Granular Application-level AuthN/AuthZ implementation

[qdrddr]

Question: Application-Level AuthN/AuthZ Support via MCP (Backend Only)

Is authentication and authorization (AuthN/AuthZ) implemented for the backend apps as part of this project specifically for MCP clients, not the mcp-context-forge UI?

Context:
Consider a CRM scenario with two users. Normally, we expect user-level access controls—each user can only view or modify their own records, except for explicitly shared ones. If both users now access the same CRM through MCP, can the same level of granular, application-level AuthN/AuthZ still be enforced? In other words, does mcp-context-forge allow preserving the original backend access controls as if the users were interacting with the CRM directly?

Original.

[crivetimihai]

Fine-grained RBAC / OAuth, etc. is part of the roadmap https://ibm.github.io/mcp-context-forge/architecture/roadmap/#authentication-authorization-security-identity - would welcome your thoughts!

[crivetimihai]

Please check out:

• [Feature Request]: HTTP Header Passthrough #208
• #283 - Role-Based Access Control (RBAC) - User/Team/Global Scopes for full multi-tenancy support

And let me know if these 2 would resolve the issue.

Please add any comments, suggested test scenarios or ideas to #208 or #283

Thanks!