OIDC providers beyond Entra #8

New issue

Open

opened 2026-08-26 04:49:54 +00:00 by jlxq0 · 0 comments

jlxq0 commented

2026-08-26 04:49:54 +00:00

Owner

Migrated from Plan.md's "Deferred (do not drift into these)" section when that file was retired; open work belongs in issues, not in a file with no state. Nothing here is scheduled and no decision has been taken. Do not start it without an explicit go.

TYPST_MCP_OIDC_ISSUER / _AUDIENCE / _TENANT_ID are already generic, and the CI smoke runs against a disposable static-file provider rather than Entra, so a second provider is config rather than code as far as anyone knows.

No second provider has been asked for, so there is nothing to do and nothing to test against. If one arrives, the Entra-specific traps are recorded in AGENTS.md and the project CLAUDE.md: a v2.0 access token's aud is the client-ID GUID, never the api:// App ID URI.

Plan.md's wording: "OIDC providers beyond Entra — the config is generic; nothing else to do until needed."

Migrated from `Plan.md`'s "Deferred (do not drift into these)" section when that file was retired; open work belongs in issues, not in a file with no state. **Nothing here is scheduled and no decision has been taken.** Do not start it without an explicit go. `TYPST_MCP_OIDC_ISSUER` / `_AUDIENCE` / `_TENANT_ID` are already generic, and the CI smoke runs against a disposable static-file provider rather than Entra, so a second provider is config rather than code as far as anyone knows. **No second provider has been asked for**, so there is nothing to do and nothing to test against. If one arrives, the Entra-specific traps are recorded in `AGENTS.md` and the project `CLAUDE.md`: a v2.0 access token's `aud` is the client-ID GUID, never the `api://` App ID URI. Plan.md's wording: "OIDC providers beyond Entra — the config is generic; nothing else to do until needed."

jlxq0 added this to the Deferred — needs a decision milestone

2026-08-26 04:49:54 +00:00

jlxq0 added the

deferred

label

2026-08-26 04:49:54 +00:00