Building a Secure MCP Server on Azure with OAuth2 On-Behalf-Of Flow

┌─────────────┐   ┌─────────────┐   ┌─────────────┐   ┌─────────────┐
│ MCP Client  │   │ Azure Entra │   │ MCP Server  │   │  MS Graph   │
│  (VS Code)  │   │     ID      │   │             │   │             │
└──────┬──────┘   └──────┬──────┘   └──────┬──────┘   └──────┬──────┘
       │                 │                 │                 │
       │ 1. Auth request │                 │                 │
       │ (user logs in)  │                 │                 │
       │────────────────>│                 │                 │
       │                 │                 │                 │
       │ 2. Token A      │                 │                 │
       │ (for MCP Server)│                 │                 │
       │<────────────────│                 │                 │
       │                 │                 │                 │
       │ 3. MCP request + Token A          │                 │
       │──────────────────────────────────>│                 │
       │                 │                 │                 │
       │                 │ 4. OBO exchange │                 │
       │                 │ Token A → B     │                 │
       │                 │<────────────────│                 │
       │                 │                 │                 │
       │                 │ 5. Token B      │                 │
       │                 │ (for Graph)     │                 │
       │                 │────────────────>│                 │
       │                 │                 │                 │
       │                 │                 │ 6. API call     │
       │                 │                 │ with Token B    │
       │                 │                 │────────────────>│
       │                 │                 │                 │
       │                 │                 │ 7. User data    │
       │                 │                 │<────────────────│
       │                 │                 │                 │
       │ 8. MCP response (profile data)    │                 │
       │<──────────────────────────────────│                 │
       │                 │                 │                 │12345678910111213141516171819202122232425262728293031323334

┌────────────────────────────────────────────────────────────┐
│                    Azure Container Apps                    │
│  ┌──────────────────────────────────────────────────────┐  │
│  │                  MCP Server (Python)                 │  │
│  │                                                      │  │
│  │  ┌────────────┐ ┌────────────┐ ┌──────────────────┐  │  │
│  │  │    JWT     │ │    OBO     │ │   FastMCP Auth   │  │  │
│  │  │  Validator │ │  Handler   │ │     Provider     │  │  │
│  │  └────────────┘ └────────────┘ └──────────────────┘  │  │
│  │                                                      │  │
│  │  ┌────────────────────────────────────────────────┐  │  │
│  │  │                  MCP Tools                     │  │  │
│  │  │  • graph_get_profile  • devops_get_profile     │  │  │
│  │  └────────────────────────────────────────────────┘  │  │
│  └──────────────────────────────────────────────────────┘  │
│                            │                               │
│                  User Assigned Managed Identity            │
└────────────────────────────────────────────────────────────┘
                             │
                             │ OBO Token Exchange
                             ▼
                  ┌─────────────────────┐
                  │   Azure Entra ID    │
                  └─────────────────────┘
                             │
            ┌────────────────┴────────────────┐
            │                                 │
            ▼                                 ▼
  ┌──────────────────┐             ┌──────────────────┐
  │  Microsoft Graph │             │   Azure DevOps   │
  │  (User Profile)  │             │  (User Profile)  │
  └──────────────────┘             └──────────────────┘1234567891011121314151617181920212223242526272829303132

# Your Azure configuration
TENANT_ID="your-tenant-id"           # From: az account show --query tenantId -o tsv
SUBSCRIPTION_ID="your-subscription"  # From: az account show --query id -o tsv
LOCATION="uksouth"                   # Azure region (uksouth, eastus, westeurope, etc.)

# Naming
PREFIX="mcp"                         # Short prefix for resource names
ENV="dev"                            # Environment: dev, stg, prd

# Generate a random identifier (4 hex characters)
# This identifies ALL resources from this deployment for easy cleanup later
RANDOM_ID=$(printf '%04x' $RANDOM)
echo "Random ID for this deployment: $RANDOM_ID"12345678910111213

# Derived names (following Azure naming conventions)
# All resources include the random ID for identification
RESOURCE_GROUP="rg-${PREFIX}-${ENV}-${RANDOM_ID}"
CONTAINER_ENV="cae-${PREFIX}-${ENV}-${RANDOM_ID}"
CONTAINER_REGISTRY="acr${PREFIX}${ENV}${RANDOM_ID}"  # ACR names must be globally unique and alphanumeric only
MANAGED_IDENTITY="id-${PREFIX}-${ENV}-${RANDOM_ID}"
LOG_ANALYTICS="log-${PREFIX}-${ENV}-${RANDOM_ID}"
CONTAINER_APP="ca-${PREFIX}-${ENV}-${RANDOM_ID}"
APP_DISPLAY_NAME="MCP OAuth2 OBO Server (${PREFIX}-${ENV}-${RANDOM_ID})"123456789

az login
az account set --subscription "$SUBSCRIPTION_ID"
az account show123

az group create \
  --name "$RESOURCE_GROUP" \
  --location "$LOCATION"123

az monitor log-analytics workspace create \
  --resource-group "$RESOURCE_GROUP" \
  --workspace-name "$LOG_ANALYTICS" \
  --location "$LOCATION"

# Get the workspace ID and key for later
LOG_ANALYTICS_WORKSPACE_ID=$(az monitor log-analytics workspace show \
  --resource-group "$RESOURCE_GROUP" \
  --workspace-name "$LOG_ANALYTICS" \
  --query customerId -o tsv)

LOG_ANALYTICS_KEY=$(az monitor log-analytics workspace get-shared-keys \
  --resource-group "$RESOURCE_GROUP" \
  --workspace-name "$LOG_ANALYTICS" \
  --query primarySharedKey -o tsv)123456789101112131415

az containerapp env create \
  --name "$CONTAINER_ENV" \
  --resource-group "$RESOURCE_GROUP" \
  --location "$LOCATION" \
  --logs-workspace-id "$LOG_ANALYTICS_WORKSPACE_ID" \
  --logs-workspace-key "$LOG_ANALYTICS_KEY"123456

az acr create \
  --name "$CONTAINER_REGISTRY" \
  --resource-group "$RESOURCE_GROUP" \
  --location "$LOCATION" \
  --sku Basic \
  --admin-enabled false123456

az identity create \
  --name "$MANAGED_IDENTITY" \
  --resource-group "$RESOURCE_GROUP" \
  --location "$LOCATION"

