Connection error

### MCP server URL

https://magnolia-mcp.ngrok.io/.rest/mcp/v1

### Where does the issue occur?

When pressing the Connect button

### Transport used

streamable-http

### Client registration type

Static

### SSE only: Does your server return the expected status code for POST requests?

Not applicable (my server does not use SSE)

### When did you last reproduce this?

2026-08-05 22:20 US/Central

### Browser and OS

Chrome on Mac OS

### Describe the issue

Connection fails with reference ofid_40937470307df3e5

### Issue details

```shell
Claude opens my browser, bounces me to Jump Cloud where I successfully log in but never makes it back to my app (Magnolia CMS).

Claude is suggesting this could be due to your end using Dynamic Client Registration with Jump Cloud does not support (But we have entered the JC OIDC client ID and secret when adding the custom connector).
```

### Expected behavior

Claude should complete the connection successfully.

### Logs from your server

```shell
2026-08-05 22:13:21,596 DEBUG org.pac4j.core.engine.DefaultSecurityLogic : === SECURITY ===
2026-08-05 22:13:21,597 DEBUG org.pac4j.core.engine.DefaultSecurityLogic : url: https://magnolia-mcp.ngrok.io/.rest/mcp/v1
2026-08-05 22:13:21,597 DEBUG org.pac4j.core.engine.DefaultSecurityLogic : clients: crescendo-jumpcloud | matchers: start-sso-flow
2026-08-05 22:13:21,597 DEBUG c4j.core.client.finder.DefaultSecurityClientFinder: Provided clientNames: crescendo-jumpcloud
2026-08-05 22:13:21,597 DEBUG c4j.core.client.finder.DefaultSecurityClientFinder: clientNameOnRequest: Optional.empty
2026-08-05 22:13:21,597 DEBUG org.pac4j.core.client.Clients : Found client: OidcClient(super=IndirectClient(super=BaseClient(name=crescendo-jumpcloud, authorizationGenerators=[info.magnolia.sso.oidc.GroupsAuthorizationGenerator@46fad466], credentialsExtractor=org.pac4j.oidc.credentials.extractor.OidcCredentialsExtractor@59b630a9, authenticator=org.pac4j.oidc.credentials.authenticator.OidcAuthenticator@64d155f9, profileCreator=InitializableObject(initialized=true, initializing=false, maxAttempts=3, nbAttempts=1, lastAttempt=1785964200719, minTimeIntervalBetweenAttemptsInMilliseconds=5000), customProperties={}, profileFactoryWhenNotAuthenticated=null, multiProfile=false, saveProfileInSession=true, config=org.pac4j.core.config.Config@740a8052), callbackUrl=/.auth, urlResolver=org.pac4j.core.http.url.DefaultUrlResolver@6aabab10, callbackUrlResolver=org.pac4j.core.http.callback.NoParameterCallbackUrlResolver@738fd6ee, ajaxRequestResolver=org.pac4j.core.http.ajax.DefaultAjaxRequestResolver@6394bd8f, redirectionActionBuilder=InitializableObject(initialized=true, initializing=false, maxAttempts=3, nbAttempts=1, lastAttempt=1785964199453, minTimeIntervalBetweenAttemptsInMilliseconds=5000), logoutProcessor=org.pac4j.oidc.logout.processor.OidcLogoutProcessor@360bbc16, logoutActionBuilder=org.pac4j.oidc.logout.OidcLogoutActionBuilder@5e50f106, checkAuthenticationAttempt=true), configuration=OidcConfiguration(federation=org.pac4j.oidc.federation.config.OidcFederationProperties@6346751d, rpJwks=org.pac4j.core.config.properties.JwksProperties@436e6137, clientId=1e46d554-35ef-4cc0-a55b-84748c26df64, discoveryURI=https://oauth.id.jumpcloud.com/.well-known/openid-configuration, scope=openid profile