mirror of
https://github.com/langgenius/dify.git
synced 2026-05-30 13:47:52 +08:00
d3fa24d7e3
When an MCP provider has forward_user_identity enabled, MCPTool now asks
dify-enterprise to mint a short-lived per-user SSO id_token (via the M1
/inner/api/mcp/issue-token endpoint) and stamps it as the Authorization
Bearer on every outbound MCP request — so an MCP server can act on behalf
of the verified end user instead of seeing only "Dify is calling."
- Adds forward_user_identity (bool) + identity_mode ("off" | "idp_token")
to tool_mcp_providers, plumbed through MCPProviderEntity, the controller,
service-layer CRUD, and the tool/provider runtime.
- EnterpriseService.issue_mcp_token wraps the enterprise endpoint and maps
428 → MCPNoRefreshTokenError, 401 → MCPIdentityRefreshError so workflows
halt with a clear "please re-authenticate" instead of silently going
anonymous.
- Identity_mode is intentionally an enum-shaped string column so future
modes (e.g. RFC 8693 token exchange) land without UI/DB churn.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>