Definition
Assembly: Microsoft.OData.Mcp.Authentication.dll Namespace: Microsoft.OData.Mcp.Authentication.Outbound Inheritance: System.ObjectSyntax
Summary
Operator-supplied and discovered outbound OAuth settings for a single remote OData service — the options CLI hop 2 (ODataOutboundAuthHandler, OutboundOAuthClient, and the grant classes)
runs on.
Remarks
Perspecs/v3/AUTHENTICATION.md this type is named OutboundOAuthOptions, deliberately not
ClientOAuthOptions — that SDK type is hop 1’s MCP-transport options and must not be reused here.
It carries no certificate properties in v1.
Examples
Constructors
.ctor
Syntax
.ctor Inherited
Inherited from
objectSyntax
Properties
ApiKey
Gets or sets the raw API key value for the API key escape hatch, ornull when unset.
Syntax
Property Value
Type:string?
ApiKeyHeader
Gets or sets the header name OutboundOAuthOptions.ApiKey is sent under, ornull when unset.
Syntax
Property Value
Type:string?
Remarks
Required whenever OutboundOAuthOptions.ApiKey is set; see OutboundOAuthOptions.Validate.AuthServer
Gets or sets the operator’s--auth-server override, or null to discover the
authorization server from the challenge and protected resource metadata.
Syntax
Property Value
Type:System.Uri?
AuthTimeout
Gets or sets how long an interactive grant may run before it is abandoned. Defaults to 300 seconds.Syntax
Property Value
Type:System.TimeSpan?
AuthToken
Gets or sets the escape-hatch bearer token that skips OAuth entirely, ornull when unset.
Syntax
Property Value
Type:string?
BasicPassword
Gets or sets the RFC 7617 Basic authentication password, ornull when unset.
Syntax
Property Value
Type:string?
Remarks
Required whenever OutboundOAuthOptions.BasicUser is set; see OutboundOAuthOptions.Validate.BasicUser
Gets or sets the RFC 7617 Basic authentication user name, ornull when unset.
Syntax
Property Value
Type:string?
ClientId
Gets or sets the OAuth client id this process authenticates as, ornull when dynamic
client registration will supply one.
Syntax
Property Value
Type:string?
ClientMetadataDocumentUri
Gets or sets the client identity metadata document (CIMD) URI, ornull when unset.
Syntax
Property Value
Type:System.Uri?
ClientSecret
Gets or sets the OAuth client secret for a confidential client, ornull when unset.
Syntax
Property Value
Type:string?
Remarks
OutboundOAuthOptions) binds this from ODataMcpAuthConstants.ClientSecretEnvironmentVariable when it is unset. Never logged or printed.ConsentPresenter
Gets or sets the delegate invoked to present a consent request to the operator or an MCP client, ornull when interactive sign-in should throw OAuthConsentRequiredException
instead.
Syntax
Property Value
Type:System.Func<Microsoft.OData.Mcp.Authentication.Outbound.OutboundConsentRequest, System.Threading.CancellationToken, System.Threading.Tasks.Task>
Remarks
Deliberately a delegate, not a new DI interface, perAUTH-7. The auth handler reads this
property on every 401 rather than capturing it in a constructor, because IHttpClientFactory
may cache the handler across a presenter change.
Grant
Gets or sets the operator’s--grant selection, or null to let
GrantSelector pick from advertised grant_types_supported.
Syntax
Property Value
Type:System.Nullable<Microsoft.OData.Mcp.Authentication.Outbound.OutboundGrantKind?>?
HasEnvironmentIdToken
Gets or sets whether ODataMcpAuthConstants.IdTokenEnvironmentVariable was present when OutboundOAuthOptions) last ran.Syntax
Property Value
Type:bool
Remarks
Set by OutboundOAuthOptions), never by an operator flag, so OutboundOAuthOptions.Validate can treat the environment variable as a valid identity assertion id-token source without reading String) itself.HasExplicitCredentials
Gets whether any of OutboundOAuthOptions.AuthToken, OutboundOAuthOptions.ApiKey, or OutboundOAuthOptions.BasicUser is set, meaning this process authenticates without running an OAuth grant at all.Syntax
Property Value
Type:bool
IdpClientId
Gets or sets the enterprise IdP client id used to obtain the id token the identity assertion grant exchanges, ornull when unset.