# Get the identity details for later
MI_CLIENT_ID=$(az identity show \
  --name "$MANAGED_IDENTITY" \
  --resource-group "$RESOURCE_GROUP" \
  --query clientId -o tsv)

MI_PRINCIPAL_ID=$(az identity show \
  --name "$MANAGED_IDENTITY" \
  --resource-group "$RESOURCE_GROUP" \
  --query principalId -o tsv)

MI_RESOURCE_ID=$(az identity show \
  --name "$MANAGED_IDENTITY" \
  --resource-group "$RESOURCE_GROUP" \
  --query id -o tsv)1234567891011121314151617181920

ACR_ID=$(az acr show \
  --name "$CONTAINER_REGISTRY" \
  --resource-group "$RESOURCE_GROUP" \
  --query id -o tsv)

# Wait for Managed Identity to propagate to Azure AD
echo "Waiting for Managed Identity to propagate..."
sleep 15

az role assignment create \
  --assignee "$MI_PRINCIPAL_ID" \
  --role "AcrPull" \
  --scope "$ACR_ID"12345678910111213

# Create the app registration
APP_ID=$(az ad app create \
  --display-name "$APP_DISPLAY_NAME" \
  --sign-in-audience "AzureADMyOrg" \
  --web-redirect-uris "http://127.0.0.1:33418/" "https://vscode.dev/redirect" \
  --enable-access-token-issuance false \
  --enable-id-token-issuance false \
  --query appId -o tsv)

echo "App Registration Client ID: $APP_ID"12345678910

az ad app update \
  --id "$APP_ID" \
  --identifier-uris "api://$APP_ID"123

# Generate a UUID for the scope
SCOPE_ID=$(uuidgen)

# Create the permission scope (Azure CLI requires the full api object structure)
az ad app update \
  --id "$APP_ID" \
  --set "api={
    \"requestedAccessTokenVersion\": 2,
    \"oauth2PermissionScopes\": [{
      \"id\": \"$SCOPE_ID\",
      \"adminConsentDescription\": \"Allow the application to access MCP OAuth2 OBO Server on behalf of the signed-in user.\",
      \"adminConsentDisplayName\": \"Access MCP OAuth2 OBO Server\",
      \"isEnabled\": true,
      \"type\": \"User\",
      \"userConsentDescription\": \"Allow the application to access MCP OAuth2 OBO Server on your behalf.\",
      \"userConsentDisplayName\": \"Access MCP OAuth2 OBO Server\",
      \"value\": \"access_as_user\"
    }]
  }"12345678910111213141516171819

# Well-known client IDs for pre-authorization
VSCODE_CLIENT_ID="aebc6443-996d-45c2-90f0-388ff96faa56"
AZURE_CLI_CLIENT_ID="04b07795-8ddb-461a-bbee-02f9e1bf7b46"

# Add pre-authorized applications (must include the full api object with existing scope)
az ad app update \
  --id "$APP_ID" \
  --set "api={
    \"requestedAccessTokenVersion\": 2,
    \"oauth2PermissionScopes\": [{
      \"id\": \"$SCOPE_ID\",
      \"adminConsentDescription\": \"Allow the application to access MCP OAuth2 OBO Server on behalf of the signed-in user.\",
      \"adminConsentDisplayName\": \"Access MCP OAuth2 OBO Server\",
      \"isEnabled\": true,
      \"type\": \"User\",
      \"userConsentDescription\": \"Allow the application to access MCP OAuth2 OBO Server on your behalf.\",
      \"userConsentDisplayName\": \"Access MCP OAuth2 OBO Server\",
      \"value\": \"access_as_user\"
    }],
    \"preAuthorizedApplications\": [
      {
        \"appId\": \"$VSCODE_CLIENT_ID\",
        \"delegatedPermissionIds\": [\"$SCOPE_ID\"]
      },
      {
        \"appId\": \"$AZURE_CLI_CLIENT_ID\",
        \"delegatedPermissionIds\": [\"$SCOPE_ID\"]
      }
    ]
  }"123456789101112131415161718192021222324252627282930

# Microsoft Graph permissions (delegated)
# User.Read: Read user profile
az ad app permission add \
  --id "$APP_ID" \
  --api "00000003-0000-0000-c000-000000000000" \
  --api-permissions "e1fe6dd8-ba31-4d61-89e7-88639da4683d=Scope"

# openid: Sign users in
az ad app permission add \
  --id "$APP_ID" \
  --api "00000003-0000-0000-c000-000000000000" \
  --api-permissions "37f7f235-527c-4136-accd-4a02d197296e=Scope"

# profile: View basic profile
az ad app permission add \
  --id "$APP_ID" \
  --api "00000003-0000-0000-c000-000000000000" \
  --api-permissions "14dad69e-099b-42c9-810b-d002981feec1=Scope"

# email: View email address
az ad app permission add \
  --id "$APP_ID" \
  --api "00000003-0000-0000-c000-000000000000" \
  --api-permissions "64a6cdd6-aab1-4aaf-94b8-3cc8405e90d0=Scope"

# Azure DevOps permissions (delegated)
# vso.profile: Read user profile
az ad app permission add \
  --id "$APP_ID" \
  --api "499b84ac-1321-427f-aa17-267ca6975798" \
  --api-permissions "4ee63f9b-9e65-476c-a487-9fea1e00c7ef=Scope"12345678910111213141516171819202122232425262728293031

az ad app permission admin-consent --id "$APP_ID"1

# Create SP if it doesn't exist (may already exist from app registration)
az ad sp show --id "$APP_ID" > /dev/null 2>&1 || az ad sp create --id "$APP_ID"

