MCP Obo

代表拥有Entra ID和FastMCP的流程

博客文章：https://baeke.info/2025/07/29/end-to-end-authorization-with-entra-id-and-mcp/

说明

1.创建并激活Python虚拟环境

python3 -m venv .venv
source .venv/bin/activate

2.安装依赖项

pip install -r requirements.txt

3.设置环境变量

创建一个 .env 项目根目录中具有所需Azure和API凭据的文件（有关所需变量，请参阅示例文件）。

4.启动MCP服务器

python -m mcp.main

5.运行MCP客户端

在新终端中（虚拟环境已激活）：

python mcp_client.py

图表

sequenceDiagram
    autonumber
    participant User
    participant Client
    participant AzureAD as "Azure Entra ID"
    participant MCP
    participant MSGraph

    User->>Client: Initiate Device Flow
    Client->>AzureAD: Start Device Code Flow
    AzureAD-->>Client: Device Code + Verification URL
    Client->>User: Show Code + URL

    User->>AzureAD: Authenticates via browser
    AzureAD-->>Client: Returns Access Token (for MCP)

    Client->>MCP: Call tool with Bearer Access Token
    MCP->>AzureAD: OBO request for token to call MS Graph\n(include access token as assertion)
    AzureAD-->>MCP: Returns new Access Token (for MS Graph)

    MCP->>MSGraph: Call Graph API with new token
    MSGraph-->>MCP: Graph data
    MCP-->>Client: Return tool result