feat: oauth2.1 mcp integration

backend/open_webui/routers/configs.py

@@ -21,7 +21,9 @@ from open_webui.env import SRC_LOG_LEVELS
 from open_webui.utils.oauth import (
     get_discovery_urls,
     get_oauth_client_info_with_dynamic_client_registration,
-    encrypt_token,
+    encrypt_data,
+    decrypt_data,
+    OAuthClientInformationFull,
 )
 from mcp.shared.auth import OAuthMetadata
 
@@ -103,17 +105,22 @@ class OAuthClientRegistrationForm(BaseModel):
 async def register_oauth_client(
     request: Request,
     form_data: OAuthClientRegistrationForm,
+    type: Optional[str] = None,
     user=Depends(get_admin_user),
 ):
     try:
+        oauth_client_id = form_data.client_id
+        if type:
+            oauth_client_id = f"{type}:{form_data.client_id}"
+
         oauth_client_info = (
             await get_oauth_client_info_with_dynamic_client_registration(
-                request, form_data.url
+                request, oauth_client_id, form_data.url
             )
         )
         return {
             "status": True,
-            "oauth_client_info": encrypt_token(
+            "oauth_client_info": encrypt_data(
                 oauth_client_info.model_dump(mode="json")
             ),
         }
@@ -161,8 +168,25 @@ async def set_tool_servers_config(
     request.app.state.config.TOOL_SERVER_CONNECTIONS = [
         connection.model_dump() for connection in form_data.TOOL_SERVER_CONNECTIONS
     ]
+
     await set_tool_servers(request)
 
+    for connection in request.app.state.config.TOOL_SERVER_CONNECTIONS:
+        server_type = connection.get("type", "openapi")
+        if server_type == "mcp":
+            server_id = connection.get("info", {}).get("id")
+            auth_type = connection.get("auth_type", "none")
+            if auth_type == "oauth_2.1" and server_id:
+                try:
+                    oauth_client_info = decrypt_data(oauth_client_info)
+                    await request.app.state.oauth_client_manager.add_client(
+                        f"{server_type}:{server_id}",
+                        OAuthClientInformationFull(**oauth_client_info),
+                    )
+                except Exception as e:
+                    log.debug(f"Failed to add OAuth client for MCP tool server: {e}")
+                    continue
+
     return {
         "TOOL_SERVER_CONNECTIONS": request.app.state.config.TOOL_SERVER_CONNECTIONS,
     }

backend/open_webui/routers/tools.py

@@ -9,6 +9,7 @@ from pydantic import BaseModel, HttpUrl
 from fastapi import APIRouter, Depends, HTTPException, Request, status
 
 
+from open_webui.models.oauth_sessions import OAuthSessions
 from open_webui.models.tools import (
     ToolForm,
     ToolModel,
@@ -80,6 +81,24 @@ async def get_tools(request: Request, user=Depends(get_verified_user)):
     # MCP Tool Servers
     for server in request.app.state.config.TOOL_SERVER_CONNECTIONS:
         if server.get("type", "openapi") == "mcp":
+            server_id = server.get("info", {}).get("id")
+            auth_type = server.get("auth_type", "none")
+
+            session_token = None
+            if auth_type == "oauth_2.1":
+                splits = server_id.split(":")
+                server_id = splits[-1] if len(splits) > 1 else server_id
+
+                session_token = (
+                    await request.app.state.oauth_client_manager.get_oauth_token(
+                        user.id, f"mcp:{server_id}"
+                    )
+                )
+
+                print("User ID:", user.id)
+                print("Server ID:", server_id)
+                print("MCP Session Token:", session_token)
+
             tools.append(
                 ToolUserResponse(
                     **{
@@ -96,6 +115,13 @@ async def get_tools(request: Request, user=Depends(get_verified_user)):
                         ),
                         "updated_at": int(time.time()),
                         "created_at": int(time.time()),
+                        **(
+                            {
+                                "authenticated": session_token is not None,
+                            }
+                            if auth_type == "oauth_2.1"
+                            else {}
+                        ),
                     }
                 )
             )