mcp -dotnet-entra-id

This MCP server acts as an OAuth 2.1 proxy that sits between MCP clients (such as Claude AI and ChatGPT) and Microsoft Entra ID (Azure Active Directory). It provides a secure authentication flow, maps Entra ID tokens to MCP-compatible tokens, and exposes MCP endpoints that require valid Bearer tokens. The included WhoAmI tool demonstrates how authenticated user claims (name, email, OID, UPN) can be accessed by MCP tools to personalize interactions. To use it, configure your Entra ID app registration to allow the proxy to issue tokens with the desired scopes and audience, then run the container to start the OAuth proxy. Clients will redirect through the custom login experience, obtain a token, and call MCP endpoints with the appropriate Authorization header.

Prerequisites:

• Docker installed and running
• Optional: if you prefer running from source, .NET 8 SDK and a compatible IIS/Kestrel hosting setup

Option A — Deploy with Docker (recommended):

1. Build or pull the Docker image for the MCP proxy that bridges Entra ID authentication:
   • docker pull profility-be-mcp-server-dotnet-entra-id
2. Run the container with required environment variables (adjust values to your environment):
   • docker run -d --name profility-mcp --env AZURE_AD_TENANT_ID=YOUR_TENANT_ID --env AZURE_AD_CLIENT_ID=YOUR_CLIENT_ID --env AZURE_AD_CLIENT_SECRET=YOUR_CLIENT_SECRET --env MCP_SERVER_URL=https://YOUR-DOMAIN -p 443:443 profility-be-mcp-server-dotnet-entra-id

Option B — Run from source (.NET 8):

1. Ensure .NET 8 SDK is installed.
2. Clone the repository:
   • git clone <your-repo-url>
   • cd MCP
3. Build and run locally (adjust paths as needed):
   • dotnet build
   • dotnet run --project path/to/YourMcpProject
4. Configure environment variables for Azure AD in appsettings.json or environment before starting.

Prerequisites recap:

• Docker or .NET 8 SDK installed
• Azure Entra ID tenant and an app registration with appropriate permissions
• Networking accessible for OAuth redirects and token endpoints

Tips and common issues:

• Ensure your Entra ID app registration exposes the API scope used by the MCP proxy (e.g., MCP.Access) and that Redirect URIs match your deployment domain.
• The proxy uses RFC 7591 Dynamic Client Registration compatibility; if you encounter registration issues, verify app permissions and consent.
• When deploying behind a reverse proxy or TLS terminator, ensure HTTPS termination and correct forwarding headers for auth callbacks.
• If tokens fail validation, re-check signing and encryption keys and update Jwt.SigningKey and Jwt.EncryptionKey accordingly.
• Environment variables can be stored in a .env file or set directly in your container/orchestrator. Ensure sensitive values are protected.
• For development, you can test with a dev tunnel or localhost callback URLs, but remember to update Azure AD redirect URIs for production domains.