fix(mcp): use full OIDC round-trip for MCP OAuth to avoid id_token issuer mismatch

[Vishnuujain]

Fixes #30445

Problem

MCP OAuth (e.g. ChatGPT connector) fails on instances with OIDC SSO. POST /mcp/callback returns 500:

ID token issuer mismatch. Expected 'https://accounts.google.com' but got '<deployment-authority>'.

Fix

• AuthenticationCodeFlowHandler: skip the active-session shortcut for MCP flows so the id_token always comes from the external OIDC provider; expose the round-trip state/nonce/PKCE-verifier as request attributes.
• UserSSOOAuthProvider: link those to the MCP pending request via updatePac4jSession, so the returning /callback?state=... resolves and a provider-issued id_token is validated.

Web login path is untouched (guarded behind !isMcpFlow).

Not covered here

Live ChatGPT↔SSO end-to-end round-trip — needs verification on a deployed instance.

Greptile Summary

The PR repairs MCP authentication for OIDC deployments by:

• forcing MCP authorization through the external provider’s complete authorization-code flow instead of reusing an OpenMetadata session token;
• carrying the generated state, nonce, and PKCE verifier into the MCP pending authorization record for callback restoration.

Confidence Score: 5/5

The PR appears safe to merge, with no blocking failure identified in the follow-up scope.

No blocking failure remains.

Important Files Changed

Filename	Overview
openmetadata-mcp/src/main/java/org/openmetadata/mcp/server/auth/provider/UserSSOOAuthProvider.java	Persists the provider-generated OIDC state, nonce, and PKCE verifier against the pending MCP authorization before returning from redirect initiation.
openmetadata-service/src/main/java/org/openmetadata/service/security/AuthenticationCodeFlowHandler.java	Detects MCP login requests, bypasses internal active-session token reuse, and exposes the external OIDC round-trip parameters to the MCP bridge.

Sequence Diagram

sequenceDiagram
  participant Client as MCP Client
  participant MCP as UserSSOOAuthProvider
  participant OIDC as AuthenticationCodeFlowHandler
  participant IdP as External OIDC Provider
  participant Repo as MCP Pending Auth Repository
  Client->>MCP: Start authorization
  MCP->>OIDC: handleLogin(MCP callback URI)
  OIDC->>OIDC: Generate state, nonce, and PKCE verifier
  OIDC-->>MCP: Expose values as request attributes
  MCP->>Repo: Link OIDC values to pending MCP request
  OIDC-->>IdP: Redirect to provider authorization
  IdP-->>OIDC: "/callback?state=..."
  OIDC->>Repo: Resolve pending request by provider state
  OIDC-->>Client: Complete MCP authorization

Loading

_{Reviews (2): Last reviewed commit: "fix(mcp): use full OIDC round-trip for M..." | Re-trigger Greptile}

Context used:

• Knowledge Base — OpenMetadata MCP Server
• Knowledge Base — Auth and Security: Authentication, Authorization, Secrets, and SCIM

[gitar-bot]

Code Review ✅ Approved

Switches MCP OAuth to use a full OIDC round-trip instead of the active-session shortcut, preventing id_token issuer mismatches. No issues found.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[github-actions]

🔴 Playwright Results — 2 test failure(s)

✅ 4533 passed · ❌ 2 failed · 🟡 24 flaky · ⏭️ 102 skipped

Shard	Passed	Failed	Flaky	Skipped
🟡 Shard 1	436	0	4	16
✅ Shard 2	11	0	0	0
🟡 Shard 3	822	0	9	8
🔴 Shard 4	810	2	3	25
🟡 Shard 5	830	0	3	5
✅ Shard 6	832	0	0	46
🟡 Shard 7	792	0	5	2

Genuine Failures (failed on all attempts)

❌ Features/OntologyExplorerRdf.spec.ts › term Relations Graph requests /rdf/glossary/graph scoped to the selected term (glossaryTermId) when RDF is enabled (shard 4)

