Remove MCP direct identity-provider mode

MCP shipped two ways to authenticate a caller: the Gateway validating a
bearer and MCP trusting injected headers, or FastMCP verifying the caller
itself. Only one can be the answer, and the published documentation
already recommended the second. This removes the first.

request_context.py loses the header trust boundary entirely: the ASGI
middleware, the per-request state, the header parsing, and the user_name
field that no consumer read. get_request_credentials collapses to the
FastMCP access token, which is now the only source of caller identity, so
identity can no longer come from a header a caller could set. The module
goes from 355 lines to 194.

auth_enabled disappears with it. Authentication is not a mode any more, so
its configuration is required rather than conditionally required, and a
deployment that cannot reach an identity provider fails at load instead of
starting up unauthenticated.

The Gateway stops synthesising what FastMCP serves: the protected-resource
route forwards unconditionally, and the local_reply_config that rewrote
the /mcp 401 challenge is gone because FastMCP emits it. services.mcp
loses authorizationServers and scopes, and oidcProxy loses its enabled
toggle, which could only ever be true.

Tests authenticate the way the service does. protocol_harness gains a
static token verifier and a service_config helper, so suites that
exercise the tool pipeline get a real auth provider instead of trusted
headers.

The smoke checks come with it, because deploying proxy mode for the first
time showed the suite failing before it reached any assertion: it
authenticates with the OSMO-issued OETF token, which FastMCP rejects.
The unauthenticated surface a client uses to bootstrap OAuth needs no
token and is now its own test -- the 401 challenge and its
resource_metadata pointer, the RFC 9728 document, that FastMCP advertises
its authorization endpoint under /mcp, and that the health endpoints the
/mcp prefix would otherwise publish return 404. The authenticated catalog
and workflow checks name OSMO_MCP_ACCESS_TOKEN, which runs them when an
identity-provider token is supplied.

Two smoke-check fixes ride along. The expected catalog was missing
osmo_list_tasks, added by #1311, so its exact-equality assertion would
have failed at 25 versus 26 had it ever run, and the two counts in the
service README were stale for the same reason. The suite also carried an
`auth` tag that the kind environment's exclude_tags dropped, so it never
ran anywhere -- which is why the staleness went unnoticed. It is tagged
by what it needs deployed now, with kind excluding `mcp` explicitly.

Two behaviours changed and are recorded rather than hidden. An
unauthenticated request is now rejected after RequestBodyLimitMiddleware
has buffered its bounded body rather than before, because FastMCP's auth
runs inside the route. And whether a follow-up request succeeds after a
cancelled one is FastMCP's to decide; verified against the pre-change tree
that an authenticated deployment already behaved this way, so this change
does not introduce it.

Removing the mode column from the deployment guide's table left three
:widths: values against two columns, and the troubleshooting table in the
getting-started guide lost a cell marker on its HTTP 403 row. Both are Sphinx
errors, so docs-build failed on this commit. Fixed here rather than later in
the stack: a PR should not leave the docs build red for the ones behind it.

The smoke-check skip message described the wrong token. FastMCP's proxy
issues its own token to the client and keeps the upstream identity-provider
token server-side, validating it by JTI lookup on each request
(oauth_proxy/proxy.py:1820-1848), so a raw identity-provider token does not
authenticate to /mcp. The message now names the token the caller actually
needs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: jiaenren

deployments/charts/service/README.md

@@ -95,7 +95,7 @@ OSMO services write logs to standard streams for collection by the platform log
 
