Package edu.internet2.middleware.grouper.ws.mcp

Class GrouperOAuthServlet

java.lang.Object
javax.servlet.GenericServlet
javax.servlet.http.HttpServlet
edu.internet2.middleware.grouper.ws.mcp.GrouperOAuthServlet
All Implemented Interfaces:
Serializable, javax.servlet.Servlet, javax.servlet.ServletConfig
public class GrouperOAuthServlet extends javax.servlet.http.HttpServlet
OAuth 2.1 + PKCE servlet for MCP authentication.

Handles the following endpoints under /mcp/oauth/*:

  • POST /mcp/oauth/token - Token endpoint (exchanges auth code + PKCE verifier for JWT)
  • POST /mcp/oauth/register - Dynamic client registration (anonymous, rate-limited)

Registration is anonymous (no authentication required) and protected by: the redirect URI allowlist, IP-based rate limiting, and the fact that registration alone grants zero access — the user must still complete the OAuth consent flow and be in the proper MCP authorization groups.

The authorization endpoint is handled by the Grouper UI at grouperUi/app/UiV2OAuth.authorize so the user gets authenticated and sees the consent page directly without an extra redirect hop.

See Also:

  • Constructor Summary

    Constructors
    Constructor
    Description
    GrouperOAuthServlet()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    protected void
    doPost(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)
     

    Methods inherited from class javax.servlet.http.HttpServlet

    doDelete, doGet, doHead, doOptions, doPut, doTrace, getLastModified, service, service

    Methods inherited from class javax.servlet.GenericServlet

    destroy, getInitParameter, getInitParameterNames, getServletConfig, getServletContext, getServletInfo, getServletName, init, init, log, log

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • GrouperOAuthServlet

      public GrouperOAuthServlet()

  • Method Details

    • doPost

      protected void doPost(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) throws javax.servlet.ServletException, IOException
      Overrides:
      doPost in class javax.servlet.http.HttpServlet
      Throws:
      javax.servlet.ServletException
      IOException