where OAuth endpoints will be accessible (includes any mount path) resource_base_url: Optional public base URL for the protected resource metadata and token audience. Defaults to ``base_url``. issuer_url: Issuer URL for OAuth metadata (defaults to base_url). Use root-level URL to avoid 404s during discovery when mounting under a path. redirect_path: Redirect path configured in Azure App registration (defaults to "/auth/callback") base_authority: Azure authority base URL (defaults to "login.microsoftonline.com"). For Azure Government, use "login.microsoftonline.us". token_issuer: Override the expected `iss` claim value for JWT validation. Defaults to the standard Entra ID issuer derived from `base_authority` and `tenant_id`. Pass an explicit string to enforce a specific issuer. required_scopes: Custom API scope names WITHOUT prefix (e.g., ["read", "write"]). - Automatically prefixed with identifier_uri during initialization - Validated on all tokens - Advertised in Protected Resource Metadata - Must match scope names defined in Azure Portal under "Expose an API" Example: ["read", "write"] → validates tokens containing ["api://xxx/read", "api://xxx/write"] additional_authorize_scopes: Microsoft Graph or other upstream scopes in full format. - NOT prefixed with identifier_uri - NOT validated on tokens - NOT advertised to MCP clients - Used to request additional permissions from Azure (e.g., Graph API access) Example: ["User.Read", "Mail.Read"] These scopes allow your FastMCP server to call Microsoft Graph APIs using the upstream Azure token, but MCP clients are unaware of them. Note: "offline_access" is automatically included to obtain refresh tokens. allowed_client_redirect_uris: List of allowed redirect URI patterns for MCP clients. If None (default), all URIs are allowed. If empty list, no URIs are allowed. client_storage: Storage backend for OAuth state (client registrations, encrypted tokens). If None, an encrypted file store will be created in the data directory (derived from `platformdirs`). jwt_signing_key: Secret for signing FastMCP JWT tokens (any string or bytes). If bytes are provided, they will be used as is. If a string is provided, it will be derived into a 32-byte key. If not provided, the upstream client secret will be used to derive a 32-byte key using PBKDF2. require_authorization_consent: Whether to require user consent before authorizing clients (default True). When True, users see a consent screen before being redirected to Azure. When False, authorization proceeds directly without user confirmation. When "external", the built-in consent screen is skipped but no warning is logged, indicating that consent is handled externally (e.g. by the upstream IdP). SECURITY WARNING: Only set to False for local development or testing environments. http_client: Optional httpx.AsyncClient for connection pooling in JWKS fetches. When provided, the client is reused for JWT key fetches and the caller is responsible for its lifecycle. When None (default), a fresh client is created per fetch. enable_cimd: Enable CIMD (Client ID Metadata Document) support for URL-based client IDs (default True). Set to False to disable. fallback_refresh_token_expiry_seconds: Lifetime for the FastMCP-issued refresh token when the upstream provider omits `refresh_expires_in` (e.g. Cognito, GitHub, many OIDC IdPs). Defaults to 1 year. The upstream refresh remains the source of truth. See `OAuthProxy` for details. fastmcp_access_token_expiry_seconds: Lifetime for the FastMCP-issued access token, decoupling it from the upstream provider's `expires_in`. Defaults to None (mirror the upstream lifetime). Set this for bridges whose upstream issues short-lived access tokens that some MCP clients can't refresh gracefully (e.g. `mcp-remote`). See `OAuthProxy` for details. token_expiry_threshold_seconds: Number of seconds before actual expiry to treat a token as expired, refreshing early to avoid races. Defaults to 0. rTapi://https:////v2.0/discovery/v2.0/keyszAzureProvider requires at least one non-OIDC scope in required_scopes (e.g., 'read', 'write'). OIDC scopes like 'openid', 'profile', 'email', and 'offline_access' are not included in Azure access token claims and cannot be used for scope enforcement.RS256)jwks_uriissueraudience algorithmrequired_scopesr/z/oauth2/v2.0/authorizez/oauth2/v2.0/token)upstream_authorization_endpointupstream_token_endpointupstream_client_idupstream_client_secrettoken_verifierbase_urlrr"r!r$r%r&r'r(r)r*r+r, valid_scopesr0rz using authority zAInitialized Azure OAuth provider for client %s with tenant %s%s%sz and identifier_uri N)r _tenant_id_base_authorityr_obo_credentials_obo_max_credentials_obo_supportedr r# OIDC_SCOPES ValueErrorr super__init__loggerinfo)#self client_idr tenant_idr=rCrr r!r"r#r$r%r&r'r(r)r*r+r,r-r.r/r0parsed_required_scopesparsed_additional_scopesr:r9svalidation_scopesrBauthorization_endpointtoken_endpointauthority_info __class__s# t/Users/ahmed/devFolder/Ultron/claude-voice/.venv/lib/python3.12/site-packages/fastmcp/server/auth/providers/azure.pyrNzAzureProvider.__init__cs$D".o!>+ 4 5 ; ! #; ;'T)A'TCS'T $$- IT ),!"-D& 0D6N(M8N+;1YKu!Mn-Qyk9MN/4"4 4!+9MA4  !% %!4!45-#  ~&a {2H I $N#31YK?QR ,B$2(#0)/'!-X)E)+*G1-2W0S+I/#)  . 8 800@AN O  <@zCAzureProvider._prepare_scopes_for_token_exchange..#;aqK?O; zToken exchange scopes: %s)rr#rlistdictfromkeysrOrv)rQrr deduplicateds r\"_prepare_scopes_for_token_exchangez0AzureProvider._prepare_scopes_for_token_exchangesn77 "E  + +  " "#;;# DMM/:;  0,?rmc|tjd|t|jxsg}|Dcgc] }||vs| }}|j |}|jr"|j d|jDt tj|}tjd||Scc}w)aPrepare scopes for Azure token refresh. Azure requires fully-qualified scopes and only allows ONE resource per token request (AADSTS28000). We include scopes for this API plus OIDC scopes. Args: scopes: Base scopes from RefreshToken (unprefixed, e.g., ["read"]) Returns: Deduplicated list of scopes formatted for Azure token endpoint zBase scopes from storage: %sc32K|]}|tvs |ywrrrs r\rzEAzureProvider._prepare_scopes_for_upstream_refresh..rrz#Scopes for Azure token endpoint: %s) rOrvsetr#rrrrr)rQradditional_scopes_setrV base_scopesrdeduplicated_scopess r\$_prepare_scopes_for_upstream_refreshz2AzureProvider._prepare_scopes_for_upstream_refreshs  3V<!$D$D$D$J K"(K&QA5J,Jq& K77 D  + +  " "#;;# #4==#AB :./9#'04 3B B " B  B # B B 3B #B B "B &6B '7B -B ,B (N!B "'#B $%B &0:'B (.8)B *),+B ,-B .!/B 0.1B 23B 4 5B H%)%)%)#'LL L  L " L#LL"L#L!LL LL\#=*#=$#= #=J!F8(SS(6S S24#>F(F FP7rLrmrcReZdZdZdddd dfdZeddZxZS) AzureJWTVerifieraJWT verifier pre-configured for Azure AD / Microsoft Entra ID. Auto-configures JWKS URI, issuer, audience, and scope handling from your Azure app registration details. Designed for Managed Identity and other token-verification-only scenarios where AzureProvider's full OAuth proxy isn't needed. Handles Azure's scope format automatically: - Validates tokens using short-form scopes (what Azure puts in ``scp`` claims) - Advertises full-URI scopes in OAuth metadata (what clients need to request) Example:: from fastmcp.server.auth import RemoteAuthProvider from fastmcp.server.auth.providers.azure import AzureJWTVerifier from pydantic import AnyHttpUrl verifier = AzureJWTVerifier( client_id="your-client-id", tenant_id="your-tenant-id", required_scopes=["access_as_user"], ) auth = RemoteAuthProvider( token_verifier=verifier, authorization_servers=[ AnyHttpUrl("https://login.microsoftonline.com/your-tenant-id/v2.0") ], base_url="https://my-server.com", ) Nr)r=r r-c|xsd||_hd}||vrdnd|d|d}t| d|d|d|||jgd| y) aSInitialize Azure JWT verifier. Args: client_id: Azure application (client) ID from your App registration tenant_id: Azure tenant ID (specific tenant GUID, "organizations", or "consumers"). For multi-tenant apps ("organizations" or "consumers"), issuer validation is skipped since Azure tokens carry the actual tenant GUID as issuer. required_scopes: Scope names as they appear in Azure Portal under "Expose an API" (e.g., ["access_as_user", "read"]). These are validated against the short-form scopes in token ``scp`` claims, and automatically prefixed with identifier_uri for OAuth metadata. identifier_uri: Application ID URI (defaults to ``api://{client_id}``). Used to prefix scopes in OAuth metadata so clients know the full scope URIs to request from Azure. base_authority: Azure authority base URL (defaults to "login.microsoftonline.com"). For Azure Government, use "login.microsoftonline.us". r3>common consumers organizationsNr4r5r6r7r8)r9r:r;r<r=)_identifier_urirMrN) rQrRrSr=r r-multi_tenant_valuesr:r[s r\rNzAzureJWTVerifier.