 The optional MCP workload exposes predefined OSMO operations to compatible
 native or desktop MCP clients. In direct-provider mode, the Gateway validates
-the bearer on `/mcp`. With `oidcProxy.enabled`, FastMCP validates its own proxy
+the bearer on `/mcp`. FastMCP validates its own proxy
 token and relays the verified upstream access token through the same Gateway
 for each mapped OSMO API request. That API request still passes the deployment's
 normal identity-provider validation and semantic RBAC.
@@ -115,15 +115,12 @@ destination, but it cannot validate external DNS.
 | `services.mcp.imageName` | MCP image repository name. | `mcp` |
 | `services.mcp.imageTag` | Per-MCP image tag override; falls back to `global.osmoImageTag` when empty. | `""` |
 | `services.mcp.resourceUrl` | Canonical public HTTPS MCP URL ending in exact `/mcp`; also determines the fixed outbound Gateway origin. | `""` |
-| `services.mcp.authorizationServers` | OAuth/OIDC issuers advertised in direct-provider mode; ignored when `oidcProxy.enabled` is true. | `[]` |
-| `services.mcp.scopes` | OAuth scopes advertised in direct-provider mode; ignored when `oidcProxy.enabled` is true. | `[]` |
 | `services.mcp.allowedOrigins` | Exact browser origins permitted on `/mcp`; native clients normally omit `Origin`. | `[]` |
 | `services.mcp.requestTimeoutSeconds` | Total timeout for each MCP-initiated Gateway request, from 1 through 60 seconds. | `10` |
 | `services.mcp.replicas` | Number of MCP replicas. The OIDC proxy keeps its state in Redis, so it scales out. | `1` |
 | `services.mcp.extraEnv` | Additional non-managed environment variables. It cannot override MCP host, port, Gateway origin, or request timeout. | `[]` |
 | `services.mcp.extraVolumeMounts` | Additional MCP container volume mounts, including Vault-injected credential files. | `[]` |
 | `services.mcp.extraVolumes` | Additional MCP pod volumes. | `[]` |
-| `services.mcp.oidcProxy.enabled` | Enable FastMCP's built-in OIDC proxy inside the existing MCP process. It advertises CIMD and retains DCR as a compatibility fallback. | `false` |
 | `services.mcp.oidcProxy.oidc.configUrl` | Upstream OIDC discovery URL. | `""` |
 | `services.mcp.oidcProxy.oidc.clientId` | Administrator-managed confidential OIDC application client ID. | `""` |
 | `services.mcp.oidcProxy.oidc.clientSecretFile` | Mounted file containing the upstream OIDC client secret. | `/etc/osmo/mcp-auth/client-secret` |

deployments/charts/service/ci/mcp-values.yaml

@@ -19,15 +19,12 @@ set -euo pipefail
 
 SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
 CHART_DIR="$(dirname -- "$SCRIPT_DIR")"
-VALUES_FILE="$SCRIPT_DIR/mcp-values.yaml"
 PROXY_VALUES_FILE="$SCRIPT_DIR/mcp-oidc-proxy-values.yaml"
-RENDERED_MANIFEST="$(mktemp)"
-MCP_MANIFEST="$(mktemp)"
 DISABLED_MANIFEST="$(mktemp)"
 PROXY_RENDERED_MANIFEST="$(mktemp)"
 PROXY_MCP_MANIFEST="$(mktemp)"
-trap 'rm -f "$RENDERED_MANIFEST" "$MCP_MANIFEST" "$DISABLED_MANIFEST" \
-  "$PROXY_RENDERED_MANIFEST" "$PROXY_MCP_MANIFEST"' EXIT
+trap 'rm -f "$DISABLED_MANIFEST" "$PROXY_RENDERED_MANIFEST" \
+  "$PROXY_MCP_MANIFEST"' EXIT
 
 fail() {
   echo "MCP chart validation failed: $*" >&2
@@ -102,14 +99,8 @@ expect_render_failure() {
   esac
 }
 
-helm lint "$CHART_DIR" --values "$VALUES_FILE"
 helm lint "$CHART_DIR" --values "$PROXY_VALUES_FILE"
 helm template mcp-disabled "$CHART_DIR" >"$DISABLED_MANIFEST"
-helm template mcp-validation "$CHART_DIR" \
-  --values "$VALUES_FILE" >"$RENDERED_MANIFEST"
-helm template mcp-validation "$CHART_DIR" \
-  --values "$VALUES_FILE" \
-  --show-only templates/mcp-service.yaml >"$MCP_MANIFEST"
 helm template mcp-proxy-validation "$CHART_DIR" \
   --values "$PROXY_VALUES_FILE" >"$PROXY_RENDERED_MANIFEST"
 helm template mcp-proxy-validation "$CHART_DIR" \
@@ -124,57 +115,10 @@ for forbidden in \
   assert_file_omits "$DISABLED_MANIFEST" "$forbidden"
 done
 
