[goutamadwant]

Summary

Add an OAuth 2.1 proxy and Dynamic Client Registration facade to ModelContextProtocol.AspNetCore for identity providers that do not support DCR.

What changed

• Add authorization-server metadata, protected-resource metadata, client registration, authorization, callback, and token endpoints.
• Discover upstream OAuth endpoints through OIDC metadata.
• Use separate S256 PKCE flows for the client-to-proxy and proxy-to-provider exchanges.
• Bind authorization transactions to protected, short-lived cookies.
• Keep upstream access and refresh tokens server-side using Data Protection and IMcpOAuthProxyStore.
• Require an application token factory and prevent upstream tokens from being returned to MCP clients.
• Support opaque refresh-token families, replay detection, descendant revocation, and retry-safe rotation.
• Add registration and authorization policy callbacks for application-specific validation.
• Emit structured token-mint audit records containing the subject, audience, scopes, client ID, token ID, and mint time.
• Provide a single-instance IDistributedCache store adapter and document the atomic-store requirements for distributed deployments.
• Document configuration, storage, key rotation, rate limiting, and security considerations.

The change is additive and does not alter existing authentication or transport behavior.

Testing

• dotnet restore ModelContextProtocol.slnx
• dotnet build ModelContextProtocol.slnx --no-restore
• dotnet test tests/ModelContextProtocol.AspNetCore.Tests/ModelContextProtocol.AspNetCore.Tests.csproj --no-build --no-restore --filter FullyQualifiedName~OAuth
  • 115 tests passed on each of .NET 8, .NET 9, and .NET 10
• Focused OAuth proxy suite
  • 17 tests passed on each of .NET 8, .NET 9, and .NET 10
• dotnet format ModelContextProtocol.slnx --verify-no-changes --no-restore --include src/ModelContextProtocol.AspNetCore/Authentication tests/ModelContextProtocol.AspNetCore.Tests/OAuth/McpOAuthProxyTests.cs
• dotnet docfx docs/docfx.json --warningsAsErrors true
  • 0 warnings and 0 errors

Fixes #1446