SP_OBJECT_ID=$(az ad sp show --id "$APP_ID" --query id -o tsv)

# Require user assignment (only users in the security group can authenticate)
az ad sp update \
  --id "$SP_OBJECT_ID" \
  --set appRoleAssignmentRequired=true123456789

GROUP_ID=$(az ad group create \
  --display-name "MCP OAuth2 OBO Server Users (${PREFIX}-${ENV}-${RANDOM_ID})" \
  --mail-nickname "mcp-oauth2-obo-users-${PREFIX}-${ENV}-${RANDOM_ID}" \
  --description "Users authorized to access the MCP OAuth2 OBO Server (${RANDOM_ID})" \
  --query id -o tsv)

echo "Security Group ID: $GROUP_ID"1234567

# Add an owner who can manage group membership
az ad group owner add \
  --group "$GROUP_ID" \
  --owner-object-id "<user-object-id>"1234

# Assign the group to the service principal (grants access)
az ad app permission grant \
  --id "$APP_ID" \
  --api "$APP_ID" \
  --scope "access_as_user"

# Create app role assignment for the group
az rest --method POST \
  --uri "https://graph.microsoft.com/v1.0/servicePrincipals/$SP_OBJECT_ID/appRoleAssignedTo" \
  --headers "Content-Type=application/json" \
  --body "{
    \"principalId\": \"$GROUP_ID\",
    \"resourceId\": \"$SP_OBJECT_ID\",
    \"appRoleId\": \"00000000-0000-0000-0000-000000000000\"
  }"123456789101112131415

# Get your user object ID
MY_USER_ID=$(az ad signed-in-user show --query id -o tsv)

# Add yourself to the group
az ad group member add \
  --group "$GROUP_ID" \
  --member-id "$MY_USER_ID"1234567

az ad app federated-credential create \
  --id "$APP_ID" \
  --parameters "{
    \"name\": \"mcp-mi-credential-${RANDOM_ID}\",
    \"issuer\": \"https://login.microsoftonline.com/$TENANT_ID/v2.0\",
    \"subject\": \"$MI_PRINCIPAL_ID\",
    \"description\": \"Allows the Managed Identity to authenticate as the application (${RANDOM_ID})\",
    \"audiences\": [\"api://AzureADTokenExchange\"]
  }"123456789

# Create a secret that expires in 1 year
SECRET=$(az ad app credential reset \
  --id "$APP_ID" \
  --append \
  --years 1 \
  --query password -o tsv)

echo "Client Secret (save this, it won't be shown again): $SECRET"12345678

echo "=== Save these values ==="
echo "RANDOM_ID=$RANDOM_ID"  # Keep this for identifying/cleaning up resources
echo "TENANT_ID=$TENANT_ID"
echo "AZURE_CLIENT_ID=$APP_ID"
echo "AZURE_MI_CLIENT_ID=$MI_CLIENT_ID"
echo "CONTAINER_REGISTRY=$CONTAINER_REGISTRY"
echo "CONTAINER_ENV=$CONTAINER_ENV"
echo "CONTAINER_APP=$CONTAINER_APP"
echo "RESOURCE_GROUP=$RESOURCE_GROUP"
echo "SECURITY_GROUP_ID=$GROUP_ID"
echo "SCOPE_ID=$SCOPE_ID"
echo "CLIENT_SECRET=$SECRET"  # For local dev only123456789101112

mcp-server/
├── Dockerfile
├── pyproject.toml
├── src/
│   ├── __init__.py
│   ├── server.py           # Entry point
│   ├── config.py           # Configuration
│   ├── dependencies.py     # FastMCP setup + auth provider
│   ├── auth/
│   │   ├── __init__.py
│   │   ├── jwt_validator.py
│   │   ├── obo_handler.py
│   │   ├── fastmcp_provider.py
│   │   └── service_tokens.py
│   ├── tools/
│   │   ├── __init__.py
│   │   ├── graph_profile.py
│   │   └── devops_profile.py
│   ├── routes/
│   │   ├── __init__.py
│   │   └── health.py
│   └── .env.local          # Local development config (git-ignored)12345678910111213141516171819202122

mkdir -p mcp-server/src/{auth,tools,routes}
touch mcp-server/src/__init__.py
touch mcp-server/src/{auth,tools,routes}/__init__.py123

[project]
name = "mcp-oauth2-obo-server"
version = "1.0.0"
description = "MCP Server with OAuth2 OBO Flow"
requires-python = ">=3.11"
dependencies = [
    "fastmcp==2.14.4",
    "uvicorn[standard]==0.40.0",
    "msal==1.34.0",
    "pyjwt[crypto]==2.10.1",
    "httpx==0.28.1",
    "starlette==0.52.1",
    "pydantic==2.12.5",
    "pydantic-settings==2.12.0",
    "python-dotenv==1.2.1",
]

[dependency-groups]
dev = [
    "ruff==0.14.14",
    "mypy==1.19.1",
    "pytest==9.0.2",
    "pytest-asyncio==1.3.0",
]123456789101112131415161718192021222324

uv sync1

"""Configuration from environment variables"""

import logging
from pathlib import Path

from dotenv import load_dotenv
from pydantic import Field
from pydantic_settings import BaseSettings, SettingsConfigDict

# Load .env.local for local development
env_path = Path(__file__).parent / ".env.local"
if env_path.exists():
    load_dotenv(env_path)

class Settings(BaseSettings):
    """Application configuration with validation"""

    # Azure Entra ID
    TENANT_ID: str | None = Field(None, alias="AZURE_TENANT_ID")
    CLIENT_ID: str | None = Field(None, alias="AZURE_CLIENT_ID")
    MI_CLIENT_ID: str | None = Field(None, alias="AZURE_MI_CLIENT_ID")

    # Server
    PORT: int = Field(8000, gt=0, le=65535)
    LOG_LEVEL: str = Field("INFO", pattern="^(DEBUG|INFO|WARNING|ERROR|CRITICAL)$")

