Fixed
- (deps) Update module github.com/giantswarm/mcp-oauth to v0.9.0 in #344 by @renovate[bot]
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.216...v0.0.217
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.216...v0.0.217
Full Changelog: https://github.com/giantswarm/agentic-platform/compare/v1.4.0...v1.4.1
Full Changelog: https://github.com/giantswarm/klausctl/compare/v0.2.8...v0.2.9
id_token (was access_token). The exchanged token is forwarded as the downstream bearer and must serve as the user’s OIDC identity; Dex’s default access token is opaque, so mcp-kubernetes (strict --downstream-oauth) could not use it for Kubernetes OIDC and denied tool calls with authentication required: please log in to access this resource, even though the connection reported Connected [SSO: Exchanged]. Requesting an id_token yields a JWT whose aud carries the configured requiredAudiences, so mcp-oauth accepts it via the forwarded-ID-token (SSO) path — mirroring the token-forwarding behaviour. mcp-prometheus and other identity-only downstreams were unaffected and keep working.server.TrustedIssuer.SubjectClaim sources the canonical subject from a configurable claim, wired through oauth.server.trustedIssuers[].subjectClaim.Full Changelog: https://github.com/giantswarm/agentic-platform/compare/v1.3.4...v1.4.0
Full Changelog: https://github.com/giantswarm/agentic-platform/compare/v1.3.3...v1.3.4
Full Changelog: https://github.com/giantswarm/agentic-platform/compare/v1.3.2...v1.3.3
Full Changelog: https://github.com/giantswarm/muster/compare/v0.7.2...v0.7.3
Full Changelog: https://github.com/giantswarm/agentic-platform/compare/v1.3.1...v1.3.2