Model Context Protocol Adds Enterprise-Managed Authorization Extension
Summary
Model Context Protocol adds an Enterprise-Managed Authorization extension that lets a company's identity provider decide which MCP servers employees can access, replacing per-user consent. Clients exchange an ID-JAG token for a server access token. Documentation lists Okta, Ping Identity and Descope as supporting vendors; Okta caps issuing at 250 ID-JAGs per user per resource app monthly.
Key Points
- Keycloak accepts ID-JAGs only as an experimental feature behind the identity-assertion-jwt flag since 26.7.0, per the documentation.
- Revoking an employee at the identity provider takes effect immediately across all MCP clients, the documentation states.
- The IETF OAuth working group defines ID-JAG in draft-ietf-oauth-identity-assertion-authz-grant.