Remove mcp-gateway/OPENUI_OAUTH_FIX.md
This commit is contained in:
parent
50fd6dc3c9
commit
fd78e7b17b
1 changed files with 0 additions and 218 deletions
|
|
@ -1,218 +0,0 @@
|
||||||
# OpenUI OAuth "Client not registered" Fix
|
|
||||||
|
|
||||||
## Problem
|
|
||||||
|
|
||||||
When connecting MCP Gateway to Open-UI, you get:
|
|
||||||
```
|
|
||||||
{"error":"invalid_client","error_description":"Client not registered."}
|
|
||||||
```
|
|
||||||
|
|
||||||
Even though it works fine in Claude.ai.
|
|
||||||
|
|
||||||
## Root Cause
|
|
||||||
|
|
||||||
Your gateway uses **in-memory OAuth client registration** (`REGISTERED_CLIENTS` dict). This means:
|
|
||||||
|
|
||||||
1. Each client (Claude.ai, Open-UI, etc.) registers itself via `/oauth/register`
|
|
||||||
2. The registration is stored in RAM only
|
|
||||||
3. When the gateway restarts → all registrations are lost
|
|
||||||
4. Open-UI's client ID is no longer recognized during token exchange
|
|
||||||
|
|
||||||
Additionally, there are **two separate OAuth flows** happening:
|
|
||||||
- Claude.ai uses one client ID
|
|
||||||
- Open-UI registers and gets a different client ID
|
|
||||||
- If the gateway restarts between registration and first use, Open-UI's ID is gone
|
|
||||||
|
|
||||||
## Solution Options
|
|
||||||
|
|
||||||
### Option A: Persistent OAuth Client Storage (Recommended)
|
|
||||||
Store OAuth clients in a file or database instead of RAM.
|
|
||||||
|
|
||||||
**File**: `gateway-proxy/oauth_storage.py` (to be created)
|
|
||||||
|
|
||||||
```python
|
|
||||||
import json
|
|
||||||
import os
|
|
||||||
from typing import dict
|
|
||||||
|
|
||||||
OAUTH_STORAGE_FILE = os.environ.get("OAUTH_STORAGE_FILE", "/data/oauth_clients.json")
|
|
||||||
|
|
||||||
def load_oauth_clients() -> dict:
|
|
||||||
"""Load OAuth clients from persistent storage"""
|
|
||||||
if os.path.exists(OAUTH_STORAGE_FILE):
|
|
||||||
try:
|
|
||||||
with open(OAUTH_STORAGE_FILE, 'r') as f:
|
|
||||||
return json.load(f)
|
|
||||||
except Exception as e:
|
|
||||||
logger.error(f"Failed to load OAuth clients: {e}")
|
|
||||||
return {}
|
|
||||||
return {}
|
|
||||||
|
|
||||||
def save_oauth_clients(clients: dict) -> None:
|
|
||||||
"""Save OAuth clients to persistent storage"""
|
|
||||||
try:
|
|
||||||
os.makedirs(os.path.dirname(OAUTH_STORAGE_FILE), exist_ok=True)
|
|
||||||
with open(OAUTH_STORAGE_FILE, 'w') as f:
|
|
||||||
json.dump(clients, f, indent=2)
|
|
||||||
except Exception as e:
|
|
||||||
logger.error(f"Failed to save OAuth clients: {e}")
|
|
||||||
|
|
||||||
def register_client(client_info: dict) -> None:
|
|
||||||
"""Register a new OAuth client"""
|
|
||||||
clients = load_oauth_clients()
|
|
||||||
client_id = client_info["client_id"]
|
|
||||||
clients[client_id] = client_info
|
|
||||||
save_oauth_clients(clients)
|
|
||||||
```
|
|
||||||
|
|
||||||
**Changes to gateway_proxy.py:**
|
|
||||||
```python
|
|
||||||
# At startup, replace:
|
|
||||||
# REGISTERED_CLIENTS: dict[str, dict] = {}
|
|
||||||
# with:
|
|
||||||
from .oauth_storage import load_oauth_clients, save_oauth_clients
|
|
||||||
REGISTERED_CLIENTS = load_oauth_clients()
|
|
||||||
|
|
||||||
# In oauth_register function, after adding client:
|
|
||||||
REGISTERED_CLIENTS[client_id] = client_info
|
|
||||||
save_oauth_clients(REGISTERED_CLIENTS) # Add this line
|
|
||||||
```
|
|
||||||
|
|
||||||
**docker-compose.yml update:**
|
|
||||||
```yaml
|
|
||||||
gateway-proxy:
|
|
||||||
volumes:
|
|
||||||
- gateway-data:/data # Persist OAuth clients
|
|
||||||
```
|
|
||||||
|
|
||||||
### Option B: Pre-register Known Clients (Quick Fix)
|
|
||||||
Hardcode known clients (Claude.ai, Open-UI) so they don't need dynamic registration.
