Implement SEP-2468: Recommend Issuer (iss) Parameter in Auth Responses

[alexhancock]

SEP-2468: Recommend Issuer (iss) Parameter in MCP Auth Responses — rust-sdk implementation

Spec PR: modelcontextprotocol/modelcontextprotocol#2468
Track: Specification · Stage: accepted · Priority: P0 · Theme: Enterprise Readiness
Needs code changes: Yes (Medium) — additive (security)

Summary

Recommends including and validating an explicit issuer (iss) claim in MCP authorization
responses to mitigate authorization mix-up attacks in multi-IdP environments, following RFC 9207.
Clients will need to validate the iss parameter and bind responses to the correct authorization
server.

Why this needs code changes in rust-sdk

The OAuth client lives in crates/rmcp/src/transport/auth.rs. AuthorizationMetadata already has
an issuer: Option<String> field, and AuthorizationManager generates the authorization URL
(get_authorization_url) and exchanges the code in the callback path. Today the callback path does
not capture or validate the iss query parameter that RFC 9207 adds to the redirect, so the
mix-up defense isn't in place.

The expected issuer must also be available at callback time. The flow state is persisted as
StoredAuthorizationState (currently holds PKCE verifier + CSRF token) — that's the natural place
to also stash the issuer the flow was started against.

Proposed work

• Extend StoredAuthorizationState to record the expected issuer (the AuthorizationMetadata.issuer used when get_authorization_url was called).
• In the callback/code-exchange path, parse the iss query parameter from the redirect.
• Validate the received iss equals the stored expected issuer (RFC 9207); on mismatch return an AuthError (e.g. reuse/extend the AuthorizationServerMismatch variant proposed in SEP-2352).
• Decide policy for a missing iss: tolerate for back-compat with non-RFC-9207 ASes, but require it when the AS advertised support.
• Add tests covering match, mismatch, and missing-iss.

Affected areas

crates/rmcp/src/transport/auth.rs (AuthorizationManager callback/code-exchange, StoredAuthorizationState, AuthError).

Notes / risks

• Conformance currently shows auth/metadata-var3 and auth/scope-step-up failing; this work touches the same auth client and may be bundled with SEP-2350/2351/2352.