Support Embedded Auth Server alongside AWS STS token exchange

[tgrunnagle]

RFC to support running the embedded authorization server alongside the AWS STS token exchange middleware.

[jhrozek]

Hmm, would the AWS STS work with MCPServer at all? I've only ever tested that with MCPRemoteProxy. And looking at the STS code, it does require a RemoteURL.

[jhrozek]

More context: the reason the STS context requires a remote URL is that with AWS STS, all HTTP messages carry an AWS-HMAC-SHA header that also encodes the target host. So the AWS STS can't work without a remote URL, was the intent to add a remote URL to MCPServer as well?

[jhrozek]

Having the vMCP work in mind that will hit exactly the same issue I wonder if we should rather head in the opposite direction and keep the ExternalAuth CRD strictly for the MCPServer-to-backend API and add a new CRD for the authserver config. Then the MCP server would define:

    authServerRef:
      name: my-auth-server        # Identity
    externalAuthConfigRef:
      name: my-sts-config         # Outgoing: AWS STS

where my-auth-server would point to:

  apiVersion: toolhive.stacklok.com/v1alpha1
  kind: MCPAuthServerConfig  # Or inline in MCPServer spec if we wanted to
  metadata:
    name: my-auth-server
  spec:
    issuerURL: https://...
    upstreams: [...]

this would allow us to compose the configuration more freely and express combinations like auth server + rfc token exchange, auth server + entra OBO, authserver + static header injection etc without any other changes to the CRDs.