Azure-Samples / Azure-Samples/remote-mcp-apim-functions-python

EasyAuth returns 403 forbidden

Offen
#21 2 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
Bicep
Sterne
129
Forks
79
PR-Merge-Kennzahlen
Keine gemergten PRs in 30 T.

Beschreibung

I have made some changes to try use EasyAuth instead of function key. Copilot suggested using the same app registration so that has been my main attempt. I get everything working except at the very end, it returns 403 when trying to get the list of MCP tools after getting authenticated. The error in the function app:
```
2025-07-18T21:54:34Z [Information] Authorization failed. These requirements were not met:
Handler assertion should evaluate to true.
2025-07-18T21:54:34Z [Information] Executing ForbidResult with authentication schemes (WebJobsAuthLevel, Bearer).
2025-07-18T21:54:34Z [Information] AuthenticationScheme: WebJobsAuthLevel was forbidden.
```

I also made changes to persist the ClientInfo by adding http endpoints to store and fetch the client information. These http endpoints are in the same function app and they do not get rejected. Why do only the MCP endpoints fail the authentication scheme with the exact same token?

Beitragsleitfaden

Beitragsleitfaden öffnen

Rechercherichtung

Start by comparing authentication for the MCP endpoints with the HTTP endpoints used to store and fetch ClientInfo, then reproduce the tools-list request and inspect the shown function-app authorization logs. Done means the same token is accepted for the MCP request without the WebJobsAuthLevel forbid response.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
azure
Bereich
api, authentication, backend
Issue-Typ
Bug
Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Aktivitätsstatus
Veraltet
Klarheit
Muss geklärt werden
Anfängerfreundlichkeit
25/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.