    # Security
    MAX_TOKEN_AGE_HOURS: int = Field(24, ge=1, le=168)  # 1 hour to 7 days

    # Container App (auto-populated by Azure)
    CONTAINER_APP_NAME: str | None = None
    CONTAINER_APP_ENV_DNS_SUFFIX: str | None = None
    APP_URL: str | None = None

    @property
    def constructed_app_url(self) -> str:
        """Build the application URL from Container App environment"""
        if self.CONTAINER_APP_NAME and self.CONTAINER_APP_ENV_DNS_SUFFIX:
            return f"https://{self.CONTAINER_APP_NAME}.{self.CONTAINER_APP_ENV_DNS_SUFFIX}"
        return self.APP_URL or "http://localhost:8000"

    model_config = SettingsConfigDict(
        env_file=".env.local",
        env_file_encoding="utf-8",
        case_sensitive=True,
        extra="ignore",
    )

settings = Settings()  # type: ignore[call-arg]

# Configure logging
logging.basicConfig(
    level=getattr(logging, settings.LOG_LEVEL),
    format="%(asctime)s - %(name)s - %(levelname)s - %(message)s",
)
logger = logging.getLogger(__name__)

if not settings.TENANT_ID or not settings.CLIENT_ID:
    logger.warning("Missing Azure Entra ID configuration - auth will be disabled")1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859

"""Azure Entra ID JWT token validation"""

import logging
from datetime import UTC, datetime
from typing import Any

import jwt
from jwt import PyJWKClient

logger = logging.getLogger(__name__)

class AzureJWTValidator:
    """Validates Microsoft Entra ID JWT tokens"""

    def __init__(self, tenant_id: str, client_id: str, max_token_age_hours: int = 24):
        self.tenant_id = tenant_id
        self.client_id = client_id
        self.max_token_age_seconds = max_token_age_hours * 3600

        # JWKS client fetches signing keys from Azure
        self.jwks_client = PyJWKClient(
            f"https://login.microsoftonline.com/{tenant_id}/discovery/v2.0/keys",
            cache_keys=True,
            max_cached_keys=16,
        )

        # Valid issuers for this tenant
        self.valid_issuers = [
            f"https://login.microsoftonline.com/{tenant_id}/v2.0",
            f"https://sts.windows.net/{tenant_id}/",
        ]

    async def validate(self, token: str) -> dict[str, Any] | None:
        """
        Validate JWT token.

        Checks: signature, audience, issuer, expiry, and token age.
        Returns claims dict if valid, None otherwise.
        """
        try:
            # Get signing key from JWKS endpoint
            signing_key = self.jwks_client.get_signing_key_from_jwt(token)

            # Decode and validate standard claims
            claims = jwt.decode(
                token,
                signing_key.key,
                algorithms=["RS256"],
                audience=[self.client_id, f"api://{self.client_id}"],
                issuer=self.valid_issuers,
            )

            # Additional check: reject tokens that are too old
            current_time = datetime.now(UTC).timestamp()
            iat = claims.get("iat")

            if iat:
                token_age = current_time - iat

                if token_age > self.max_token_age_seconds:
                    logger.warning(
                        f"Token rejected: too old ({token_age / 3600:.1f} hours)"
                    )
                    return None

                # Reject future-dated tokens (5-minute clock skew allowed)
                if iat > current_time + 300:
                    logger.warning("Token rejected: issued in the future")
                    return None

            logger.debug(f"Token validated for user: {claims.get('oid')}")
            return dict(claims)

        except jwt.InvalidTokenError as e:
            logger.warning(f"Token validation failed: {e}")
            return None
        except Exception as e:
            logger.error(f"Unexpected validation error: {e}")
            return None12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879

"""On-Behalf-Of token exchange handler"""

import logging
import os

import httpx
import msal

logger = logging.getLogger(__name__)

# API scope constants
GRAPH_SCOPE_USER_READ = "https://graph.microsoft.com/User.Read"
DEVOPS_RESOURCE_ID = "499b84ac-1321-427f-aa17-267ca6975798/.default"

class OBOHandler:
    """Handles On-Behalf-Of token exchange with Azure Entra ID"""

    def __init__(self, tenant_id: str, client_id: str, mi_client_id: str | None = None):
        self.tenant_id = tenant_id
        self.client_id = client_id
        self.mi_client_id = mi_client_id
        self.msal_app: msal.ConfidentialClientApplication | None = None

    async def _get_managed_identity_token(self, resource: str) -> str | None:
        """Get token from Managed Identity endpoint (Azure only)"""
        identity_endpoint = os.environ.get("IDENTITY_ENDPOINT")
        identity_header = os.environ.get("IDENTITY_HEADER")

        if not identity_endpoint or not identity_header:
            return None

        params = {
            "resource": resource,
            "api-version": "2019-08-01",
            "client_id": self.mi_client_id,
        }
        headers = {"X-IDENTITY-HEADER": identity_header}

        async with httpx.AsyncClient() as client:
            response = await client.get(
                identity_endpoint, params=params, headers=headers
            )
            if response.status_code == 200:
                return response.json().get("access_token")
        return None

    async def _init_msal(self) -> None:
        """Initialize MSAL with Managed Identity or client secret"""
        if self.msal_app:
            return

        # Try Managed Identity first (only works in Azure)
        mi_endpoint = os.environ.get("IDENTITY_ENDPOINT")

        if mi_endpoint and self.mi_client_id:
            logger.info("Attempting Managed Identity authentication")
            mi_token = await self._get_managed_identity_token("api://AzureADTokenExchange")

            if mi_token:
                self.msal_app = msal.ConfidentialClientApplication(
                    client_id=self.client_id,
                    authority=f"https://login.microsoftonline.com/{self.tenant_id}",
                    client_credential={
                        "client_assertion": mi_token,
                        "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
                    },
                )
                logger.info("MSAL initialized with Managed Identity")
                return

