anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Entra Authentication for MCP doesn't work #8616

New Issue
Open
opened 2026-02-16 18:10:24 -05:00 by yindo · 1 comment
yindo commented 2026-02-16 18:10:24 -05:00
Owner
Copy Link
Copy Source

Originally created by @adameska on GitHub (Feb 5, 2026).

Description

The request to my entra app to login and authorize is including resource when it shouldn't And i can't control what is in the resource and it's not matching verbatim what my app registration has as an Application ID URI (my MCP has resource: "http://localhost:3000" and my entra has http://localhost:3000 as the ID but opencode is passing resource of "http://localhost:3000/" which is causing getting a token to fail. My MCP is returning an authorization server of
"https://login.microsoftonline.com/tenat-guid/v2.0" which doesn't support dynamic client registration (so i set a client id and scopes, it didn't look like i could set resource even if i wanted to?)

We shouldn't need to set resource at all... the scope "http://localhost:3000/basic" should be all that's needed for entra auth to work.

Plugins

none

OpenCode version

1.1.51

Steps to reproduce

  1. Add a MCP resource that uses entra auth
  2. Try and authenticate with automatic oauth token generation instead of setting it yourself

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response

Originally created by @adameska on GitHub (Feb 5, 2026). ### Description The request to my entra app to login and authorize is including resource when it shouldn't And i can't control what is in the resource and it's not matching verbatim what my app registration has as an Application ID URI (my MCP has resource: "http://localhost:3000" and my entra has http://localhost:3000 as the ID but opencode is passing resource of "http://localhost:3000/" which is causing getting a token to fail. My MCP is returning an authorization server of "https://login.microsoftonline.com/tenat-guid/v2.0" which doesn't support dynamic client registration (so i set a client id and scopes, it didn't look like i could set resource even if i wanted to?) We shouldn't need to set resource at all... the scope "http://localhost:3000/basic" should be all that's needed for entra auth to work. ### Plugins none ### OpenCode version 1.1.51 ### Steps to reproduce 1. Add a MCP resource that uses entra auth 2. Try and authenticate with automatic oauth token generation instead of setting it yourself ### Screenshot and/or share link _No response_ ### Operating System _No response_ ### Terminal _No response_
yindo added the bug label 2026-02-16 18:10:24 -05:00
yindo commented 2026-02-16 18:10:24 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Feb 5, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #10950: Stored OAuth credentials silently override explicit provider config - may be related to resource/auth override issues
  • #7306: OAuth client_credentials configuration results in authorization_code flow - relates to OAuth flow configuration not respecting explicit settings
  • #7135: OAuth MCP always using root level even though URL is .../xmcp/mcp - relates to incorrect path/resource handling in OAuth configuration
  • #1492: MCP client doesn't follow specification for Authentication - relates to MCP authentication flow issues
  • #5371: Support MCP servers that require POST-based or non-standard SSE handshake - relates to alternative authentication/connection patterns

The core issue seems to be that OpenCode is passing a 'resource' parameter that doesn't match your Entra configuration. Issues #7306 and #7135 discuss similar problems with OAuth configuration overrides and path handling.

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Feb 5, 2026): This issue might be a duplicate of existing issues. Please check: - #10950: Stored OAuth credentials silently override explicit provider config - may be related to resource/auth override issues - #7306: OAuth client_credentials configuration results in authorization_code flow - relates to OAuth flow configuration not respecting explicit settings - #7135: OAuth MCP always using root level even though URL is .../xmcp/mcp - relates to incorrect path/resource handling in OAuth configuration - #1492: MCP client doesn't follow specification for Authentication - relates to MCP authentication flow issues - #5371: Support MCP servers that require POST-based or non-standard SSE handshake - relates to alternative authentication/connection patterns The core issue seems to be that OpenCode is passing a 'resource' parameter that doesn't match your Entra configuration. Issues #7306 and #7135 discuss similar problems with OAuth configuration overrides and path handling. Feel free to ignore if none of these address your specific case.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#8616
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?