-for forbidden in \
-    'path: /.well-known/oauth-authorization-server' \
-    'path: /authorize' \
-    'path: /auth/callback' \
-    'path: /register' \
-    'path: /token' \
-    'path: /consent'; do
-  assert_file_omits "$RENDERED_MANIFEST" "$forbidden"
-done
-
-for expected in \
-    'kind: Deployment' \
-    'kind: Service' \
-    'name: osmo-mcp' \
-    'image: nvcr.io/nvidia/osmo/mcp:latest' \
-    'name: OSMO_GATEWAY_URL' \
-    'name: OSMO_MCP_REQUEST_TIMEOUT_SECONDS' \
-    'name: OSMO_MCP_AUTH_ENABLED' \
-    'kind: NetworkPolicy' \
-    'name: osmo-mcp-allow-gateway-envoy' \
-    'app.kubernetes.io/component: envoy' \
-    'automountServiceAccountToken: false'; do
-  assert_file_contains "$MCP_MANIFEST" "$expected"
-done
-assert_file_contains "$RENDERED_MANIFEST" 'path: /mcp'
-assert_file_contains "$RENDERED_MANIFEST" 'path: /.well-known/oauth-protected-resource/mcp'
-assert_file_contains "$RENDERED_MANIFEST" '\"authorization_servers\":[\"https://issuer.example.com\"]'
-assert_file_contains "$RENDERED_MANIFEST" '\"resource\":\"https://osmo.example.com/mcp\"'
-assert_file_contains "$RENDERED_MANIFEST" '\"scopes_supported\":[\"mcp:Access\"]'
-assert_file_contains "$RENDERED_MANIFEST" 'local safe_roles = {}'
-assert_file_contains "$RENDERED_MANIFEST" "not string.find(role, '[,%c]')"
-assert_file_contains "$RENDERED_MANIFEST" "table.concat(safe_roles, ',')"
-assert_env_value "$MCP_MANIFEST" OSMO_GATEWAY_URL https://osmo.example.com
-assert_env_value "$MCP_MANIFEST" OSMO_MCP_REQUEST_TIMEOUT_SECONDS 10
-assert_env_value "$MCP_MANIFEST" OSMO_MCP_AUTH_ENABLED false
-assert_route_omits "$RENDERED_MANIFEST" osmo-mcp 'typed_per_filter_config:'
-
-for expected in \
-    'name: OSMO_MCP_AUTH_RESOURCE_URL' \
-    'name: OSMO_MCP_AUTH_REDIS_URL' \
-    'name: OSMO_MCP_AUTH_REDIS_CONNECT_TIMEOUT_SECONDS' \
-    'name: OSMO_MCP_AUTH_REDIS_OPERATION_TIMEOUT_SECONDS' \
-    'name: OSMO_MCP_AUTH_OIDC_CONFIG_URL' \
-    'name: OSMO_MCP_AUTH_OIDC_CLIENT_ID' \
-    'name: OSMO_MCP_AUTH_OIDC_CLIENT_SECRET_FILE' \
-    'name: OSMO_MCP_AUTH_OIDC_ACCESS_TOKEN_ISSUER' \
-    'name: OSMO_MCP_AUTH_OIDC_ACCESS_TOKEN_REQUIRED_SCOPE' \
-    'name: OSMO_MCP_AUTH_UPSTREAM_TIMEOUT_SECONDS' \
-    'secretName: mcp-oidc-proxy-secrets'; do
-  assert_file_contains "$PROXY_MCP_MANIFEST" "$expected"
-done
+# The roles Lua filter has no other coverage in the repo.
+assert_file_contains "$PROXY_RENDERED_MANIFEST" 'local safe_roles = {}'
+assert_file_contains "$PROXY_RENDERED_MANIFEST" "not string.find(role, '[,%c]')"
+assert_file_contains "$PROXY_RENDERED_MANIFEST" "table.concat(safe_roles, ',')"
 
