Skip to main content

Definition

Assembly: Microsoft.OData.Mcp.Authentication.dll Namespace: Microsoft.OData.Mcp.Authentication.Outbound Inheritance: System.Object

Syntax

Summary

Operator-supplied and discovered outbound OAuth settings for a single remote OData service — the options CLI hop 2 (ODataOutboundAuthHandler, OutboundOAuthClient, and the grant classes) runs on.

Remarks

Per specs/v3/AUTHENTICATION.md this type is named OutboundOAuthOptions, deliberately not ClientOAuthOptions — that SDK type is hop 1’s MCP-transport options and must not be reused here. It carries no certificate properties in v1.

Examples

Constructors

.ctor

Syntax

.ctor Inherited

Inherited from object

Syntax

Properties

ApiKey

Gets or sets the raw API key value for the API key escape hatch, or null when unset.

Syntax

Property Value

Type: string?

ApiKeyHeader

Gets or sets the header name OutboundOAuthOptions.ApiKey is sent under, or null when unset.

Syntax

Property Value

Type: string?

Remarks

Required whenever OutboundOAuthOptions.ApiKey is set; see OutboundOAuthOptions.Validate.

AuthServer

Gets or sets the operator’s --auth-server override, or null to discover the authorization server from the challenge and protected resource metadata.

Syntax

Property Value

Type: System.Uri?

AuthTimeout

Gets or sets how long an interactive grant may run before it is abandoned. Defaults to 300 seconds.

Syntax

Property Value

Type: System.TimeSpan?

AuthToken

Gets or sets the escape-hatch bearer token that skips OAuth entirely, or null when unset.

Syntax

Property Value

Type: string?

BasicPassword

Gets or sets the RFC 7617 Basic authentication password, or null when unset.

Syntax

Property Value

Type: string?

Remarks

Required whenever OutboundOAuthOptions.BasicUser is set; see OutboundOAuthOptions.Validate.

BasicUser

Gets or sets the RFC 7617 Basic authentication user name, or null when unset.

Syntax

Property Value

Type: string?

ClientId

Gets or sets the OAuth client id this process authenticates as, or null when dynamic client registration will supply one.

Syntax

Property Value

Type: string?

ClientMetadataDocumentUri

Gets or sets the client identity metadata document (CIMD) URI, or null when unset.

Syntax

Property Value

Type: System.Uri?

ClientSecret

Gets or sets the OAuth client secret for a confidential client, or null when unset.

Syntax

Property Value

Type: string?

Remarks

OutboundOAuthOptions) binds this from ODataMcpAuthConstants.ClientSecretEnvironmentVariable when it is unset. Never logged or printed.

ConsentPresenter

Gets or sets the delegate invoked to present a consent request to the operator or an MCP client, or null when interactive sign-in should throw OAuthConsentRequiredException instead.

Syntax

Property Value

Type: System.Func<Microsoft.OData.Mcp.Authentication.Outbound.OutboundConsentRequest, System.Threading.CancellationToken, System.Threading.Tasks.Task>

Remarks

Deliberately a delegate, not a new DI interface, per AUTH-7. The auth handler reads this property on every 401 rather than capturing it in a constructor, because IHttpClientFactory may cache the handler across a presenter change.

Grant

Gets or sets the operator’s --grant selection, or null to let GrantSelector pick from advertised grant_types_supported.

Syntax

Property Value

Type: System.Nullable<Microsoft.OData.Mcp.Authentication.Outbound.OutboundGrantKind?>?

HasEnvironmentIdToken

Gets or sets whether ODataMcpAuthConstants.IdTokenEnvironmentVariable was present when OutboundOAuthOptions) last ran.

Syntax

Property Value

Type: bool

Remarks

Set by OutboundOAuthOptions), never by an operator flag, so OutboundOAuthOptions.Validate can treat the environment variable as a valid identity assertion id-token source without reading String) itself.

HasExplicitCredentials

Gets whether any of OutboundOAuthOptions.AuthToken, OutboundOAuthOptions.ApiKey, or OutboundOAuthOptions.BasicUser is set, meaning this process authenticates without running an OAuth grant at all.

