Model Context Protocol(MCP) Authorization for Enterprise Use Case With Keycloak
summary
Proposal SEP-646 merged Oct 31 adds enterprise-managed MCP authorization so agentic AI uses an identity assertion (ID-JWT / ID jot) instead of per-resource consent, giving the central IdP visibility and admin control and removing repeated user prompts. Demo modifies a Node.js sample to show Okta issuing the ID-JWT and Keycloak (with RFC 7523 preview + token-exchange support) consuming it to mint MCP access tokens; integration works end-to-end and PR #4608 covers the Keycloak changes.
AI-written summary · about
chapters (10)
- 0:00MCP and Keycloak intro
- 2:08Agent AI and MCP background
- 3:57MCP and OAuth relationship
- 4:40Enterprise pain points
- 9:59Solution: ID JOT grant
- 11:54ID JOT flow details
- 14:00Keycloak implementation status
- 15:49Demo setup
- 17:15Live demo walkthrough
- 23:34Key takeaways
related talks
27mSimple Control: Managing Multi-Domain MCP Access Via Keycloak IdP With ID-JAG
32mAI Agents with Keycloak in MCP
20mEvolution of MCP auth
17mSponsored Demo: MCP Auth Demo: CIMD With Keycloak
26mSecure Your MCP Servers with OAuth, JWT, SPIFFE and More
39mSecure Authorization for Agentic AI in Multi-Domain Environments
45mSecuring MCP Servers with Spring AI
25mSecure Your MCP Servers With OAuth, JWT, SPIFFE and More