rename: CrossApplicationAccess* -> IdentityAssertionGrant* (fix CS8603 + final rename per review)

Author: aniket-okta

README.md

@@ -34,7 +34,7 @@ For more information about MCP:
 ## Cross-Application Access (Identity Assertion Authorization Grant flow)
 
 The SDK provides support for the [Identity Assertion Authorization Grant flow](https://github.com/modelcontextprotocol/ext-auth/blob/main/specification/draft/enterprise-managed-authorization.mdx)
-via `CrossApplicationAccessProvider`. See the [Cross-Application Access](docs/concepts/transports/transports.md#cross-application-access) section in the transport docs for full usage details.
+via `IdentityAssertionGrantProvider`. See the [Cross-Application Access](docs/concepts/transports/transports.md#cross-application-access) section in the transport docs for full usage details.
 
 ## License
 

docs/concepts/transports/transports.md

@@ -381,7 +381,7 @@ Like [stdio](#stdio-transport), the in-memory transport is inherently single-ses
 
 ## Cross-Application Access
 
-The SDK provides built-in support for the [Identity Assertion Authorization Grant (IDAG) flow](https://github.com/modelcontextprotocol/ext-auth/blob/main/specification/draft/enterprise-managed-authorization.mdx) via `CrossApplicationAccessProvider`. This enables non-interactive enterprise SSO scenarios where users authenticate once via their enterprise Identity Provider (IdP) and access MCP servers without per-server authorization prompts.
+The SDK provides built-in support for the [Identity Assertion Authorization Grant (IDAG) flow](https://github.com/modelcontextprotocol/ext-auth/blob/main/specification/draft/enterprise-managed-authorization.mdx) via `IdentityAssertionGrantProvider`. This enables non-interactive enterprise SSO scenarios where users authenticate once via their enterprise Identity Provider (IdP) and access MCP servers without per-server authorization prompts.
 
 The flow consists of two steps:
 1. **RFC 8693 Token Exchange** at the enterprise IdP: OIDC ID token → JWT Authorization Grant (JAG)
@@ -395,8 +395,8 @@ using ModelContextProtocol.Authentication;
 // The caller owns the HttpClient lifetime.
 var httpClient = new HttpClient();
 
-var provider = new CrossApplicationAccessProvider(
-    new CrossApplicationAccessProviderOptions
+var provider = new IdentityAssertionGrantProvider(
+    new IdentityAssertionGrantProviderOptions
     {
         ClientId = "mcp-client-id",
         IdpTokenEndpoint = "https://company.okta.com/oauth2/token",

…Authentication/CrossApplicationAccess.cs …Authentication/IdentityAssertionGrant.cssrc/ModelContextProtocol.Core/Authentication/CrossApplicationAccess.cs renamed to src/ModelContextProtocol.Core/Authentication/IdentityAssertionGrant.cs src/ModelContextProtocol.Core/Authentication/CrossApplicationAccess.cs renamed to src/ModelContextProtocol.Core/Authentication/IdentityAssertionGrant.cs

@@ -10,7 +10,7 @@ namespace ModelContextProtocol.Authentication;
 /// Implements the Enterprise Managed Authorization flow as specified at
 /// <see href="https://github.com/modelcontextprotocol/ext-auth/blob/main/specification/draft/enterprise-managed-authorization.mdx"/>.
 /// </remarks>
-internal static class CrossApplicationAccess
+internal static class IdentityAssertionGrant
 {
     #region Constants
 
@@ -103,7 +103,7 @@ public static async Task<string> RequestJwtAuthorizationGrantAsync(
                 // Could not parse error response
             }
 
-            throw new CrossApplicationAccessException(
+            throw new IdentityAssertionGrantException(
                 $"Token exchange failed with status {(int)httpResponse.StatusCode}.",
                 errorResponse?.Error,
                 errorResponse?.ErrorDescription,
@@ -114,25 +114,25 @@ public static async Task<string> RequestJwtAuthorizationGrantAsync(
 
         if (response is null)
         {
-            var ex = new CrossApplicationAccessException("Failed to parse token exchange response.");
+            var ex = new IdentityAssertionGrantException("Failed to parse token exchange response.");
             ex.Data["ResponseBody"] = responseBody;
             throw ex;
         }
 
         if (string.IsNullOrEmpty(response.AccessToken))
         {
-            throw new CrossApplicationAccessException("Token exchange response missing required field: access_token");
+            throw new IdentityAssertionGrantException("Token exchange response missing required field: access_token");
         }
 
         if (!string.Equals(response.IssuedTokenType, TokenTypeIdJag, StringComparison.Ordinal))
         {
-            throw new CrossApplicationAccessException(
+            throw new IdentityAssertionGrantException(
                 $"Token exchange response issued_token_type must be '{TokenTypeIdJag}', got '{response.IssuedTokenType}'.");
         }
 
         if (!string.Equals(response.TokenType, TokenTypeNotApplicable, StringComparison.Ordinal))
         {
-            throw new CrossApplicationAccessException(
+            throw new IdentityAssertionGrantException(
                 $"Token exchange response token_type must be '{TokenTypeNotApplicable}' per RFC 8693 §2.2.1, got '{response.TokenType}'.");
         }
 
