OAuth authentication enhanced

[AlexandreDonne]

Hello !
I want to use the MCPClient in a chatbot.
I have a frontend with a chat and a backend where I create agents with Semantic Kernel.
Example : The user says in the chat: "I want to launch the Beatles on Spotify".
I have a MCP server hosted and the authentication works with oAuth.

The workflow I want:
If the user is not connected to the MCP:

• I send the authorization url to the front
• the user log in
• I get the code and pass it to the mcp client which handles the oauth workflow
• After I want to get the access and refresh token to store it and use it on the next call

If the user has connected:

• I get the tokens from my db and pass it to the client
• No authent needed

Today:
I can't set or get the tokens. The AuthorizationRedirectDelegate can't handle asynchrone as I need (I wait for the user to click on "Login")

Thank you.

[halter73]

I'm not sure I fully understand your scenario. Can you provide sample code demonstrating what you're trying to do? AuthorizationRedirectDelegate is Task-returning, so I don't see way you would be unable to wait for the user to log in. The access token and refresh tokens are automatically stored in memory and will be used as necessary for the rest of the MCP session.

Things get trickier if you are trying to handle an authentication flow across multiple processes, but even then, you have the ability to pass in your own HttpClient via the SseClientTransport constructor. This should allow you to handle the OAuth flow manually if you really need to manage the access and refresh tokens yourself.

[AlexandreDonne]

A message in the chatbot calls a HTTP route on my server where the McpClientFactory.CreateAsync is made.
But I want the authentication to be persisted between messages.

The problem in the AuthorizationRedirectDelegate is that the only solution I see is :
I get the authorization url via the delegate, I publish a message in my chatbot to ask the user to connect.
In my code handling the redirect uri I store the code.
But in my AuthorizationRedirectDelegate I must do a while(1) after publishing the message waiting until I find the code in my store.

[halllo]

I added #834 to allow plugging in custom token caches.
That enables the client to reuse its access token beyond the lifetime of the transport.