email, customParams={}, clientAuthenticationMethod=client_secret_basic, supportedClientAuthenticationMethods=null, privateKeyJwtClientAuthnMethodConfig=null, clientSecretJwtClientAuthnMethodConfig=null, useNonce=false, useNonceOnRefresh=true, disablePkce=false, pkceMethod=null, idTokenSigningAlgorithm=RS256, requestObjectSigningAlgorithm=null, maxAge=null, maxClockSkew=30, resourceRetriever=org.pac4j.oidc.config.OidcConfiguration$OidcResourceRetriever@30c019a8, responseType=code, responseMode=null, logoutUrl=null, loginHint=null, connectTimeout=500, readTimeout=5000, withState=true, mappedClaims={}, stateGenerator=org.pac4j.core.util.generator.RandomValueGenerator@74aab161, codeVerifierGenerator=org.pac4j.core.util.generator.RandomValueGenerator@791f21bc, valueRetriever=org.pac4j.oidc.util.SessionStoreValueRetriever@29a14d1f, expireSessionWithToken=true, tokenExpirationAdvance=0, allowUnsignedIdTokens=false, includeAccessTokenClaimsInProfile=false, sslSocketFactory=null, callUserInfoEndpoint=true, hostnameVerifier=null, opMetadataResolver=InitializableObject(initialized=true, initializing=false, maxAttempts=3, nbAttempts=1, lastAttempt=1785964199141, minTimeIntervalBetweenAttemptsInMilliseconds=5000), logoutValidation=true, pushedAuthorizationRequest=false)) for name: crescendo-jumpcloud
2026-08-05 22:13:21,599 DEBUG c4j.core.client.finder.DefaultSecurityClientFinder: result: [crescendo-jumpcloud]
2026-08-05 22:13:21,599 DEBUG org.pac4j.core.engine.DefaultSecurityLogic : currentClients: [OidcClient(super=IndirectClient(super=BaseClient(name=crescendo-jumpcloud, authorizationGenerators=[info.magnolia.sso.oidc.GroupsAuthorizationGenerator@46fad466], credentialsExtractor=org.pac4j.oidc.credentials.extractor.OidcCredentialsExtractor@59b630a9, authenticator=org.pac4j.oidc.credentials.authenticator.OidcAuthenticator@64d155f9, profileCreator=InitializableObject(initialized=true, initializing=false, maxAttempts=3, nbAttempts=1, lastAttempt=1785964200719, minTimeIntervalBetweenAttemptsInMilliseconds=5000), customProperties={}, profileFactoryWhenNotAuthenticated=null, multiProfile=false, saveProfileInSession=true, config=org.pac4j.core.config.Config@740a8052), callbackUrl=/.auth, urlResolver=org.pac4j.core.http.url.DefaultUrlResolver@6aabab10, callbackUrlResolver=org.pac4j.core.http.callback.NoParameterCallbackUrlResolver@738fd6ee, ajaxRequestResolver=org.pac4j.core.http.ajax.DefaultAjaxRequestResolver@6394bd8f, redirectionActionBuilder=InitializableObject(initialized=true, initializing=false, maxAttempts=3, nbAttempts=1, lastAttempt=1785964199453, minTimeIntervalBetweenAttemptsInMilliseconds=5000), logoutProcessor=org.pac4j.oidc.logout.processor.OidcLogoutProcessor@360bbc16, logoutActionBuilder=org.pac4j.oidc.logout.OidcLogoutActionBuilder@5e50f106, checkAuthenticationAttempt=true), configuration=OidcConfiguration(federation=org.pac4j.oidc.federation.config.OidcFederationProperties@6346751d, rpJwks=org.pac4j.core.config.properties.JwksProperties@436e6137, clientId=1e46d554-35ef-4cc0-a55b-84748c26df64, discoveryURI=https://oauth.id.jumpcloud.com/.well-known/openid-configuration, scope=openid profile email, customParams={}, clientAuthenticationMethod=client_secret_basic, supportedClientAuthenticationMethods=null, privateKeyJwtClientAuthnMethodConfig=null, clientSecretJwtClientAuthnMethodConfig=null, useNonce=false, useNonceOnRefresh=true, disablePkce=false, pkceMethod=null, idTokenSigningAlgorithm=RS256, requestObjectSigningAlgorithm=null, maxAge=null, maxClockSkew=30, resourceRetriever=org.pac4j.oidc.config.OidcConfiguration$OidcResourceRetriever@30c019a8, responseType=code, responseMode=null, logoutUrl=null, loginHint=null, connectTimeout=500, readTimeout=5000, withState=true, mappedClaims={}, stateGenerator=org.pac4j.core.util.generator.RandomValueGenerator@74aab161, codeVerifierGenerator=org.pac4j.core.util.generator.RandomValueGenerator@791f21bc, valueRetriever=org.pac4j.oidc.util.SessionStoreValueRetriever@29a14d1f, expireSessionWithToken=true, tokenExpirationAdvance=0, allowUnsignedIdTokens=false, includeAccessTokenClaimsInProfile=false, sslSocketFactory=null, callUserInfoEndpoint=true, hostnameVerifier=null, opMetadataResolver=InitializableObject(initialized=true, initializing=false, maxAttempts=3, nbAttempts=1, lastAttempt=1785964199141, minTimeIntervalBetweenAttemptsInMilliseconds=5000), logoutValidation=true, pushedAuthorizationRequest=false))]