@@ -197,7 +197,7 @@ public static async Task<TokenContainer> ExchangeJwtBearerGrantAsync(
                 // Could not parse error response
             }
 
-            throw new CrossApplicationAccessException(
+            throw new IdentityAssertionGrantException(
                 $"JWT bearer grant failed with status {(int)httpResponse.StatusCode}.",
                 errorResponse?.Error,
                 errorResponse?.ErrorDescription,
@@ -208,24 +208,24 @@ public static async Task<TokenContainer> ExchangeJwtBearerGrantAsync(
 
         if (response is null)
         {
-            var ex = new CrossApplicationAccessException("Failed to parse JWT bearer grant response.");
+            var ex = new IdentityAssertionGrantException("Failed to parse JWT bearer grant response.");
             ex.Data["ResponseBody"] = responseBody;
             throw ex;
         }
 
         if (string.IsNullOrEmpty(response.AccessToken))
         {
-            throw new CrossApplicationAccessException("JWT bearer grant response missing required field: access_token");
+            throw new IdentityAssertionGrantException("JWT bearer grant response missing required field: access_token");
         }
 
         if (string.IsNullOrEmpty(response.TokenType))
         {
-            throw new CrossApplicationAccessException("JWT bearer grant response missing required field: token_type");
+            throw new IdentityAssertionGrantException("JWT bearer grant response missing required field: token_type");
         }
 
         if (!string.Equals(response.TokenType, "bearer", StringComparison.OrdinalIgnoreCase))
         {
-            throw new CrossApplicationAccessException(
+            throw new IdentityAssertionGrantException(
                 $"JWT bearer grant response token_type must be 'bearer' per RFC 7523, got '{response.TokenType}'.");
         }
 
@@ -289,7 +289,7 @@ internal static async Task<AuthorizationServerMetadata> DiscoverAuthServerMetada
             }
         }
 
-        throw new CrossApplicationAccessException($"Failed to discover authorization server metadata for: {issuerUrl}");
+        throw new IdentityAssertionGrantException($"Failed to discover authorization server metadata for: {issuerUrl}");
     }
 
     #endregion

…ication/CrossApplicationAccessContext.cs …ication/IdentityAssertionGrantContext.cssrc/ModelContextProtocol.Core/Authentication/CrossApplicationAccessContext.cs renamed to src/ModelContextProtocol.Core/Authentication/IdentityAssertionGrantContext.cs src/ModelContextProtocol.Core/Authentication/CrossApplicationAccessContext.cs renamed to src/ModelContextProtocol.Core/Authentication/IdentityAssertionGrantContext.cs

@@ -1,10 +1,10 @@
 namespace ModelContextProtocol.Authentication;
 
 /// <summary>
-/// Context provided to the <see cref="CrossApplicationAccessIdTokenCallback"/> for a Cross-Application Access
+/// Context provided to the <see cref="IdentityAssertionGrantIdTokenCallback"/> for a Cross-Application Access
 /// authorization flow. Contains the URLs discovered during the OAuth flow needed for the token exchange step.
 /// </summary>
-public sealed class CrossApplicationAccessContext
+public sealed class IdentityAssertionGrantContext
 {
     /// <summary>
     /// Gets the MCP resource server URL (i.e., the <c>resource</c> parameter for token exchange).

…ation/CrossApplicationAccessException.cs …ation/IdentityAssertionGrantException.cssrc/ModelContextProtocol.Core/Authentication/CrossApplicationAccessException.cs renamed to src/ModelContextProtocol.Core/Authentication/IdentityAssertionGrantException.cs src/ModelContextProtocol.Core/Authentication/CrossApplicationAccessException.cs renamed to src/ModelContextProtocol.Core/Authentication/IdentityAssertionGrantException.cs

@@ -4,7 +4,7 @@ namespace ModelContextProtocol.Authentication;
 /// Represents an error that occurred during a Cross-Application Access authorization operation
 /// (token exchange per RFC 8693, and JWT bearer grant per RFC 7523).
 /// </summary>
-public sealed class CrossApplicationAccessException : Exception
+public sealed class IdentityAssertionGrantException : Exception
 {
     /// <summary>
     /// Gets the OAuth error code, if available (e.g., "invalid_request", "invalid_grant").
@@ -22,13 +22,13 @@ public sealed class CrossApplicationAccessException : Exception
     public string? ErrorUri { get; }
 
     /// <summary>
-    /// Initializes a new instance of the <see cref="CrossApplicationAccessException"/> class.
+    /// Initializes a new instance of the <see cref="IdentityAssertionGrantException"/> class.
     /// </summary>
     /// <param name="message">The error message.</param>
     /// <param name="errorCode">The OAuth error code.</param>
     /// <param name="errorDescription">The human-readable error description.</param>
     /// <param name="errorUri">The error URI.</param>
-    public CrossApplicationAccessException(string message, string? errorCode = null, string? errorDescription = null, string? errorUri = null)
+    public IdentityAssertionGrantException(string message, string? errorCode = null, string? errorDescription = null, string? errorUri = null)
         : base(FormatMessage(message, errorCode, errorDescription))
     {
         ErrorCode = errorCode;

