Expose jwt-auth token forwarding params in mcp-auth for consistency

[renuka-fernando]

Description

The mcp-auth policy delegates authentication to jwt-auth by cloning its own params and passing them straight through (mcp-auth.go: jwtParams := maps.Clone(params), then deleting only requiredScopes). However, mcp-auth/policy-definition.yaml does not declare jwt-auth's token/header forwarding params, so a user has no documented, supported way to configure them when using mcp-auth — they silently fall back to jwt-auth's built-in defaults.

For consistency with jwt-auth, mcp-auth should expose the following params in its own policy-definition.yaml and forward them explicitly to jwt-auth:

• headerName (default Authorization) — header to read the token from.
• forwardedTokenHeader (default x-forwarded-authorization) — header to forward the token on.
• forwardTokenStripScheme (default false) — strip the scheme prefix from the forwarded token.

Additionally, consider replacing the blind maps.Clone(params) pass-through with explicit param forwarding, so mcp-auth's configuration surface is well-defined rather than implicitly inheriting every jwt-auth param (declared or not).

Note: the forwardToken param is handled separately in #2866, where it is introduced on mcp-auth as an enum (send / drop / auto) rather than a bool.

Version

mcp-auth v1.1.2

Related Issue

#2866