�[31mTest timeout of 60000ms exceeded.�[39m

❌ Features/OntologyExplorerRdf.spec.ts › glossary Relations Graph calls /rdf/glossary/graph when RDF is enabled and renders nodes from the response (shard 4)

Error: GET /rdf/glossary/graph must be called on the glossary Relations Graph when RDF is enabled

�[2mexpect(�[22m�[31mreceived�[39m�[2m).�[22mtoBe�[2m(�[22m�[32mexpected�[39m�[2m) // Object.is equality�[22m

Expected: �[32mtrue�[39m
Received: �[31mfalse�[39m

🟡 24 flaky test(s) (passed on retry)

• Features/Pagination.spec.ts › should test Database Schemas complete flow with search (shard 1, 1 retry)
• Pages/Lineage/LineageRightPanel.spec.ts › Verify custom properties tab IS visible for supported type: chart (shard 1, 1 retry)
• Pages/SearchSettings.spec.ts › Latest preview config wins when a superseded request resolves late (shard 1, 1 retry)
• Flow/SearchRBAC.spec.ts › a dashboard-scoped user sees dashboards but never tables (shard 1, 1 retry)
• Features/BulkEditEntity.spec.ts › Table (shard 3, 1 retry)
• Features/BulkEditImportPermissions.spec.ts › Editor with EditAll can access every bulk edit and import page (shard 3, 1 retry)
• Features/ContextCenterArchive.spec.ts › full document lifecycle: folder expand icon, upload, delete, restore, and permanent delete (shard 3, 1 retry)
• Features/ContextCenterArticles.spec.ts › Article listing search filters, clears, and shows empty state (shard 3, 2 retries)
• Features/ContextCenterArticles.spec.ts › Related assets, activity feed, user mentions, and article mentions work (shard 3, 1 retry)
• Features/ContextCenterArticles.spec.ts › Text formatting (shard 3, 1 retry)
• Features/ContextCenterDocument.spec.ts › moving document to folder shows folder on card; re-opening menu shows current folder selected; clicking it again removes document from folder (shard 3, 1 retry)
• Features/ContextCenterMemories.spec.ts › clearing search restores the unfiltered list (shard 3, 1 retry)
• Features/Glossary/GlossaryCRUDOperations.spec.ts › should create glossary with mutually exclusive enabled (shard 3, 1 retry)
• Features/MetricBulkImportExportEdit.spec.ts › MetricListPage unchecking header checkbox clears the selection bar (shard 4, 1 retry)
• Features/OntologyExplorerRdf.spec.ts › renders without crashing when /rdf/glossary/graph returns duplicate nodes and dangling edges (shard 4, 2 retries)
• Features/StoredProcedureServiceBulkFetch.spec.ts › Stored procedure carries service via the bulk field path even when service is not requested (shard 4, 1 retry)
• Flow/PersonaFlow.spec.ts › Set default persona for team should work properly (shard 5, 1 retry)
• Pages/CustomProperties.spec.ts › Set & Update all CP types on apiCollection (shard 5, 1 retry)
• Pages/DataContractsSemanticRules.spec.ts › Validate Description Rule Is_Not_Set (shard 5, 1 retry)
• Pages/Glossary.spec.ts › Approve and reject glossary term from Glossary Listing (shard 7, 1 retry)
• Pages/Lineage/LineageFilters.spec.ts › Verify Impact Analysis service filter selection (shard 7, 1 retry)
• Pages/Lineage/LineageRightPanel.spec.ts › Verify custom properties tab is NOT visible for pipelineService in platform lineage (shard 7, 1 retry)
• Pages/Lineage/LineageRightPanel.spec.ts › Verify custom properties tab is NOT visible for apiService in platform lineage (shard 7, 1 retry)
• Pages/TestSuite.spec.ts › Logical TestSuite (shard 7, 1 retry)

📦 Download artifacts

How to debug locally

# Download playwright-test-results-<shard> artifact and unzip
npx playwright show-trace path/to/trace.zip    # view trace