[Cherry-pick to branch-1.3] [#12447] fix(mcp-server): Preserve the authorization scheme for static credentials (#12439) - #12462
Merged
Conversation
…c credentials (#12439) ### What changes were proposed in this pull request? The MCP server now accepts a complete static authorization credential through `--token` or `GRAVITINO_TOKEN`. A bare value remains an OAuth2 Bearer token for backward compatibility. A value containing a syntactically valid HTTP authentication scheme and credentials is forwarded as an Authorization credential. ``` --token "abc" sends Authorization: Bearer abc --token "Bearer abc" sends Authorization: Bearer abc --token "Basic dXNlcjpwYXNz" sends Authorization: Basic dXNlcjpwYXNz --token "Custom credentials" sends Authorization: Custom credentials --token "" sends no header ``` The patch: - Detects authorization credentials using the RFC 9110 scheme syntax instead of a fixed scheme allowlist. - Canonicalizes the built-in `Basic`, `Bearer`, and `Negotiate` scheme names because the corresponding Gravitino authenticators currently match them case-sensitively. - Preserves valid custom scheme names for custom Gravitino authenticators. - Treats empty and whitespace-only static tokens as anonymous. - Updates the `Setting.token` documentation and `--token` help text. - Adds unit coverage for built-in, custom, malformed, empty, whitespace, and compatibility cases. ### Why are the changes needed? The MCP server forwards credentials to Gravitino but does not authenticate them itself. An incoming `Authorization` header is already forwarded unchanged, while the static `--token` fallback was always prefixed with `Bearer`. Consequently, an MCP client that cannot attach its own header could not connect to a Gravitino server configured with `gravitino.authenticators = basic`. Supplying a Basic credential through `--token` produced `Authorization: Bearer Basic <credentials>` and failed with: ``` Error code: 1011, Error type: UnauthorizedException, Error message: The provided credentials did not support ``` This change lets the static fallback express the authentication scheme required by Gravitino while preserving the existing behavior for bare OAuth2 tokens. Fix: #12447 ### Does this PR introduce _any_ user-facing change? Yes. `--token` and `GRAVITINO_TOKEN` now accept complete credentials using any syntactically valid HTTP authentication scheme. Bare values continue to be sent as Bearer tokens, and whitespace-only values now send no Authorization header. Built-in scheme names are canonicalized case-insensitively, and a value already beginning with `Bearer ` is no longer double-prefixed. No CLI arguments or environment variables are added or removed. ### How was this patch tested? ```shell cd mcp-server python -m pytest tests/unit/test_auth_flow.py -v python -m pytest tests/unit -q ``` The targeted file has 24 passing tests, and all 184 MCP unit tests pass. `./gradlew spotlessApply` succeeds, and `pylint` reports 10.00 for the changed files. The Basic credential path was also verified on Kubernetes against Gravitino 1.3 configured with `authenticators: basic`. The same MCP `tools/call` that failed before the change succeeds after it. --------- Co-authored-by: Mark Hoerth <mark@datastrato.com> Co-authored-by: yuqi <yuqi@datastrato.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-pick Information:
branch-1.3