Support for OAuth 2.0 Dynamic Client Registration Protocol (RFC 7591) for OpenAI ChatGPT Connectors

[thomasgallagher]

Firstly, thank you. I’ve been a long standing DoorKeeper user and you’ve done a fantastic job with it, so I wanted to acknowledge the work you’ve put in.

I’ve recently been building a custom MCP server with ChatGPT as a connector, and it appears that for everything to function correctly, the OAuth server needs to support this protocol.

The following proof of concept appears to work with the ChatGPT connector flow (https://platform.openai.com/docs/mcp), but it’s not production ready and hasn’t been reviewed for security. I thought I’d share it in case it’s useful to this discussion.

Many thanks,
Tom

# app/controllers/oauth/client_registrations_controller.rb
class Oauth::ClientRegistrationsController < ApplicationController
  skip_before_action :verify_authenticity_token

  def create
    unless registration_params[:redirect_uris].is_a?(Array) && registration_params[:redirect_uris].any?
      return render json: { error: "invalid_redirect_uri" }, status: :unprocessable_entity
    end

    scopes = extract_scopes
    if scopes.empty?
      scopes = "public"
    end

    app = Doorkeeper::Application.create!(
      name: registration_params[:client_name] || "Dynamic client",
      redirect_uri: registration_params[:redirect_uris].join("\n"),
      scopes: scopes,
      confidential: false # OpenAI connectors currently don't support confidential clients and does not use the client secret
    )

    render json: client_metadata(app), status: :created
  end

  private

  def registration_params
    params.permit(
      :client_name,
      :token_endpoint_auth_method,
      grant_types: [],
      redirect_uris: [],
      scope: []
    )
  end

  def extract_scopes
    return "" unless registration_params[:scope]
    scopes = registration_params[:scope].join(" ")
    scopes
  end

  def client_metadata(app)
    {
      client_id: app.uid,
      client_secret: app.secret,
      client_id_issued_at: Time.now.to_i,
      client_secret_expires_at: 0, # 0 means "never" in RFC 7591
      redirect_uris: app.redirect_uri.split("\n"),
      grant_types: registration_params[:grant_types] || [ "authorization_code" ],
      token_endpoint_auth_method: registration_params[:token_endpoint_auth_method] || "client_secret_basic"
    }
  end
end

# app/controllers/application_controller.rb
def oauth_metadata
  base_url = "#{request.protocol}#{request.host_with_port}"

  metadata = {
    issuer: base_url,
    authorization_endpoint: "#{base_url}/oauth/authorize",
    token_endpoint: "#{base_url}/oauth/token",
    registration_endpoint: "#{base_url}/oauth/register",
    scopes_supported: [ "public" ],
    response_types_supported: [ "code" ],
    response_modes_supported: [ "query" ],
    grant_types_supported: [ "authorization_code", "client_credentials", "refresh_token" ],
    token_endpoint_auth_methods_supported: [
      "client_secret_basic",
      "client_secret_post",
      "none"
    ],
    revocation_endpoint: "#{base_url}/oauth/revoke",
    code_challenge_methods_supported: [ "plain", "S256" ]
  }

  render json: metadata
end

# config/routes.rb
get "/.well-known/oauth-authorization-server", to: "application#oauth_metadata"