        # Fallback to client secret (local dev or other clouds)
        client_secret = os.environ.get("AZURE_CLIENT_SECRET", "").strip()

        if client_secret:
            logger.info("Using client secret for MSAL")
            self.msal_app = msal.ConfidentialClientApplication(
                client_id=self.client_id,
                authority=f"https://login.microsoftonline.com/{self.tenant_id}",
                client_credential=client_secret,
            )
        else:
            logger.error("No credentials available for MSAL")

    async def exchange_token_for_graph(
        self, user_token: str, scopes: list[str] | None = None
    ) -> str | None:
        """Exchange user token for Microsoft Graph token"""
        return await self._exchange_token(
            user_token, scopes or [GRAPH_SCOPE_USER_READ], "graph"
        )

    async def exchange_token_for_devops(
        self, user_token: str, scopes: list[str] | None = None
    ) -> str | None:
        """Exchange user token for Azure DevOps token"""
        return await self._exchange_token(
            user_token, scopes or [DEVOPS_RESOURCE_ID], "devops"
        )

    async def _exchange_token(
        self, user_token: str, scopes: list[str], service: str
    ) -> str | None:
        """Perform the OBO token exchange"""
        await self._init_msal()

        if not self.msal_app:
            logger.error(f"MSAL not initialized for {service} OBO")
            return None

        try:
            # Refresh MI assertion if using Managed Identity
            if self.mi_client_id and os.environ.get("IDENTITY_ENDPOINT"):
                mi_token = await self._get_managed_identity_token("api://AzureADTokenExchange")
                if mi_token:
                    self.msal_app.client_credential = {"client_assertion": mi_token}

            result = self.msal_app.acquire_token_on_behalf_of(
                user_assertion=user_token,
                scopes=scopes,
            )

            if "access_token" in result:
                logger.debug(f"OBO exchange successful for {service}")
                return result["access_token"]

            error = result.get("error_description", "Unknown error")
            logger.error(f"{service} OBO failed: {error}")
            return None

        except Exception as e:
            logger.error(f"OBO exchange error for {service}: {e}")
            return None123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132

"""FastMCP authentication provider for Azure Entra ID"""

import logging

from fastmcp.server.auth import AccessToken, RemoteAuthProvider, TokenVerifier
from pydantic import AnyHttpUrl

from .jwt_validator import AzureJWTValidator

logger = logging.getLogger(__name__)

class AzureEntraIDTokenVerifier(TokenVerifier):
    """Verifies Azure Entra ID tokens and stores raw token for OBO"""

    def __init__(self, tenant_id: str, client_id: str, max_token_age_hours: int = 24):
        super().__init__(base_url=None, required_scopes=[])
        self.client_id = client_id  # Store for scope expansion
        self.validator = AzureJWTValidator(tenant_id, client_id, max_token_age_hours)

    async def verify_token(self, token: str) -> AccessToken | None:
        """Verify token and prepare for OBO exchange"""
        claims = await self.validator.validate(token)

        if not claims:
            return None

        # Extract scopes from token
        scope_claim = claims.get("scp", "")
        scopes = scope_claim.split(" ") if scope_claim else []

        # Azure AD puts short scope names in tokens (e.g., "access_as_user")
        # but clients request full URIs (e.g., "api://{client_id}/access_as_user").
        # Add the full URI form so FastMCP's scope validation passes.
        if "access_as_user" in scopes:
            scopes.append(f"api://{self.client_id}/access_as_user")

        return AccessToken(
            token=token,
            client_id=claims.get("oid", ""),
            scopes=scopes,
            expires_at=claims.get("exp"),
            claims={
                **claims,
                "raw_user_token": token,  # Store for OBO exchange
                "user_name": claims.get("name", "Unknown"),
                "user_email": claims.get("email") or claims.get("upn"),
            },
        )

class AzureEntraIDAuthProvider(RemoteAuthProvider):
    """Auth provider with OAuth discovery for MCP clients"""

    def __init__(
        self,
        tenant_id: str,
        client_id: str,
        base_url: str,
        max_token_age_hours: int = 24,
    ):
        # Create token verifier
        token_verifier = AzureEntraIDTokenVerifier(
            tenant_id, client_id, max_token_age_hours
        )

        # Set the scope that clients should request.
        # Note: openid, profile, email are OIDC scopes that control what claims
        # appear in the token, but they don't appear in the 'scp' claim itself.
        # Only our custom scope (access_as_user) appears in scp and can be validated.
        token_verifier.required_scopes = [
            f"api://{client_id}/access_as_user",
        ]

        # Initialize with Azure Entra ID as authorization server.
        # Pass base_url WITHOUT the /mcp path: FastMCP adds it when calling
        # get_routes(mcp_path="/mcp"), constructing the correct RFC 9728
        # discovery URL: /.well-known/oauth-protected-resource/mcp
        super().__init__(
            token_verifier=token_verifier,
            authorization_servers=[
                AnyHttpUrl(f"https://login.microsoftonline.com/{tenant_id}/v2.0")
            ],
            base_url=base_url,
            resource_name="MCP OAuth2 OBO Server",
        )123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384

"""Service token acquisition via OBO flow"""

import logging
from typing import Any

from fastmcp.exceptions import ToolError
from fastmcp.server.dependencies import get_access_token

logger = logging.getLogger(__name__)

async def get_service_token(service: str, scopes: list[str] | None = None) -> str:
    """
    Get a service-specific token using OBO flow.

