[GH-ISSUE #19] how does a user of openwebui pass their authentication credentials to an MCP #14

New issue

Closed

opened 2026-10-18 21:10:16 +00:00 by bsakaguchi · 3 comments

bsakaguchi commented

2026-10-18 21:10:16 +00:00

Owner

Originally created by @lattwood on GitHub (Apr 2, 2025).
Original GitHub issue: https://github.com/open-webui/mcpo/issues/19

hey,

one of the things touted in the document is enhanced security.

MCP has folks actively working on improving the (horrible) state of authentication relating to MCPs: https://github.com/modelcontextprotocol/specification/issues/205

for example, to have a "tool server" (so i'm not saying MCP) create an issue on JIRA would require the tool server to somehow assume the user's identity for correct attribution.

and then you have the issue of read authorization- like, some folks will have access to different things on JIRA than others, and you don't want to expose everything to everyone.

but as it currently stands, MCP has an authorization workflow documented, which they're actively reworking-

what's the plan for solving the delegated authentication issue?

Originally created by @lattwood on GitHub (Apr 2, 2025). Original GitHub issue: https://github.com/open-webui/mcpo/issues/19 hey, one of the things touted in the document is enhanced security. MCP has folks actively working on improving the (horrible) state of authentication relating to MCPs: https://github.com/modelcontextprotocol/specification/issues/205 for example, to have a "tool server" (so i'm not saying MCP) create an issue on JIRA would require the tool server to somehow assume the user's identity for correct attribution. and then you have the issue of read authorization- like, some folks will have access to different things on JIRA than others, and you don't want to expose everything to everyone. but as it currently stands, MCP has an authorization workflow documented, which they're actively reworking- what's the plan for solving the delegated authentication issue?

bsakaguchi closed this issue

2026-10-18 21:10:16 +00:00

bsakaguchi commented

2026-10-18 21:10:16 +00:00

Author

Owner

@tjbck commented on GitHub (Apr 2, 2025):

Any http auth protocol will be supported and should be supported. No need to reinvent the wheel: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Authentication

@tjbck commented on GitHub (Apr 2, 2025): #4 Any http auth protocol will be supported and should be supported. No need to reinvent the wheel: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Authentication

bsakaguchi commented

2026-10-18 21:10:17 +00:00

Author

Owner

@muliyul commented on GitHub (Apr 8, 2025):

@tjbck I don't understand your answer. Do we wait for the spec to be finalized?

@muliyul commented on GitHub (Apr 8, 2025): @tjbck I don't understand your answer. Do we wait for the spec to be finalized?

bsakaguchi commented

2026-10-18 21:10:17 +00:00

Author

Owner

@tjbck commented on GitHub (Apr 8, 2025):

I don't understand your question, no need to "wait" for anything. mcpo also already supports bearer token auth method, which is widely supported and is the industry standard for all api servers.

@tjbck commented on GitHub (Apr 8, 2025): I don't understand your question, no need to "wait" for anything. mcpo also already supports bearer token auth method, which is widely supported and is the industry standard for all api servers.