|
|
||||||
|
|
||||||
**In .env:**
|
|
||||||
```bash
|
|
||||||
# Pre-registered OAuth clients (JSON format)
|
|
||||||
OAUTH_CLIENTS='{"claude-app":{"client_id":"claude-app","client_secret":"YOUR_SECRET","client_name":"Claude.ai"},"openui":{"client_id":"openui","client_secret":"YOUR_SECRET","client_name":"Open-UI"}}'
|
|
||||||
```
|
|
||||||
|
|
||||||
**In gateway_proxy.py:**
|
|
||||||
```python
|
|
||||||
import json
|
|
||||||
|
|
||||||
def load_oauth_clients() -> dict:
|
|
||||||
"""Load pre-registered clients from env"""
|
|
||||||
clients_json = os.environ.get("OAUTH_CLIENTS", "{}")
|
|
||||||
try:
|
|
||||||
return json.loads(clients_json)
|
|
||||||
except:
|
|
||||||
return {}
|
|
||||||
|
|
||||||
REGISTERED_CLIENTS = load_oauth_clients()
|
|
||||||
```
|
|
||||||
|
|
||||||
### Option C: Disable Client Validation (Development Only)
|
|
||||||
For testing, skip client ID validation in token endpoint:
|
|
||||||
|
|
||||||
**In oauth_token function, around line 520:**
|
|
||||||
```python
|
|
||||||
# Change this check:
|
|
||||||
client_info = REGISTERED_CLIENTS.get(client_id)
|
|
||||||
if not client_info:
|
|
||||||
return JSONResponse({"error": "invalid_client"}, status_code=400)
|
|
||||||
|
|
||||||
# To this (development only):
|
|
||||||
client_info = REGISTERED_CLIENTS.get(client_id)
|
|
||||||
if not client_info:
|
|
||||||
logger.warning(f"Client {client_id} not registered, allowing anyway (DEV MODE)")
|
|
||||||
# Allow unregistered clients for testing
|
|
||||||
```
|
|
||||||
|
|
||||||
## Recommended Implementation
|
|
||||||
|
|
||||||
**Use Option A** (persistent storage) because:
|
|
||||||
- ✅ Works across gateway restarts
|
|
||||||
- ✅ Supports multiple clients (Claude.ai, Open-UI, others)
|
|
||||||
- ✅ Secure (OAuth flow still requires proper credentials)
|
|
||||||
- ✅ Production-ready
|
|
||||||
- ✅ No hardcoded secrets
|
|
||||||
|
|
||||||
## Implementation Steps
|
|
||||||
|
|
||||||
### Step 1: Create oauth_storage.py
|
|
||||||
Save to `gateway-proxy/oauth_storage.py` (content provided above)
|
|
||||||
|
|
||||||
### Step 2: Update gateway_proxy.py
|
|
||||||
|
|
||||||
Around line 27 (imports), add:
|
|
||||||
```python
|
|
||||||
from .oauth_storage import load_oauth_clients, save_oauth_clients
|
|
||||||
```
|
|
||||||
|
|
||||||
Around line 52, replace:
|
|
||||||
```python
|
|
||||||
# REGISTERED_CLIENTS: dict[str, dict] = {}
|
|
||||||
REGISTERED_CLIENTS = load_oauth_clients()
|
|
||||||
```
|
|
||||||
|
|
||||||
In `oauth_register()` function, after line 383:
|
|
||||||
```python
|
|
||||||
REGISTERED_CLIENTS[client_id] = client_info
|
|
||||||
save_oauth_clients(REGISTERED_CLIENTS) # ADD THIS LINE
|
|
||||||
```
|
|
||||||
|
|
||||||
### Step 3: Update docker-compose.yml
|
|
||||||
|
|
||||||
Add volume to gateway-proxy service:
|
|
||||||
```yaml
|
|
||||||
gateway-proxy:
|
|
||||||
volumes:
|
|
||||||
- gateway-data:/data
|
|
||||||
|
|
||||||
volumes:
|
|
||||||
gateway-data:
|
|
||||||
```
|
|
||||||
|
|
||||||
### Step 4: Set environment variable (optional)
|
|
||||||
In `.env`:
|
|
||||||
```bash
|
|
||||||
OAUTH_STORAGE_FILE=/data/oauth_clients.json
|
|
||||||
```
|
|
||||||
|
|
||||||
### Step 5: Restart
|
|
||||||
```bash
|
|
||||||
docker-compose down
|
|
||||||
docker-compose up -d
|
|
||||||
```
|
|
||||||
|
|
||||||
## Testing
|
|
||||||
|
|
||||||
1. Register with Open-UI (should succeed)
|
|
||||||
2. Restart gateway: `docker-compose restart gateway-proxy`
|
|
||||||
3. Try to use Open-UI again (should work - client is persisted)
|
|
||||||
4. Check `/data/oauth_clients.json` file exists with registration
|
|
||||||
|
|
||||||
## Debugging
|
|
||||||
|
|
||||||
Check if clients are saved:
|
|
||||||
```bash
|
|
||||||
docker exec mcp-gateway cat /data/oauth_clients.json | jq '.'
|
|
||||||
```
|
|
||||||
|
|
||||||
Check gateway logs for registration:
|
|
||||||
```bash
|
|
||||||
docker logs mcp-gateway | grep "DCR:"
|
|
||||||
```
|
|
||||||
|
|
||||||
If you still get "Client not registered":
|
|
||||||
1. Verify oauth_storage.py is in gateway-proxy/
|
|
||||||
2. Check that save_oauth_clients() is being called
|
|
||||||
3. Check file permissions on /data/ volume
|
|
||||||
4. Check docker logs for save errors
|
|
||||||
|
|
||||||
## Alternative: Use Redis or Database
|
|
||||||
|
|
||||||
For production with multiple gateway instances, consider storing OAuth clients in:
|
|
||||||
- Redis (fast, distributed)
|
|
||||||
- PostgreSQL (persistent, queryable)
|
|
||||||
- MongoDB (flexible schema)
|
|
||||||
|
|
||||||
This ensures clients are available across all instances.
|
|
||||||
Loading…
Reference in a new issue