 # FastMCP's OAuth endpoints are published under /mcp, so the gateway needs one
 # prefix route rather than an entry per endpoint name.
@@ -245,21 +189,16 @@ if awk -v secret_name='mcp-oidc-proxy-secrets' '
   fail 'OIDC proxy mode rendered credential material into a Secret'
 fi
 
-expect_render_failure "$VALUES_FILE" \
+expect_render_failure "$PROXY_VALUES_FILE" \
   'encoded alternate Gateway origin' \
   'services.mcp.resourceUrl must be a valid HTTPS origin' \
   --set 'services.mcp.resourceUrl=https://osmo.example.com%40evil.example.com/mcp'
 
-expect_render_failure "$VALUES_FILE" \
+expect_render_failure "$PROXY_VALUES_FILE" \
   'managed Gateway URL override' \
   'services.mcp.extraEnv must not override managed variable OSMO_GATEWAY_URL' \
   --set-json 'services.mcp.extraEnv=[{"name":"OSMO_GATEWAY_URL","value":"https://evil.example.com"}]'
 
-expect_render_failure "$PROXY_VALUES_FILE" \
-  'OIDC proxy without MCP' \
-  'services.mcp.oidcProxy.enabled requires services.mcp.enabled=true' \
-  --set 'services.mcp.enabled=false'
-
 expect_render_failure "$PROXY_VALUES_FILE" \
   'OIDC proxy Redis database below range' \
   'services.mcp.oidcProxy.redis.dbNumber must be between 0 and 15' \

deployments/charts/service/ci/validate-mcp-chart.sh

@@ -31,16 +31,11 @@ setting detects this rotation and triggers Envoy to reload.
 {{- $mcp := .Values.services.mcp }}
 {{- $mcpEnabled := $mcp.enabled | default false }}
 {{- $mcpOidcProxy := $mcp.oidcProxy }}
-{{- if and ($mcpOidcProxy.enabled | default false) (not $mcpEnabled) }}
-{{- fail "services.mcp.oidcProxy.enabled requires services.mcp.enabled=true" }}
-{{- end }}
-{{- $mcpOidcProxyEnabled := and $mcpEnabled ($mcpOidcProxy.enabled | default false) }}
+{{- $mcpOidcProxyEnabled := $mcpEnabled }}
 {{- $mcpPath := "/mcp" }}
 {{- $mcpMetadataPath := "/.well-known/oauth-protected-resource/mcp" }}
 {{- $mcpResourceUrl := "" }}
 {{- $mcpMetadataUrl := "" }}
-{{- $mcpAuthorizationServers := $mcp.authorizationServers }}
-{{- $mcpScopes := $mcp.scopes }}
 {{- $skipAuthPaths := concat (default (list) $envoy.skipAuthPaths) (default (list) $envoy.extraSkipAuthPaths) }}
 {{- $authnSkipPaths := $skipAuthPaths }}
 {{- if $gw.oauth2Proxy.enabled }}
@@ -54,28 +49,6 @@ setting detects this rotation and triggers Envoy to reload.
 {{- fail "services.mcp.enabled requires gateway.authz.enabled=true" }}
 {{- end }}
 {{- $mcpResourceUrl = include "osmo.mcp-resource-url" . }}
-{{- if not $mcpOidcProxyEnabled }}
-{{- if not (kindIs "slice" $mcp.authorizationServers) }}
-{{- fail "services.mcp.authorizationServers must be a list" }}
-{{- end }}
-{{- if eq (len $mcp.authorizationServers) 0 }}
-{{- fail "services.mcp.authorizationServers must contain at least one issuer when MCP is enabled" }}
-{{- end }}
-{{- if not (kindIs "slice" $mcp.scopes) }}
-{{- fail "services.mcp.scopes must be a list" }}
-{{- end }}
-{{- if eq (len $mcp.scopes) 0 }}
-{{- fail "services.mcp.scopes must contain at least one scope when MCP is enabled" }}
-{{- end }}
-{{- range $scope := $mcp.scopes }}
-{{- if not (kindIs "string" $scope) }}
-{{- fail "services.mcp.scopes entries must be strings" }}
-{{- end }}
-{{- if eq (trim $scope) "" }}
-{{- fail "services.mcp.scopes entries must not be empty" }}
-{{- end }}
-{{- end }}
-{{- end }}
 {{- if not $envoy.jwt.providers }}
 {{- fail "services.mcp.enabled requires at least one gateway.envoy.jwt.providers entry" }}
 {{- end }}
@@ -299,27 +272,9 @@ data:
                     - name: ":method"
                       string_match:
                         exact: GET
-                  {{- if $mcpOidcProxyEnabled }}
                   route:
                     cluster: osmo-mcp
                     timeout: 15s
-                  {{- else }}
-                  direct_response:
-                    status: 200
-                    body:
-                      inline_string: {{ dict "resource" $mcpResourceUrl "authorization_servers" $mcpAuthorizationServers "bearer_methods_supported" (list "header") "scopes_supported" $mcpScopes | toJson | quote }}
-                  {{- end }}
-                  response_headers_to_add:
-                  - header:
-                      key: content-type
-                      value: application/json
-                    append_action: OVERWRITE_IF_EXISTS_OR_ADD
-                  # Inspector completes OAuth in its browser UI and fetches
-                  # this public, non-secret discovery document from localhost.
-                  - header:
-                      key: access-control-allow-origin
-                      value: "*"
-                    append_action: OVERWRITE_IF_EXISTS_OR_ADD
                   typed_per_filter_config:
                     {{- include "osmo.gateway-auth-filters-disabled" . | nindent 20 }}
 
