Enterprise: OIDC auth + HTTP transport + RLS

[itdove]

Description

Plug into corporate identity systems. Control who reads/writes what.

HTTP Transport

• MCP server supports HTTP transport alongside stdio
• Enables remote access (not just local)
• Required for OIDC — can't validate JWT over stdio

OIDC Auth Provider

• JWT validation on every MCP call
• IdP group → Lore role mapping via config:

  {
    "auth": {
      "provider": "oidc",
      "issuer": "https://login.microsoftonline.com/<tenant>/v2.0",
      "audience": "lore-api",
      "role_claim": "groups",
      "role_mapping": {
        "admin": "lore-admins",
        "user": "lore-users"
      }
    }
  }

• Tested IdPs: Azure AD / Entra ID, Okta, Keycloak, Google Workspace
• Keycloak as SAML/LDAP bridge for legacy AD environments

Postgres RLS

• For Supabase backend: RLS policies enforce access at DB level
• MCP server passes JWT → Supabase validates → RLS filters rows
• No ACL logic in MCP server code

Auth Providers

• `oidc` — JWT validated in MCP server
• `supabase` — Supabase JWT with RLS
• `none` — no auth (local stdio only)

Acceptance

• HTTP transport works alongside stdio
• OIDC JWT validation on every call
• Group → role mapping configurable
• Works with at least Azure AD and Keycloak
• Supabase RLS policies enforce access
• `auth.provider` config field works

Dependencies

• Enterprise: StoreBackend ABC + Turso/Supabase backends #17 (centralized DB — RLS needs Postgres backend)