    Args:
        service: Target service ('graph' or 'devops')
        scopes: Optional scopes (uses defaults if not provided)

    Returns:
        Service-specific access token

    Raises:
        ToolError: If authentication fails
    """
    # Get validated token from FastMCP context
    access_token = get_access_token()
    if not access_token:
        raise ToolError("Authentication required")

    # Extract raw token for OBO
    raw_token = access_token.claims.get("raw_user_token")
    if not raw_token:
        raise ToolError("Unable to retrieve authentication token")

    # Get OBO handler
    from src.dependencies import get_obo_handler
    obo_handler = get_obo_handler()

    if not obo_handler:
        raise ToolError("Authentication service unavailable")

    # Perform token exchange
    if service == "graph":
        service_token = await obo_handler.exchange_token_for_graph(raw_token, scopes)
    elif service == "devops":
        service_token = await obo_handler.exchange_token_for_devops(raw_token, scopes)
    else:
        raise ValueError(f"Unknown service: {service}")

    if not service_token:
        raise ToolError(f"Failed to acquire {service} token - try signing in again")

    return service_token

def get_user_info() -> dict[str, Any]:
    """Get current user information from auth context"""
    access_token = get_access_token()
    if access_token and access_token.claims:
        return {
            "user_id": access_token.client_id,
            "user_name": access_token.claims.get("user_name", "Unknown"),
            "user_email": access_token.claims.get("user_email"),
        }
    return {}12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364

"""Microsoft Graph profile tool"""

import logging

import httpx

logger = logging.getLogger(__name__)

GRAPH_BASE_URL = "https://graph.microsoft.com/v1.0"

async def graph_get_profile() -> dict:
    """Get the current user's Microsoft 365 profile"""
    from src.auth.service_tokens import get_service_token, get_user_info
    from src.dependencies import mcp

    # Log who's calling
    user_info = get_user_info()
    logger.info(f"graph_get_profile called by {user_info.get('user_name', 'Unknown')}")

    # Get Graph API token via OBO
    graph_token = await get_service_token("graph")

    # Call Microsoft Graph
    async with httpx.AsyncClient() as client:
        response = await client.get(
            f"{GRAPH_BASE_URL}/me",
            headers={"Authorization": f"Bearer {graph_token}"},
        )
        response.raise_for_status()
        return response.json()

# Register with FastMCP - import mcp here to avoid circular imports
def register(mcp_instance):
    """Register this tool with the MCP instance"""
    mcp_instance.tool(name="graph_get_profile")(graph_get_profile)1234567891011121314151617181920212223242526272829303132333435

"""Azure DevOps profile tool"""

import logging

import httpx

logger = logging.getLogger(__name__)

DEVOPS_PROFILE_URL = "https://app.vssps.visualstudio.com/_apis/profile/profiles/me"
DEVOPS_ACCOUNTS_URL = "https://app.vssps.visualstudio.com/_apis/accounts"

async def devops_get_profile() -> dict:
    """Get the current user's Azure DevOps profile and organisations"""
    from src.auth.service_tokens import get_service_token, get_user_info

    user_info = get_user_info()
    logger.info(f"devops_get_profile called by {user_info.get('user_name', 'Unknown')}")

    # Get DevOps API token via OBO
    devops_token = await get_service_token("devops")
    headers = {"Authorization": f"Bearer {devops_token}"}

    async with httpx.AsyncClient() as client:
        # Get profile
        profile_response = await client.get(
            DEVOPS_PROFILE_URL,
            headers=headers,
            params={"api-version": "7.1"},
        )
        profile_response.raise_for_status()
        profile = profile_response.json()

        # Get organisations
        accounts_response = await client.get(
            DEVOPS_ACCOUNTS_URL,
            headers=headers,
            params={"api-version": "7.1", "memberId": profile.get("id")},
        )

        organisations = []
        if accounts_response.status_code == 200:
            organisations = accounts_response.json().get("value", [])

        return {
            "profile": profile,
            "organisations": organisations,
        }

def register(mcp_instance):
    """Register this tool with the MCP instance"""
    mcp_instance.tool(name="devops_get_profile")(devops_get_profile)123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051

"""FastMCP setup and dependency management"""

import logging
from contextlib import asynccontextmanager
from typing import TYPE_CHECKING

from fastmcp import FastMCP

from src.auth.fastmcp_provider import AzureEntraIDAuthProvider
from src.auth.obo_handler import OBOHandler
from src.config import settings

if TYPE_CHECKING:
    from collections.abc import AsyncIterator

logger = logging.getLogger(__name__)

# Global OBO handler (initialized at startup)
_obo_handler: OBOHandler | None = None

def get_obo_handler() -> OBOHandler | None:
    """Get the OBO handler instance"""
    return _obo_handler

@asynccontextmanager
async def lifespan(_mcp: FastMCP) -> "AsyncIterator[None]":
    """Lifespan manager - initializes OBO handler at startup"""
    global _obo_handler

    if settings.TENANT_ID and settings.CLIENT_ID:
        _obo_handler = OBOHandler(
            tenant_id=settings.TENANT_ID,
            client_id=settings.CLIENT_ID,
            mi_client_id=settings.MI_CLIENT_ID,
        )
        logger.info("OBO handler initialized")

    yield

    logger.info("MCP server shutting down")

# Configure auth provider if credentials are available
auth_provider = None
if settings.TENANT_ID and settings.CLIENT_ID:
    auth_provider = AzureEntraIDAuthProvider(
        tenant_id=settings.TENANT_ID,
        client_id=settings.CLIENT_ID,
        base_url=settings.constructed_app_url,
        max_token_age_hours=settings.MAX_TOKEN_AGE_HOURS,
    )

# Create FastMCP instance
mcp = FastMCP(
    name="MCP OAuth2 OBO Server",
    instructions="MCP Server with OAuth2 On-Behalf-Of flow for Microsoft services",
    lifespan=lifespan,
    auth=auth_provider,
)

# Register tools
from src.tools import devops_profile, graph_profile

graph_profile.register(mcp)
devops_profile.register(mcp)12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364

"""Health check endpoint"""

import os
from datetime import UTC, datetime

from starlette.requests import Request
from starlette.responses import JSONResponse

async def health_check(_request: Request) -> JSONResponse:
    """Health probe for Container Apps"""
    from src.config import settings

    return JSONResponse({
        "status": "healthy",
        "timestamp": datetime.now(UTC).isoformat(),
        "service": "MCP OAuth2 OBO Server",
        "version": "1.0.0",
        "auth_mode": "managed_identity" if os.environ.get("IDENTITY_ENDPOINT")
                     else "client_secret" if os.environ.get("AZURE_CLIENT_SECRET")
                     else "none",
    })123456789101112131415161718192021