Syntax

Property Value

Type: bool

IdpClientId

Gets or sets the enterprise IdP client id used to obtain the id token the identity assertion grant exchanges, or null when unset.

Syntax

Property Value

Type: string?

IdpClientSecret

Gets or sets the enterprise IdP client secret, or null when unset.

Syntax

Property Value

Type: string?

IdpIdTokenFile

Gets or sets the path to a UTF-8 OIDC id token file for the identity assertion grant, or null when unset.

Syntax

Property Value

Type: string?

Remarks

ODataMcpAuthConstants.IdTokenEnvironmentVariable is the other id-token source; see OutboundOAuthOptions.HasEnvironmentIdToken and OutboundOAuthOptions). The token is never passed on argv.

IdpScope

Gets or sets the scope requested from the enterprise IdP, or null when unset.

Syntax

Property Value

Type: string?

IdpTokenEndpoint

Gets or sets the enterprise IdP token endpoint, or null when unset.

Syntax

Property Value

Type: System.Uri?

Remarks

Either this or OutboundOAuthOptions.IdpUrl satisfies the identity assertion endpoint requirement in OutboundOAuthOptions.Validate.

IdpUrl

Gets or sets the enterprise IdP base URL, or null when unset.

Syntax

Property Value

Type: System.Uri?

Remarks

Either this or OutboundOAuthOptions.IdpTokenEndpoint satisfies the identity assertion endpoint requirement in OutboundOAuthOptions.Validate.

RedirectUri

Gets or sets the loopback redirect URI override for the authorization code grant, or null to use an ephemeral loopback port.

Syntax

Property Value

Type: System.Uri?

Resource

Gets or sets the RFC 8707 resource indicator / audience override, or null to derive it from protected resource metadata or the service root’s origin.

Syntax

Property Value

Type: System.Uri?

Scopes

Gets or sets the fallback scope list requested when the authorization server advertises none.

Syntax

Property Value

Type: System.Collections.Generic.List<string>

ScopeSelector

Gets or sets the delegate that filters or appends scopes after offline_access is appended, or null when unset.

Syntax

Property Value

Type: ModelContextProtocol.Authentication.ScopeSelectorDelegate?

Remarks

Runs last in scope resolution and may remove offline_access. Reused as-is from the SDK per specs/v3/AUTHENTICATION.md’s SDK reuse table.

TokenCachePath

Gets or sets the directory the Latchkey File and Dpapi backends store cached tokens in, or null for the per-user default (see LatchkeyTokenCache.DefaultTokenCacheDirectory).

Syntax

Property Value

Type: string?

Methods

Equals Inherited Virtual

Inherited from object

Syntax

Parameters

Returns

Type: bool

Equals Inherited

Inherited from object

Syntax

Parameters

Returns

Type: bool

FromEnvironment

Binds settings this instance does not already carry from their environment variable equivalents.

Syntax

Parameters

Returns

Type: Microsoft.OData.Mcp.Authentication.Outbound.OutboundOAuthOptions options, mutated in place: OutboundOAuthOptions.ClientSecret is set from ODataMcpAuthConstants.ClientSecretEnvironmentVariable when it was unset, and OutboundOAuthOptions.HasEnvironmentIdToken is set to true when ODataMcpAuthConstants.IdTokenEnvironmentVariable is present and OutboundOAuthOptions.IdpIdTokenFile was unset.

Exceptions

Examples

Remarks

Never logs or prints the values it reads. An explicit OutboundOAuthOptions.ClientSecret is left untouched even when the environment variable is also set, so a flag always wins over the environment.

GetHashCode Inherited Virtual

Inherited from object

Syntax

Returns

Type: int

GetType Inherited

Inherited from object

Syntax

Returns

Type: System.Type

MemberwiseClone Inherited

Inherited from object

Syntax

Returns

Type: object

ReferenceEquals Inherited

Inherited from object

Syntax

Parameters

Returns

Type: bool

ToString Inherited Virtual

Inherited from object

Syntax

Returns

Type: string?

Validate

Validates that this instance’s settings are internally consistent before an outbound grant is attempted.

Syntax

Exceptions

Examples

Remarks

Every thrown message names the CLI flag that is missing or invalid, so a caller can surface it directly to the operator without translation.