Refine authentication/authorization langugage#8
Refine authentication/authorization langugage#8PieterKas wants to merge 1 commit intomodelcontextprotocol:dmcadams-wif-extenstionfrom
Conversation
Refine language for clarity and consistency in the Workload Identity Federation document, including updates to terminology and structure.
| functions as a workload within a workload platform (such as Kubernetes or cloud | ||
| provider environments). Like the Client Credentials extension, this pattern | ||
| addresses machine-to-machine authentication use cases. | ||
| operates as an autonomous workload without any user interaction. In these |
There was a problem hiding this comment.
The original text aimed to avoid pedantic arguments about whether a workload is truly "autonomous without any user interaction" when the use case is a microservice deep in a call stack that is originally triggered by user interaction. In my prior experience, this was the most common situation we heard from customers and the intention was that readers not mistakenly think this spec was inapplicable for them. Hence, language anchored on how the workload authenticates and authorizes itself, rather than getting into nuances of autonomy. The original text could definitely be tightened up, though. Any thoughts on balancing these considerations?
There was a problem hiding this comment.
That is a very good point - the original text may suffice. But perhaps that needs to be made more explicit so that readers have clear guidance that this applies to any workload that may be in a call chain, including when the call chain was initiated by a user? How about something like this:
| operates as an autonomous workload without any user interaction. In these | |
| Workload Identity Federation enables MCP clients to authenticate and authorize using their own workload identity, without relying on interactive end-user OAuth flows. This model applies whether the workload is fully autonomous or acting within a user-initiated request path, as long as the client performs non-interactive authentication. MCP clients are typically deployed within workload platforms such as Kubernetes, virtual machines, or cloud provider environments. |
2 participants
Refine language for clarity and consistency in the Workload Identity Federation document, including updates to terminology and structure.
Motivation and Context
How Has This Been Tested?
Breaking Changes
Types of changes
Checklist
Additional context