Syntax
Property Value
Type:string?
IdpClientSecret
Gets or sets the enterprise IdP client secret, ornull when unset.
Syntax
Property Value
Type:string?
IdpIdTokenFile
Gets or sets the path to a UTF-8 OIDC id token file for the identity assertion grant, ornull when unset.
Syntax
Property Value
Type:string?
Remarks
ODataMcpAuthConstants.IdTokenEnvironmentVariable is the other id-token source; see OutboundOAuthOptions.HasEnvironmentIdToken and OutboundOAuthOptions). The token is never passed on argv.IdpScope
Gets or sets the scope requested from the enterprise IdP, ornull when unset.
Syntax
Property Value
Type:string?
IdpTokenEndpoint
Gets or sets the enterprise IdP token endpoint, ornull when unset.
Syntax
Property Value
Type:System.Uri?
Remarks
Either this or OutboundOAuthOptions.IdpUrl satisfies the identity assertion endpoint requirement in OutboundOAuthOptions.Validate.IdpUrl
Gets or sets the enterprise IdP base URL, ornull when unset.
Syntax
Property Value
Type:System.Uri?
Remarks
Either this or OutboundOAuthOptions.IdpTokenEndpoint satisfies the identity assertion endpoint requirement in OutboundOAuthOptions.Validate.RedirectUri
Gets or sets the loopback redirect URI override for the authorization code grant, ornull to use an ephemeral loopback port.
Syntax
Property Value
Type:System.Uri?
Resource
Gets or sets the RFC 8707 resource indicator / audience override, ornull to derive
it from protected resource metadata or the service root’s origin.
Syntax
Property Value
Type:System.Uri?
Scopes
Gets or sets the fallback scope list requested when the authorization server advertises none.Syntax
Property Value
Type:System.Collections.Generic.List<string>
ScopeSelector
Gets or sets the delegate that filters or appends scopes afteroffline_access is appended, or
null when unset.
Syntax
Property Value
Type:ModelContextProtocol.Authentication.ScopeSelectorDelegate?
Remarks
Runs last in scope resolution and may removeoffline_access. Reused as-is from the SDK per
specs/v3/AUTHENTICATION.md’s SDK reuse table.
TokenCachePath
Gets or sets the directory the Latchkey File and Dpapi backends store cached tokens in, ornull for the per-user default (see LatchkeyTokenCache.DefaultTokenCacheDirectory).
Syntax
Property Value
Type:string?
Methods
Equals Inherited Virtual
Inherited from
objectSyntax
Parameters
Returns
Type:bool
Equals Inherited
Inherited from
objectSyntax
Parameters
Returns
Type:bool
FromEnvironment
Binds settings this instance does not already carry from their environment variable equivalents.Syntax
Parameters
Returns
Type:Microsoft.OData.Mcp.Authentication.Outbound.OutboundOAuthOptions
options, mutated in place: OutboundOAuthOptions.ClientSecret is set from
ODataMcpAuthConstants.ClientSecretEnvironmentVariable when it was unset, and
OutboundOAuthOptions.HasEnvironmentIdToken is set to true when
ODataMcpAuthConstants.IdTokenEnvironmentVariable is present and
OutboundOAuthOptions.IdpIdTokenFile was unset.
Exceptions
Examples
Remarks
Never logs or prints the values it reads. An explicit OutboundOAuthOptions.ClientSecret is left untouched even when the environment variable is also set, so a flag always wins over the environment.GetHashCode Inherited Virtual
Inherited from
objectSyntax
Returns
Type:int
GetType Inherited
Inherited from
objectSyntax
Returns
Type:System.Type
MemberwiseClone Inherited
Inherited from
objectSyntax
Returns
Type:object
ReferenceEquals Inherited
Inherited from
objectSyntax
Parameters
Returns
Type:bool
ToString Inherited Virtual
Inherited from
objectSyntax
Returns
Type:string?