-
Notifications
You must be signed in to change notification settings - Fork 257
Description
Is your feature request related to a problem? Please describe.
No, it's an enhancement that would make it easier to deploy this server.
Describe the solution you'd like
Allow the client to use a local client id and client secret to go through the auth2 flow.
Additional context
When the server is deployed using the 'stateless-http' transport, you must specify the client ID and client secret to the server via the environment, then, dynamic client registration returns them to the user.
Since DCR is optional according to the spec, it would be better for the client to skip DCR if it already has the necessary information and initiate the OAuth flow.
This would allow a single deployment of this server with multi-tenancy; each client being able to access its own account using one (trusted) server.
Currently, the /.well-known/oauth-authorization-server endpoint doesn't exist if the ID/secret isn't provided, so the client cannot access the authorization endpoint since it's on a non-default URL.