mirror of
https://github.com/pomerium/pomerium.git
synced 2026-02-12 23:55:27 +01:00
Pomerium is an identity and context-aware access proxy.
02ea793100## Summary Add support for Pomerium to host Client ID Metadata Documents (CIMD) at `/.pomerium/mcp/client/metadata.json` for MCP server routes using auto-discovery mode (routes without `upstream_oauth2` configured). When Pomerium acts as an OAuth 2.1 client to upstream MCP servers, it needs to present its own CIMD to the upstream authorization server. This enables dynamic client registration via the Client ID Metadata Document spec (draft-ietf-oauth-client-id-metadata-document). Key changes: - Add `ClientIDMetadata` handler to serve per-host CIMD documents - Add `UsesAutoDiscovery`/`GetServerHostInfo` methods to `HostInfo` - Split OAuth callback endpoints: `server/oauth/callback` vs `client/oauth/callback` - Add debug logging for CIMD requests ## Related issues - [ENG-3525](https://linear.app/pomerium/issue/ENG-3525/host-client-id-metadata-documents-for-auto-discovery-mode) ## User Explanation MCP server routes using auto-discovery mode (without explicit `upstream_oauth2` configuration) now automatically serve a CIMD document. This allows upstream MCP servers' authorization servers to discover Pomerium's OAuth client metadata. ## Checklist - [x] reference any related issues - [x] updated unit tests - [ ] add appropriate label (`enhancement`, `bug`, `breaking`, `dependencies`, `ci`) - [ ] ready for review |
||
|---|---|---|
| .github | ||
| .vscode | ||
| authenticate | ||
| authorize | ||
| cmd/pomerium | ||
| config | ||
| databroker | ||
| examples | ||
| integration | ||
| internal | ||
| k8s/zero | ||
| ospkg | ||
| pkg | ||
| proxy | ||
| scripts | ||
| ui | ||
| .clang-format | ||
| .codecov.yml | ||
| .dockerignore | ||
| .fossa.yml | ||
| .gitattributes | ||
| .gitignore | ||
| .golangci.yml | ||
| .pre-commit-config.yaml | ||
| .tool-versions | ||
| 3RD-PARTY | ||
| DEBUG.MD | ||
| Dockerfile | ||
| Dockerfile.debug | ||
| go.mod | ||
| go.sum | ||
| LICENSE | ||
| Makefile | ||
| pomerium.go | ||
| README.md | ||
| RELEASING.md | ||
| SECURITY.md | ||
Pomerium builds secure, clientless connections to internal web apps and services without a corporate VPN.
Pomerium is:
- Easier with clientless access.
- Faster by being tunnel-free and deployed where your apps and services are.
- Safer because every single action is verified before allowed to execute.
- Tailored to your organization’s needs by integrating all data for context-aware access.
It’s not a VPN alternative – it’s the trusted, foolproof way to protect your business. Want a hosted control plane and management GUI? Give Pomerium Zero a try today!
Docs
For comprehensive docs, and tutorials see our documentation.
Contributing
See Contributing for information on how you can contribute to Pomerium.