2026-08-05 22:13:21,599 DEBUG pac4j.core.matching.checker.DefaultMatchingChecker: Checking matcher: info.magnolia.sso.pac4j.AnyMatcher@38e4a940 -> true
2026-08-05 22:13:21,602 DEBUG org.pac4j.jee.context.session.JEESessionStore : createSession: false, retrieved session: org.apache.catalina.session.StandardSessionFacade@2084ce59
2026-08-05 22:13:21,602 DEBUG org.pac4j.jee.context.session.JEESessionStore : Get value: null for key: pac4jUserProfiles
2026-08-05 22:13:21,602 DEBUG org.pac4j.core.engine.DefaultSecurityLogic : Loaded profiles (from session: true): []
2026-08-05 22:13:21,602 DEBUG org.pac4j.core.engine.DefaultSecurityLogic : Starting authentication
2026-08-05 22:13:21,602 DEBUG ore.engine.savedrequest.DefaultSavedRequestHandler: requestedUrl: https://magnolia-mcp.ngrok.io/.rest/mcp/v1
2026-08-05 22:13:21,602 DEBUG org.pac4j.jee.context.session.JEESessionStore : createSession: true, retrieved session: org.apache.catalina.session.StandardSessionFacade@2084ce59
2026-08-05 22:13:21,602 DEBUG org.pac4j.jee.context.session.JEESessionStore : Set key: pac4jRequestedUrl for value: https://magnolia-mcp.ngrok.io/.rest/mcp/v1
2026-08-05 22:13:21,602 DEBUG org.pac4j.jee.context.session.JEESessionStore : createSession: false, retrieved session: org.apache.catalina.session.StandardSessionFacade@2084ce59
2026-08-05 22:13:21,602 DEBUG org.pac4j.jee.context.session.JEESessionStore : Get value: null for key: crescendo-jumpcloud$attemptedAuthentication
2026-08-05 22:13:21,603 DEBUG org.pac4j.jee.context.session.JEESessionStore : createSession: true, retrieved session: org.apache.catalina.session.StandardSessionFacade@2084ce59
2026-08-05 22:13:21,603 DEBUG org.pac4j.jee.context.session.JEESessionStore : Set key: crescendo-jumpcloud$stateSessionParameter for value: 9c3117925b
2026-08-05 22:13:21,603 DEBUG org.pac4j.core.resource.SpringResourceLoader : elapsed: 18219 / checkInterval: 60000 -> shouldCheck: false
2026-08-05 22:13:21,603 DEBUG org.pac4j.jee.context.session.JEESessionStore : createSession: true, retrieved session: org.apache.catalina.session.StandardSessionFacade@2084ce59
2026-08-05 22:13:21,603 DEBUG org.pac4j.jee.context.session.JEESessionStore : Set key: crescendo-jumpcloud$codeVerifierSessionParameter for value: com.nimbusds.oauth2.sdk.pkce.CodeVerifier@28ea2f2a
2026-08-05 22:13:21,603 DEBUG g.pac4j.oidc.redirect.OidcRedirectionActionBuilder: Authz parameter names: [scope, response_type, redirect_uri, state, code_challenge_method, client_id, code_challenge, response_mode]
2026-08-05 22:13:21,604 DEBUG org.pac4j.core.resource.SpringResourceLoader : elapsed: 18220 / checkInterval: 60000 -> shouldCheck: false
2026-08-05 22:13:21,604 DEBUG g.pac4j.oidc.redirect.OidcRedirectionActionBuilder: Authentication request URL: https://oauth.id.jumpcloud.com/oauth2/auth?scope=openid%20profile%20email&response_type=code&redirect_uri=https%3A%2F%2Fmagnolia-mcp.ngrok.io%2F.auth&state=9c3117925b&code_challenge_method=S256&client_id=1e46d554-35ef-4cc0-a55b-84748c26df64&code_challenge=Q-8ruKznQa4uvw_-euyYbu2h-ZbvB7gs6k65FBWBzPc
```

### Additional context

_No response_