Implementing enterprise-managed MCP authorization in Keycloak

1. Authorization challenges for enterprise MCP

As MCP is adopted in enterprise environments, authorization can create three common challenges:

• Administrative Overhead: Per-server OAuth authorization can create isolated authorization silos, making it difficult for administrators to track, manage, and audit which AI agents are accessing specific internal systems.
• Shadow IT Risks: As users independently authorize various tools, "OAuth Sprawl" can occur. This fragmented approach can make it harder to apply corporate security policies consistently and increase the risk of data exposure.
• User Friction: Requiring end-users to manually authorize every single tool integration ruins the seamless AI experience. Furthermore, this constant prompting leads to "consent fatigue," where users blindly approve access requests, creating a serious systemic security risk.

Together, these challenges can make it harder to safely scale Agentic AI across the enterprise.

2. Enterprise-Managed Authorization and ID-JAG

Figure 1. Illustrative employee lifecycle scenarios where EMA can apply centrally managed MCP access policies as roles and group memberships change.

Note: This diagram was generated using AI.

Enterprise-Managed Authorization (EMA) is a stable authorization extension for MCP, with Claude's "Enterprise-managed auth" as one implementation. The EMA specification goes beyond simple logins. It can support access management across the employee lifecycle by allowing administrators to manage MCP server access centrally through an enterprise Identity Provider (IdP), with access based on existing roles and group memberships. By making the IdP the central policy decision point, EMA gives administrators more consistent control over MCP server access, helping reduce Shadow IT risks and per-server authorization prompts for end-users.

EMA uses ID-JAG (Identity Assertion JWT Authorization Grant), an IETF draft specification.

ID-JAG enables the enterprise IdP to act as a policy gateway in the authorization flow. The IdP issues a signed assertion for a specific MCP authorization server. The MCP client presents that assertion to the authorization server, which validates it and, if valid, issues an access token for the MCP server.

By contrast, in the standard MCP authorization model, authorization may be handled separately for each MCP server. This can create isolated authorization silos, making unified governance more difficult.

With ID-JAG, authorization policy can be evaluated at the IdP as well as the MCP authorization server, giving enterprises flexibility over where policy decisions are made. The MCP authorization server still validates the ID-JAG, applies its own local policy, and issues the access token.

3. Supporting the ecosystem by implementing ID-JAG in Keycloak

While proprietary identity vendors are moving quickly to support these new standards, we believe it is critical to provide the ecosystem with an open-source option for implementing the core infrastructure of Agentic AI.

Keycloak is an open-source Identity and Access Management (IAM) project. For us, it was a natural place to contribute this work. Indeed, Keycloak is already used in official MCP SDK authorization examples. By bringing native ID-JAG support to Keycloak, we aim to give organizations an open-source implementation option without vendor lock-in, leveraging the very infrastructure the community already trusts. That is why we, as active Keycloak contributors, are currently focusing our efforts on implementing native ID-JAG support within Keycloak. We are actively advancing this initiative through tangible upstream contributions:

• PR #46048: ID-JAG Consumer Support – This implements the receiving authorization server role and was merged as an experimental feature in Keycloak 26.7. (*)
• PR #49998: ID-JAG Issuer Support – This implements the issuer side for generating assertions and is currently under review.

By bringing this capability to the open-source IdP and Authorization Server, we are contributing to the growth and adoption of both the Keycloak and ID-JAG ecosystems.

4. The road ahead for EMA support

Implementing ID-JAG is just the first step. Moving forward, we plan to work alongside the community and expand our contributions to achieve comprehensive EMA support in Keycloak.

Our ultimate goal is straightforward: to provide the MCP ecosystem with an open-source implementation option for EMA. By enabling enterprises to use open-source tools for enterprise-managed MCP authorization, we hope to support broader adoption of EMA and ID-JAG.

(*) For detailed instructions on how to use this experimental feature, please refer to the official Keycloak ID-JAG guide. At this stage, Keycloak advises against using it in production environments but we encourage you to try it in a test environment and share your feedback!

* Claude is a trademark or registered trademark of Anthropic, PBC.