From d443c70bb554c0bb03edca0533c282928a569256 Mon Sep 17 00:00:00 2001 From: Thomas Jung Date: Fri, 2 Oct 2026 10:34:06 -0400 Subject: [PATCH] docs(api): update MCP signed-in auth to IAS native-HTTP OAuth The /api-docs page documented the old XSUAA + mcp-remote bridge for the /mcp-auth/* tier. Production now fronts it with SAP Identity Authentication Service (IAS): OAuth 2.1 authorization-code + PKCE, public client (no secret), discovery via RFC 9728 protected-resource metadata. Native-HTTP-OAuth MCP clients point straight at the mount; no mcp-remote bridge needed. A2A remains XSUAA client-credentials (not migrated); its section is unchanged, tracked separately. --- hugo/content/api-docs/_index.md | 4 ++-- hugo/data/api_endpoints.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/hugo/content/api-docs/_index.md b/hugo/content/api-docs/_index.md index eebdf3ffa..f6d375437 100644 --- a/hugo/content/api-docs/_index.md +++ b/hugo/content/api-docs/_index.md @@ -107,10 +107,10 @@ Each CDS service is mounted separately under `/mcp/*` over the [Model Context Pr **Signed-in tools** (your progress, recommendations, marking steps done) live behind two authenticated tiers: -- **`/mcp-auth/*`** — OAuth 2.1 + PKCE. Requires the `Tutorial.MCP` scope (**Tutorials MCP Users** role collection). XSUAA has no dynamic client registration, so bridge through [`mcp-remote`](https://www.npmjs.com/package/mcp-remote) with the pre-registered public client. +- **`/mcp-auth/*`** — OAuth 2.1 authorization-code + PKCE against SAP Identity Authentication Service (IAS), as a **public client** (no secret). Point an MCP client with native HTTP OAuth straight at the mount — the authorization server, scopes, and PKCE method are advertised via [`/.well-known/oauth-protected-resource`](https://developers.sap.com/.well-known/oauth-protected-resource) and [`/.well-known/oauth-authorization-server`](https://developers.sap.com/.well-known/oauth-authorization-server), so no `mcp-remote` bridge is needed. In Claude Code: `"sap-developers-auth": { "type": "http", "url": "https://developers.sap.com/mcp-auth/api" }` — approve, and the browser sign-in completes the flow. - **`/mcp-pat/*`** — a **Personal Access Token** for headless / CI clients that can't do a browser flow. Mint one at [`/me/tokens/`](/me/tokens/) (self-service; requires the **Tutorials MCP Users** role collection), then send `Authorization: Bearer pat_...`. Scopes: `read` (read tools) or `write` (also allows `complete_step` / `reset_tutorial_progress`). The plaintext token is shown once. -Full connection walkthrough (Claude Desktop, Claude Code, `mcp-remote`, PATs, troubleshooting): [MCP Quickstart](https://github.com/sap-tutorials/tutorials-ims/blob/main/docs/end-users/mcp-quickstart.md). Tool + parameter reference: [mcp-server.md](https://github.com/sap-tutorials/tutorials-ims/blob/main/docs/developers/reference/mcp-server.md). +Full connection walkthrough (Claude Desktop, Claude Code, native HTTP OAuth, PATs, troubleshooting): [MCP Quickstart](https://github.com/sap-tutorials/tutorials-ims/blob/main/docs/end-users/mcp-quickstart.md). Tool + parameter reference: [mcp-server.md](https://github.com/sap-tutorials/tutorials-ims/blob/main/docs/developers/reference/mcp-server.md). ### Local `sap-devs` CLI MCP (over stdio) diff --git a/hugo/data/api_endpoints.yaml b/hugo/data/api_endpoints.yaml index ecb74ecb7..19d8342cc 100644 --- a/hugo/data/api_endpoints.yaml +++ b/hugo/data/api_endpoints.yaml @@ -116,8 +116,8 @@ sections: auth: "XSUAA" purpose: 'Joule chat streaming endpoint (Server-Sent Events).' - path: "/mcp-auth/*" - auth: "XSUAA" - purpose: 'Hosted MCP — OAuth/JWT tier (scope Tutorial.MCP). Forwards your JWT to the user-scoped mounts (/mcp/api DeveloperService, /mcp/homepage): your progress, missions, events, recommendations. Bridge via mcp-remote with the pre-registered client.' + auth: "IAS (OAuth2 + PKCE)" + purpose: 'Hosted MCP — OAuth tier (SAP IAS, authorization-code + PKCE, public client, no secret). Forwards your token to the user-scoped mounts (/mcp/api DeveloperService, /mcp/homepage): your progress, missions, events, recommendations. Point a native-HTTP-OAuth MCP client straight at the mount — no mcp-remote bridge.' driftMarkers: - "/mcp-auth/*" - "/mcp/api"