[Bug]: Deploying MCP Authentication + Authorization from AI Workspace fails on gateway 1.1.0

[randilt]

Please select the area the issue is related to

AI Workspace, Gateway

Please select the aspect the issue is related to

Aspect/API (API backends, definitions, contracts, interfaces, OpenAPI), Aspect/AI (AI/LLM integration, MCP, AI readiness), Aspect/Configuration (Config files, settings, env vars, defaults)

Description

Attached MCP Authentication and MCP Authorization on an MCP proxy in AI Workspace and deployed it to a self-hosted gateway 1.1.0. Deploy failed. The policies never got applied.

The YAML AI Workspace sends does not match the policy schemas that are actually inside the 1.1.0 image.

This gateway has:

• mcp-auth v1.0.2
• mcp-authz v1.0.1

Both schemas set additionalProperties: false.

AI Workspace still writes the newer Policy Hub fields:

mcp-auth:

• userIdClaim
• forwardToken
• forwardTokenStripScheme
• forwardedTokenHeader

mcp-authz:

• scopes / scopes.allOf on each tool

Those fields do not exist on 1.1.0. The controller rejects the artifact and nacks the deploy.

Gateway on startup:

Loaded policy definition name=mcp-auth version=v1.0.2
Loaded policy definition name=mcp-authz version=v1.0.1

Deploy failure:

Failed to create MCP proxy from YAML proxy_id=01a08a27-5e8e-7b07-b332-a4efb081d295
error="configuration validation failed with 14 error(s):
  1. spec.policies[0].params: Additional property userIdClaim is not allowed
  2. spec.policies[0].params: Additional property forwardToken is not allowed
  3. spec.policies[0].params: Additional property forwardTokenStripScheme is not allowed
  4. spec.policies[0].params: Additional property forwardedTokenHeader is not allowed
  5. spec.policies[1].params.tools.0: Must validate at least one schema (anyOf)
  6. spec.policies[1].params.tools.0: requiredClaims is required
  ... same for tools.1–4 ..."
Deployment ack sent resource_type=mcpproxy action=deploy status=failed

An earlier attempt also logged this, which shows the authz shape mismatch clearly:

field=spec.policies[1].params.tools.0 message="Additional property scopes is not allowed"
field=spec.policies[1].params.tools.0 message="requiredClaims is required"

1.1.0 mcp-authz only accepts requiredScopes / requiredClaims. Console sent scopes.

This is not a bad policy form on my side. The control plane is not generating YAML for the policy versions installed on the connected gateway.

Steps to Reproduce

1. Run self-hosted ghcr.io/wso2/api-platform/gateway-controller:1.1.0 + gateway-runtime:1.1.0, registered to Bijira.
2. In AI Workspace, open an MCP proxy → Policies.
3. Attach MCP Authentication (issuers = a key manager name from config.toml) and MCP Authorization (per-tool scope rules).
4. Deploy to the 1.1.0 gateway.

Expected: artifact validates against the gateway’s installed mcp-auth/mcp-authz schemas and deploys.

Actual: controller rejects the YAML; deploy status=failed.

Severity Level of the Issue

Severity/Blocker (Core functionality is broken and consumer is blocked. Need immediate attention)

Environment Details (with versions)

• macOS darwin 25.5.0
• ghcr.io/wso2/api-platform/gateway-controller:1.1.0
• ghcr.io/wso2/api-platform/gateway-runtime:1.1.0
• build.yaml gateway.version: 1.1.0
• Control plane: Bijira AI Workspace (ai-workspace.bijira.dev)
• /app/default-policies/mcp-auth.yaml → v1.0.2
• /app/default-policies/mcp-authz.yaml → v1.0.1