Securing Model Context Protocol with Keycloak: AuthN/AuthZ for MCP Servers

Editor's Notes

• #1: Hello, everyone. I'm Tatsuya kurosaka from Hitachi. Thank you for joining us today. This demonstration session's topic is Securing Model Context Protocol with Keycloak: Authentication and Authorization for MCP Servers. Let’s get started.
• #2: These are contents.  First, I'll talk about what is Model Context Protocol. Next, what is about Authentication and Authorization in MCP. And at last, I'll show you the demonstration video.
• #3: So, first is about Model Context Protocol.
• #4: These days, AI agent can perform a variety of tasks like getting data from some database, or accessing their Filesystem, or using external API. But AI agents had to use different ways to access different kind of resources and tools, like SQL for Database, CLI for Filesystem, REST for API. This is so inconvenient for AI agents.
• #5: That's why MCP appeared. That's stands for Model Context Protocol. These servers are called “MCP server”. And each MCP server communicates with each resource or tool, and AI agent who is gonna be a MCP Client communicates with each MCP server with common protocol "MCP". So, AI agents only have to use one common protocol. It means MCP makes AI Agents easy to connect different kind of resources and tools with standardized protocol. This is about Model Context Protocol.
• #6: Next, what is about Authentication and Authorization in MCP
• #7: This is an outline of Authorization Code grant with Third-Party Authorization Server. And this flow is based on MCP's authorization specification, the latest version’s link is here, and the specification requires OAuth 2.1. So, Let's check the diagram. First, the User queries something like "What is the balance in my bank account?“ to AI Agent. Then AI Agent tries to request running MCP server’s tool "get_balance" which can get balance from user’s private bank. But he can not use this tool because he is not authorized by Authorization Server. So, for an AI agent to be authorized, first, the authorization Server needs to authenticate the user and also get a consent for what the MCP server will do. In this case, the user has to consent that the MCP server accessing their private resource that is “User’s bank” in this case. Then, authentication and consent is complete, the AI Agent is authorized and obtain Access Token. Finally, he can request running the MCP server’s tool with the Access Token. This is about Authentication and Authorization in MCP with third-party Authorization Server.
• #8: Next, I’ll explain about demonstration.
• #9: This is the overview of demonstration. We use Keycloak as Auth server. The MCP server provides the simple calculation tools, add and multiply. But this add tool intentionally returns wrong number, 1 larger number. Because LLM can perform simple task like adding number like this without any tools, so this modification tells us whether the AI agent has used this tool or not. Now Let's look at the flow. First, the user queries the addition. The AI agent fetches tool information from connected MCP servers. And asks LLM how to use the tools. Then AI agent requests running MCP server’s tool but if he is not authorized, user authentication and consent are required. After authentication and consent are completed, AI agent can request running MCP server’s tool. And then AI Agent asks LLM to generate final answer with tool results. Then responses the answer. This is the overview of the demonstrations.
• #10: This is details of Authentication and Authorization flow from 4.1 to 4.3 on the previous page. This flow is based on OAuth 2.1 flow for the authorization code grant. And I will explain this flow by watching a demonstration video later. So, let’s check the demonstration video.
• #11: So, let's check the extracts from MCP client logs. This is an initial POST to LLM. Which is here. And the response contains how to use tool.
• #12: Next, this is a access token provided by keycloak. Access token is here. We can see scopes include “add” this means this access token is provided for using add tool. Next, this is token introspection result. Token introspection is here. We can see the token introspection succeeded.
• #13: This is the final POST to LLM which is here. And we can see the final response doesn't contain ToolUseBlock. Just contains only TextBlock. That contains part of final answer texts. So, we have checked some evidence for the authentication and authorization flow is completed. OK, that is all of my content.