#!/usr/bin/env python3
"""MCP Server entry point"""

import logging

import uvicorn
from starlette.applications import Starlette

from src.config import settings
from src.dependencies import mcp
from src.routes.health import health_check

logger = logging.getLogger(__name__)

# Register custom routes
mcp.custom_route("/health", methods=["GET"])(health_check)

# Create the ASGI app
app = mcp.http_app(transport="http")

if __name__ == "__main__":
    logger.info("=" * 60)
    logger.info("Starting MCP Server")
    logger.info(f"Tenant ID: {settings.TENANT_ID}")
    logger.info(f"Client ID: {settings.CLIENT_ID}")
    logger.info(f"Port: {settings.PORT}")
    logger.info("=" * 60)

    uvicorn.run(
        app,
        host="0.0.0.0",  # Required for containers
        port=settings.PORT,
        log_level="info",
    )12345678910111213141516171819202122232425262728293031323334

AZURE_TENANT_ID=your-tenant-id
AZURE_CLIENT_ID=your-app-client-id
AZURE_CLIENT_SECRET=your-client-secret
APP_URL=http://localhost:8000
LOG_LEVEL=INFO12345

cd mcp-server
uv run python -m src.server12

curl http://localhost:8000/health1

TOKEN=$(az account get-access-token \
    --scope "api://YOUR_CLIENT_ID/access_as_user" \
    --query accessToken -o tsv)123

# Initialize a session
SESSION_ID=$(curl -s -o /dev/null -w '%header{mcp-session-id}' \
    -X POST "http://localhost:8000/mcp" \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -H "Accept: application/json, text/event-stream" \
    -d '{"jsonrpc": "2.0", "method": "initialize", "params": {"protocolVersion": "2024-11-05", "capabilities": {}, "clientInfo": {"name": "curl", "version": "1.0"}}, "id": 1}')

echo "Session ID: $SESSION_ID"

# List available tools
curl -s -X POST "http://localhost:8000/mcp" \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -H "Accept: application/json, text/event-stream" \
    -H "Mcp-Session-Id: $SESSION_ID" \
    -d '{"jsonrpc": "2.0", "method": "tools/list", "id": 2}'1234567891011121314151617

Session ID: 692c0784dca642c786869f098032cd9a
event: message
data: {"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"graph_get_profile","description":"Get the current user's Microsoft 365 profile",...},{"name":"devops_get_profile","description":"Get the current user's Azure DevOps profile and organisations",...}]}}123

async def get_user_context() -> dict:
    """Get combined user context from all sources"""
    import asyncio

    # Fetch from both services in parallel
    graph_task = asyncio.create_task(fetch_graph_profile())
    devops_task = asyncio.create_task(fetch_devops_profile())

    graph_profile, devops_profile = await asyncio.gather(
        graph_task, devops_task, return_exceptions=True
    )

    # Combine and deduplicate
    return {
        "name": graph_profile.get("displayName"),
        "email": graph_profile.get("mail"),
        "job_title": graph_profile.get("jobTitle"),
        "department": graph_profile.get("department"),
        "devops_organisations": [
            org.get("accountName") for org in devops_profile.get("organisations", [])
        ],
    }12345678910111213141516171819202122

# Multi-stage build for optimized image size
FROM python:3.11-slim AS builder

WORKDIR /app

# Install uv for fast dependency installation
RUN pip install --no-cache-dir uv==0.7.0

# Copy dependency file and install
COPY pyproject.toml .
RUN uv pip install --system --no-cache .

# Final stage
FROM python:3.11-slim

WORKDIR /app

# Prevent Python from writing .pyc files (not needed in containers)
ENV PYTHONDONTWRITEBYTECODE=1

# Create non-root user for security
RUN useradd -m -u 1000 appuser && chown -R appuser:appuser /app

# Copy Python packages from builder
COPY --from=builder /usr/local/lib/python3.11/site-packages /usr/local/lib/python3.11/site-packages
COPY --from=builder /usr/local/bin /usr/local/bin

# Copy application code
COPY --chown=appuser:appuser src/ ./src/

# Switch to non-root user
USER appuser

# Container Apps sets PORT environment variable
EXPOSE 8000

# Health check for container orchestration
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')" || exit 1

# Run with uvicorn
CMD ["uvicorn", "src.server:app", "--host", "0.0.0.0", "--port", "8000"]123456789101112131415161718192021222324252627282930313233343536373839404142

# If you saved them to a file, source it:
# source ./azure-vars.sh

# Or set them again:
CONTAINER_REGISTRY="acrmcpdev${RANDOM_ID}"
RESOURCE_GROUP="rg-mcp-dev-${RANDOM_ID}"123456

az acr login --name "$CONTAINER_REGISTRY"1

# Build from the mcp-server/ directory where Dockerfile lives
docker build -t "${CONTAINER_REGISTRY}.azurecr.io/mcp-server:latest" .

# Push to ACR
docker push "${CONTAINER_REGISTRY}.azurecr.io/mcp-server:latest"12345

az acr build \
  --registry "$CONTAINER_REGISTRY" \
  --image mcp-server:latest .123

# Get the values we need
ACR_LOGIN_SERVER=$(az acr show \
  --name "$CONTAINER_REGISTRY" \
  --resource-group "$RESOURCE_GROUP" \
  --query loginServer -o tsv)

az containerapp create \
  --name "$CONTAINER_APP" \
  --resource-group "$RESOURCE_GROUP" \
  --environment "$CONTAINER_ENV" \
  --image "${ACR_LOGIN_SERVER}/mcp-server:latest" \
  --registry-server "$ACR_LOGIN_SERVER" \
  --registry-identity "$MI_RESOURCE_ID" \
  --user-assigned "$MI_RESOURCE_ID" \
  --target-port 8000 \
  --ingress external \
  --min-replicas 0 \
  --max-replicas 10 \
  --cpu 0.25 \
  --memory 0.5Gi \
  --env-vars \
    "AZURE_TENANT_ID=$TENANT_ID" \
    "AZURE_CLIENT_ID=$APP_ID" \
    "AZURE_MI_CLIENT_ID=$MI_CLIENT_ID" \
    "PORT=8000" \
    "LOG_LEVEL=INFO"1234567891011121314151617181920212223242526

