Enhance JWT authentication for MCP server compatibility

[michaellwest]

Summary

While building the SPE MCP Server, we identified several areas where SPE's SharedSecretAuthenticationProvider could be enhanced to improve interoperability and security for automated clients.

Current Behavior

The SharedSecretAuthenticationProvider in Spe.Core.Settings.Authorization performs manual JWT validation:

• Decodes Base64Url header/payload manually
• Validates alg is HS256
• Validates iss against AllowedIssuers list (default: "SPE Remoting", "Web API")
• Validates aud against request authority or AllowedAudiences
• Verifies HMAC-SHA256 signature using shared secret
• Extracts name claim for Sitecore user context

Recommendations

1. Support standard JWT libraries (HS256 + HS512)

Currently only HS256 is supported. Standard JWT libraries (e.g., System.IdentityModel.Tokens.Jwt) default to HS512 for HMAC signing. Supporting both would make it easier for third-party clients to integrate without implementing manual JWT construction.

2. Improve error diagnostics

When authentication fails, the current implementation returns a generic 401 with no indication of why it failed (wrong algorithm? invalid issuer? expired token? bad signature?). Adding a debug/verbose logging mode would significantly reduce integration debugging time.

3. Add iat (issued-at) and nbf (not-before) claim validation

Standard JWT security practice includes validating iat and nbf claims to prevent token replay. Currently only exp is checked.

4. Consider configurable token lifetime validation

The MCP server uses 30-second token lifetimes for security. SPE could optionally enforce a maximum token lifetime (e.g., reject tokens with exp more than 5 minutes in the future).

5. Support scope claim for fine-grained authorization

A scope claim (e.g., read-only, content-edit, admin) would allow SPE to enforce authorization at the remoting layer. This would complement the MCP server's client-side sandboxing with server-side enforcement. This could map to SPE's existing security roles.

Context

These recommendations emerged from building the MCP server and testing against SPE's remoting API. The MCP server currently works around these limitations by implementing manual HS256 JWT construction that precisely matches SPE's validation logic. See: https://github.com/SitecorePowerShell/mcp-server/blob/main/src/SpeMcpServer/Client/AuthHandler.cs