@@ -471,35 +426,6 @@ data:
                   {{- end }}
                 {{- end }}
 
-            {{- if $mcpEnabled }}
-            # jwt_authn emits an Envoy local 401 before the router runs. Replace
-            # its generic bearer challenge only for the exact MCP endpoint so
-            # standards-compatible clients can discover RFC 9728 metadata.
-            local_reply_config:
-              mappers:
-              - filter:
-                  and_filter:
-                    filters:
-                    - status_code_filter:
-                        comparison:
-                          op: EQ
-                          value:
-                            default_value: 401
-                            runtime_key: osmo.mcp.jwt_unauthorized_status
-                    - header_filter:
-                        header:
-                          name: ":path"
-                          string_match:
-                            safe_regex:
-                              google_re2: {}
-                              regex: "^/mcp([?].*)?$"
-                headers_to_add:
-                - header:
-                    key: www-authenticate
-                    value: {{ printf "Bearer resource_metadata=%q" $mcpMetadataUrl | quote }}
-                  append_action: OVERWRITE_IF_EXISTS_OR_ADD
-            {{- end }}
-
             upgrade_configs:
             - upgrade_type: websocket
               enabled: true

deployments/charts/service/templates/_gateway-envoy-config.tpl

@@ -177,18 +177,6 @@ services:
     ##
     requestTimeoutSeconds: 10
 
-    ## OAuth authorization-server issuer identifiers advertised by the public
-    ## protected-resource metadata document. Configure the issuer for the
-    ## separately registered public/native MCP OAuth client.
-    ##
-    authorizationServers: []
-
-    ## OAuth scopes requested by MCP clients. These values are advertised as
-    ## scopes_supported in RFC 9728 protected-resource metadata and should
-    ## include the delegated scope required to access this MCP resource.
-    ##
-    scopes: []
-
     ## Browser Origins permitted to call /mcp. Native MCP clients normally omit
     ## Origin and remain allowed. When this list is empty, any present Origin is
     ## rejected with 403.
@@ -202,8 +190,6 @@ services:
     ## identity-provider access token to the OSMO Gateway for normal RBAC.
     ##
     oidcProxy:
-      enabled: false
-
       ## Upstream OpenID Connect provider. Register the fixed redirect URL
       ## <resourceUrl origin>/mcp/auth/callback on this confidential application.
       ##