APP_URL=$(az containerapp show \
  --name "$CONTAINER_APP" \
  --resource-group "$RESOURCE_GROUP" \
  --query properties.configuration.ingress.fqdn -o tsv)

echo "Application URL: https://${APP_URL}"123456

curl "https://${APP_URL}/health" | jq1

{
  "status": "healthy",
  "timestamp": "2025-01-23T14:30:00.000000+00:00",
  "service": "MCP OAuth2 OBO Server",
  "version": "1.0.0",
  "auth_mode": "managed_identity"
}1234567

curl "https://${APP_URL}/.well-known/oauth-protected-resource/mcp" | jq1

{
  "resource": "https://ca-mcp-dev-xxxx.....azurecontainerapps.io/mcp",
  "authorization_servers": [
    "https://login.microsoftonline.com/{tenant-id}/v2.0"
  ],
  "scopes_supported": [
    "api://{client-id}/access_as_user"
  ],
  "bearer_methods_supported": [
    "header"
  ],
  "resource_name": "MCP OAuth2 OBO Server"
}12345678910111213

az containerapp logs show \
  --name "$CONTAINER_APP" \
  --resource-group "$RESOURCE_GROUP" \
  --follow1234

# Rebuild and push (from the mcp-server/ directory)
docker build -t "${CONTAINER_REGISTRY}.azurecr.io/mcp-server:latest" .
docker push "${CONTAINER_REGISTRY}.azurecr.io/mcp-server:latest"

# Force a new revision to pull the updated image
az containerapp update \
  --name "$CONTAINER_APP" \
  --resource-group "$RESOURCE_GROUP" \
  --image "${CONTAINER_REGISTRY}.azurecr.io/mcp-server:latest" \
  --revision-suffix "v$(date +%s)"12345678910

echo "https://${APP_URL}/mcp"1

WWW-Authenticate: Bearer resource="https://ca-mcp-dev-a1b2.../mcp"1

Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI...1

# Get your user ID
MY_USER_ID=$(az ad signed-in-user show --query id -o tsv)

# Check if you're in the group
az ad group member check \
  --group "$GROUP_ID" \
  --member-id "$MY_USER_ID"1234567

INFO - graph_get_profile called by Jane Smith
DEBUG - OBO exchange successful for graph12

# Requires Mail.Read scope
async def list_recent_emails(count: int = 10) -> list[dict]:
    """List the user's recent emails"""
    token = await get_service_token("graph", ["https://graph.microsoft.com/Mail.Read"])
    async with httpx.AsyncClient() as client:
        response = await client.get(
            f"https://graph.microsoft.com/v1.0/me/messages?$top={count}&$orderby=receivedDateTime desc",
            headers={"Authorization": f"Bearer {token}"},
        )
        response.raise_for_status()
        return response.json().get("value", [])1234567891011

# Requires Calendars.Read scope
async def get_todays_meetings() -> list[dict]:
    """Get meetings scheduled for today"""
    token = await get_service_token("graph", ["https://graph.microsoft.com/Calendars.Read"])
    # ... implementation12345

# Requires vso.work scope
async def list_my_work_items(organisation: str, project: str) -> list[dict]:
    """List work items assigned to the current user"""
    token = await get_service_token("devops", ["499b84ac-1321-427f-aa17-267ca6975798/vso.work"])
    # ... implementation12345

# Add Mail.Send permission
az ad app permission add \
  --id "$APP_ID" \
  --api "00000003-0000-0000-c000-000000000000" \
  --api-permissions "e383f46e-2787-4529-855e-0e479a3ffac0=Scope"

# Grant admin consent for new permissions
az ad app permission admin-consent --id "$APP_ID"12345678

async def send_email(to: str, subject: str, body: str) -> dict:
    """Send an email on behalf of the user"""
    token = await get_service_token("graph", ["https://graph.microsoft.com/Mail.Send"])
    # ... implementation1234

# Example: Query recent auth failures in Container Apps logs
az monitor log-analytics query \
  --workspace "$LOG_ANALYTICS_WORKSPACE_ID" \
  --analytics-query "ContainerAppConsoleLogs_CL | where Log_s contains 'Token validation failed' | summarize count() by bin(TimeGenerated, 1h)"1234

# List current permissions
az ad app permission list --id "$APP_ID" -o table12

az group delete --name "rg-mcp-dev-${RANDOM_ID}" --yes --no-wait1

APP_ID=$(az ad app list --display-name "MCP OAuth2 OBO Server (mcp-dev-${RANDOM_ID})" --query "[0].appId" -o tsv)
az ad app delete --id "$APP_ID"12

SP_ID=$(az ad sp list --display-name "MCP OAuth2 OBO Server (mcp-dev-${RANDOM_ID})" --query "[0].id" -o tsv)
if [ -n "$SP_ID" ]; then
  az ad sp delete --id "$SP_ID"
fi1234

GROUP_ID=$(az ad group list --display-name "MCP OAuth2 OBO Server Users (mcp-dev-${RANDOM_ID})" --query "[0].id" -o tsv)
az ad group delete --group "$GROUP_ID"12

# Find app registrations containing your prefix
az ad app list --query "[?contains(displayName, 'MCP OAuth2 OBO Server')].{name:displayName, id:appId}" -o table

# Find resource groups
az group list --query "[?contains(name, 'rg-mcp-')].name" -o table12345

{"status": "healthy", "auth_mode": "managed_identity"}1

logger.info(f"graph_get_profile called by {user_info.get('user_name', 'Unknown')}")1