fix(auth): validate the discovered issuer before using it as the JAG audience

RFC 8414 Section 3.3 requires the issuer in the metadata to be identical to
the issuer identifier used for discovery. ClientOAuthProvider already checks
this; the Cross-Application Access flow now does too, before the issuer is
sent as the token-exchange audience. A mismatched issuer fails instead of
becoming the audience.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: mauri0686

src/ModelContextProtocol.Core/Authentication/IdentityAssertionGrantProvider.cs

@@ -169,6 +169,16 @@ private async Task<TokenContainer> AcquireAccessTokenAsync(
         var mcpAuthMetadata = await IdentityAssertionGrant.DiscoverAuthServerMetadataAsync(
             authorizationServerUrl, _httpClient, cancellationToken).ConfigureAwait(false);
 
+        // The issuer becomes the JAG audience below, so validate it first (RFC 8414 Section 3.3): it MUST be
+        // identical to the issuer identifier used for discovery. Like ClientOAuthProvider, compare the exact
+        // strings without normalizing case, trailing slashes or percent-encoding.
+        if (mcpAuthMetadata.Issuer is not null &&
+            !string.Equals(mcpAuthMetadata.Issuer.OriginalString, authorizationServerUrl.OriginalString, StringComparison.Ordinal))
+        {
+            throw new IdentityAssertionGrantException(
+                $"Authorization server metadata issuer '{mcpAuthMetadata.Issuer.OriginalString}' does not match the expected issuer '{authorizationServerUrl.OriginalString}' (RFC 8414 Section 3.3).");
+        }
+
         var mcpTokenEndpoint = mcpAuthMetadata.TokenEndpoint?.ToString()
             ?? throw new IdentityAssertionGrantException(
                 $"MCP authorization server metadata at {authorizationServerUrl} missing token_endpoint.");

tests/ModelContextProtocol.Tests/IdentityAssertionGrantTests.cs

@@ -97,7 +97,7 @@ public async Task IdentityAssertionGrantProvider_FullFlow_ReturnsAccessToken()
 
     [Theory]
     [InlineData("https://auth.example.com", "https://auth.example.com", "https://auth.example.com")]
-    [InlineData("https://auth.example.com/", "https://auth.example.com/tenant", "https://auth.example.com/tenant")]
+    [InlineData("https://auth.example.com/tenant", "https://auth.example.com/tenant", "https://auth.example.com/tenant")]
     [InlineData("https://auth.example.com", null, "https://auth.example.com/")]
     public async Task IdentityAssertionGrantProvider_UsesDiscoveredIssuerAsJagAudience(
         string authorizationServerUrl, string? advertisedIssuer, string expectedAudience)
@@ -157,6 +157,46 @@ await provider.GetAccessTokenAsync(
         Assert.Equal(expectedAudience, audience);
     }
 
+    [Theory]
+    [InlineData("https://auth.example.com/", "https://auth.example.com/tenant")]
+    [InlineData("https://auth.example.com/", "https://auth.example.com")]
+    public async Task IdentityAssertionGrantProvider_RejectsMismatchedIssuer(
+        string authorizationServerUrl, string advertisedIssuer)
+    {
+        var idpCalled = false;
+        _mockHandler.Handler = request =>
+        {
+            if (request.RequestUri!.ToString().Contains("idp.example.com"))
+            {
+                idpCalled = true;
+            }
+
+            return JsonResponse(HttpStatusCode.OK, new JsonObject
+            {
+                ["issuer"] = advertisedIssuer,
+                ["token_endpoint"] = "https://auth.example.com/token",
+            });
+        };
+
+        var provider = new IdentityAssertionGrantProvider(
+            new IdentityAssertionGrantProviderOptions
+            {
+                ClientId = "mcp-client-id",
+                IdpTokenEndpoint = "https://idp.example.com/token",
+                IdpClientId = "idp-client-id",
+                IdTokenCallback = (_, _) => Task.FromResult("mock-id-token"),
+            },
+            _httpClient);
+
+        var ex = await Assert.ThrowsAsync<IdentityAssertionGrantException>(() => provider.GetAccessTokenAsync(
+            new Uri("https://resource.example.com"),
+            new Uri(authorizationServerUrl),
+            TestContext.Current.CancellationToken));
+
+        Assert.Contains("RFC 8414 Section 3.3", ex.Message);
+        Assert.False(idpCalled);
+    }
+
     [Fact]
     public Task IdentityAssertionGrantProvider_DefaultsToPostRegardlessOfMetadataOrder() =>
         AssertMcpTokenEndpointAuthenticationAsync(