Integrate Embedded Auth Server with Runner #3541
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tgrunnagle
requested review from
JAORMX,
amirejaz,
dmjb,
eleftherias and
lujunsan
as code owners
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #3541 +/- ##
==========================================
- Coverage 65.53% 65.46% -0.08%
==========================================
Files 405 405
Lines 39678 39695 +17
==========================================
- Hits 26004 25986 -18
- Misses 11672 11705 +33
- Partials 2002 2004 +2 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
tgrunnagle
force-pushed
the
auth-server_issue-230_2026-01-30
branch
from
d02114e to
a15d25b
Compare
tgrunnagle
requested review from
ChrisJBurns,
jerm-dro,
jhrozek and
yrobla
as code owners
tgrunnagle
force-pushed
the
auth-server_issue-230b_2026-01-30
branch
from
d5ff7fb to
c539d7d
Compare
github-actions
bot
added
size/S
jhrozek
reviewed
Feb 2, 2026
jhrozek
previously approved these changes
Feb 2, 2026
tgrunnagle
force-pushed
the
auth-server_issue-230_2026-01-30
branch
2 times, most recently
from
f7f655d to
8f5eccb
Compare
tgrunnagle
force-pushed
the
auth-server_issue-230b_2026-01-30
branch
from
e27e2e4 to
351e469
Compare
github-actions
bot
added
size/S
Add embedded OAuth/OIDC authorization server support to the Runner, enabling MCP servers to have their own authorization server when EmbeddedAuthServerConfig is configured. Changes: - Add embeddedAuthServer field to Runner struct - Initialize embedded auth server during Run() when configured - Mount auth server routes at specific prefixes to avoid conflicts with MCP endpoints (/.well-known/oauth-protected-resource is MCP) - Close embedded auth server during Cleanup() - Add comprehensive integration tests for handler mounting, endpoint responses, and cleanup behavior The auth server routes are mounted at: - /oauth/ (authorize, callback, token, register) - /.well-known/oauth-authorization-server (RFC 8414) - /.well-known/openid-configuration (OIDC Discovery) - /.well-known/jwks.json (JSON Web Key Set)
tgrunnagle
force-pushed
the
auth-server_issue-230b_2026-01-30
branch
from
351e469 to
3563c30
Compare
jhrozek
approved these changes
Feb 2, 2026
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Depends on #3540
What
This PR integrates the embedded authorization server with the
pkg/runner/package, enabling MCP servers to have their own OAuth2/OIDC authorization server whenEmbeddedAuthServerConfigis configured.Key changes:
EmbeddedAuthServerConfigfield toRunConfigfor serializable auth server configurationRunner.Run()when configuredRunner.Cleanup()Why
This completes the Runner side of the Embedded Authorization Server feature (stacklok-epics#230). The integration allows:
Per-server authorization - Each MCP server can optionally run its own embedded authorization server that delegates authentication to upstream identity providers (Okta, Auth0, GitHub, etc.)
Clean endpoint separation - Auth server routes are mounted at specific prefixes (
/oauth/,/.well-known/oauth-authorization-server, etc.) to avoid conflicts with MCP protocol endpoints like/.well-known/oauth-protected-resourceProper lifecycle management - The embedded auth server is initialized during runner startup and cleaned up during shutdown, ensuring resources are properly released
Related
pkg/runner/changes for: stacklok-epics#230