__init__s4 .E6)1E G// N+1YKu=  /q ;OP!5!56+  rmc|jsgSg}|jD]D}|tvsd|vsd|vr|j|%|j|jd|F|S)aReturn scopes with Azure URI prefix for OAuth metadata. Azure tokens contain short-form scopes (e.g., ``read``) in the ``scp`` claim, but clients must request full URI scopes (e.g., ``api://client-id/read``) from the Azure authorization endpoint. This property returns the full-URI form for OAuth metadata while ``required_scopes`` retains the short form for token validation. rr5)r=rKrr)rQrrs r\scopes_supportedz!AzureJWTVerifier.scopes_supportedsl##I))E #u~&4#7#7"8% AB * rm) rRrrSrr=rr rr-r)rr)rrrrrNpropertyrrrs@r\rrs`J-1%)9, ,  , * , # , , \rmrcN ddl}y#t$r}t|d|d}~wwxYw)zORaise ImportError with install instructions if azure-identity is not available.rNzG requires the `azure` extra. Install with: pip install 'fastmcp[azure]')azure.identity ImportError)featureazurers r\rrs; i9 9  s $$ct|tr|St|tr&t|jtr |jSy)zOExtract an AzureProvider from an auth provider, unwrapping MultiAuth if needed.N)rbrr server)auths r\_find_azure_providerr#s5$ & $ "z$++}'M{{ rmc eZdZdZddZddZy)_EntraOBOTokenaVDependency that performs OBO token exchange for Microsoft Entra. Uses azure.identity's OnBehalfOfCredential for async-native OBO, with automatic token caching and refresh. Credentials are cached on the AzureProvider so repeated tool calls reuse existing credentials and benefit from the Azure SDK's internal token cache. c||_yrr)rQrs r\rNz_EntraOBOToken.__init__7s  rmcKtdddlm}m}|}| t d|}t |j }|+t dt|j j|j|jd{}|j|jd{}|jS717w)N EntraOBOTokenr)get_access_token get_serverz7No access token available. Cannot perform OBO exchange.zPEntraOBOToken requires an AzureProvider as the auth provider. Current provider: )r) rfastmcp.server.dependenciesrr RuntimeErrorrrtyperrtoken get_tokenr)rQrrrrazure_providerrresults r\ __aenter__z_EntraOBOToken.__aenter__:s0L')  I -fkk:  !%%)&++%6%?%?$@B  *<<'--=  ,z++T[[99||  :s$BCC C3C4CCN)rr)rr)rrrrrNr r_rmr\rr.srmrc4ttt|S)a(Exchange the user's Entra token for a downstream API token via OBO. This dependency performs a Microsoft Entra On-Behalf-Of (OBO) token exchange, allowing your MCP server to call downstream APIs (like Microsoft Graph) on behalf of the authenticated user. Args: scopes: The scopes to request for the downstream API. For Microsoft Graph, use scopes like ["https://graph.microsoft.com/Mail.Read"] or ["https://graph.microsoft.com/.default"]. Returns: A dependency that resolves to the downstream API access token string Raises: ImportError: If fastmcp[azure] is not installed RuntimeError: If no access token is available, provider is not Azure, or OBO exchange fails Example: ```python from fastmcp.server.auth.providers.azure import EntraOBOToken import httpx @mcp.tool() async def get_my_emails( graph_token: str = EntraOBOToken(["https://graph.microsoft.com/Mail.Read"]) ): async with httpx.AsyncClient() as client: resp = await client.get( "https://graph.microsoft.com/v1.0/me/messages", headers={"Authorization": f"Bearer {graph_token}"} ) return resp.json() ``` Note: For OBO to work, ensure the scopes are included in the AzureProvider's `additional_authorize_scopes` parameter, and that admin consent has been granted for those scopes in your Entra app registration. )rrrrs r\rrUsT ^F+ ,,rm)rrrr)rzAuthProvider | NonerzAzureProvider | None)rrrr)/r __future__rr collectionsrtypingrrrrhttpxkey_value.aio.protocolsr fastmcp.dependenciesr fastmcp.server.auth.authr fastmcp.server.auth.oauth_proxyr !fastmcp.server.auth.providers.jwtr fastmcp.utilities.authrrfastmcp.utilities.loggingrrrmcp.server.auth.providerrmcp.shared.authrpydanticrrrrO frozensetrKrrrrrrrr_rmr\rs ##44 1+.69C07<:#5 H  HI F LJF LRa{aP$Z_$N*-rm