Document Cedar primary upstream provider selection#849
Conversation
Clarify how Cedar resolves its claim source when the embedded auth server is active: it reads upstream IDP claims only when the runtime config sets primary_upstream_provider, otherwise it falls back to claims on the original client request. Document the operator's default-to-first-upstream behavior on VirtualMCPServer, the new primaryUpstreamProvider override, and the rejection conditions that guard misconfiguration. Note that the field is a no-op on MCPServer and MCPRemoteProxy and surfaces an advisory condition. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Will amend the next generated updates. |
|
Will merge after generated updates for |
|
@tgrunnagle ping when this is ready for review |
|
What's the status of this one? Did the generated updates (unclear which version it should have landed on... 0.27.1, #861 maybe based on timing) catch the changes, or does this still need to be reviewed & merged? |
|
this would still be nice to document right @tgrunnagle ? |
|
Pinging on this one again @tgrunnagle; if it's still needed/useful, it'll need to be re-worked into the guides since they've been significantly updated since this was first drafted. Otherwise, should we close? |
3 participants
Description
Documents how Cedar resolves its claim source when authorizing requests, with
particular focus on the multi-upstream embedded auth server case on
VirtualMCPServer.Three doc surfaces updated:
rewrites the "How it works" steps under "Upstream identity provider claims"
to enumerate the three claim-source cases:
primaryUpstreamProviderset;unset with an embedded auth server (first upstream); unset with no embedded
auth server (client request token). Adds a new "How the upstream provider is
chosen" subsection that splits behavior between
VirtualMCPServerandMCPServer/MCPRemoteProxy.adds a "Cedar authorization claim source" subsection in the embedded auth
server section, documenting the default-to-first-upstream binding, the
AuthzUpstreamSelectionWarningadvisory condition, theprimaryUpstreamProvideroverride syntax, and the two admission rejectionconditions (
AuthzUpstreamUnknown,AuthzPrimaryProviderRequiresAuthServer).note clarifying that the field is a no-op on
MCPServerandMCPRemoteProxy(single-upstream model) and surfaces anAuthzPrimaryUpstreamProviderIgnoredadvisory.Type of change
Related issues/PRs
Documents the new
incomingAuth.authzConfig.inline.primaryUpstreamProviderfield added by stacklok/toolhive#5199 and the existing operator-side
default-to-first-upstream behavior that was previously undocumented.
Submitter checklist
Content and formatting
🤖 Generated with Claude Code