…CrossApplicationAccessIdTokenCallback.cs …IdentityAssertionGrantIdTokenCallback.cssrc/ModelContextProtocol.Core/Authentication/CrossApplicationAccessIdTokenCallback.cs renamed to src/ModelContextProtocol.Core/Authentication/IdentityAssertionGrantIdTokenCallback.cs src/ModelContextProtocol.Core/Authentication/CrossApplicationAccessIdTokenCallback.cs renamed to src/ModelContextProtocol.Core/Authentication/IdentityAssertionGrantIdTokenCallback.cs

@@ -12,6 +12,6 @@ namespace ModelContextProtocol.Authentication;
 /// obtained from the enterprise Identity Provider (e.g., via SSO login). The provider will then use this
 /// ID token to perform the RFC 8693 token exchange to obtain a JWT Authorization Grant.
 /// </returns>
-public delegate Task<string> CrossApplicationAccessIdTokenCallback(
-    CrossApplicationAccessContext context,
+public delegate Task<string> IdentityAssertionGrantIdTokenCallback(
+    IdentityAssertionGrantContext context,
     CancellationToken cancellationToken);

…cation/CrossApplicationAccessProvider.cs …cation/IdentityAssertionGrantProvider.cssrc/ModelContextProtocol.Core/Authentication/CrossApplicationAccessProvider.cs renamed to src/ModelContextProtocol.Core/Authentication/IdentityAssertionGrantProvider.cs src/ModelContextProtocol.Core/Authentication/CrossApplicationAccessProvider.cs renamed to src/ModelContextProtocol.Core/Authentication/IdentityAssertionGrantProvider.cs

@@ -14,8 +14,8 @@ namespace ModelContextProtocol.Authentication;
 /// </para>
 /// <list type="number">
 /// <item><description>
-/// The <see cref="CrossApplicationAccessProviderOptions.IdTokenCallback"/> is called to obtain an OIDC ID token.
-/// It receives a <see cref="CrossApplicationAccessContext"/> with the discovered resource and authorization
+/// The <see cref="IdentityAssertionGrantProviderOptions.IdTokenCallback"/> is called to obtain an OIDC ID token.
+/// It receives a <see cref="IdentityAssertionGrantContext"/> with the discovered resource and authorization
 /// server URLs.
 /// </description></item>
 /// <item><description>
@@ -31,8 +31,8 @@ namespace ModelContextProtocol.Authentication;
 /// </remarks>
 /// <example>
 /// <code>
-/// var provider = new CrossApplicationAccessProvider(
-///     new CrossApplicationAccessProviderOptions
+/// var provider = new IdentityAssertionGrantProvider(
+///     new IdentityAssertionGrantProviderOptions
 ///     {
 ///         ClientId = "mcp-client-id",
 ///         IdpTokenEndpoint = "https://company.okta.com/oauth2/token",
@@ -48,16 +48,16 @@ namespace ModelContextProtocol.Authentication;
 ///     cancellationToken: ct);
 /// </code>
 /// </example>
-public sealed class CrossApplicationAccessProvider
+public sealed class IdentityAssertionGrantProvider
 {
-    private readonly CrossApplicationAccessProviderOptions _options;
+    private readonly IdentityAssertionGrantProviderOptions _options;
     private readonly HttpClient _httpClient;
     private readonly ILogger _logger;
 
     private TokenContainer? _cachedTokens;
 
     /// <summary>
-    /// Initializes a new instance of the <see cref="CrossApplicationAccessProvider"/> class.
+    /// Initializes a new instance of the <see cref="IdentityAssertionGrantProvider"/> class.
     /// </summary>
     /// <param name="options">Configuration for the Cross-Application Access provider.</param>
     /// <param name="httpClient">
@@ -66,8 +66,8 @@ public sealed class CrossApplicationAccessProvider
     /// <param name="loggerFactory">Optional logger factory.</param>
     /// <exception cref="ArgumentNullException"><paramref name="options"/> or <paramref name="httpClient"/> is null.</exception>
     /// <exception cref="ArgumentException">Required option values are missing.</exception>
-    public CrossApplicationAccessProvider(
-        CrossApplicationAccessProviderOptions options,
+    public IdentityAssertionGrantProvider(
+        IdentityAssertionGrantProviderOptions options,
         HttpClient httpClient,
         ILoggerFactory? loggerFactory = null)
     {
@@ -89,7 +89,7 @@ public CrossApplicationAccessProvider(
 
         _options = options;
         _httpClient = httpClient;
-        _logger = (ILogger?)loggerFactory?.CreateLogger<CrossApplicationAccessProvider>() ?? NullLogger.Instance;
+        _logger = (ILogger?)loggerFactory?.CreateLogger<IdentityAssertionGrantProvider>() ?? NullLogger.Instance;
     }
 
     /// <summary>
@@ -99,7 +99,7 @@ public CrossApplicationAccessProvider(
     /// <param name="authorizationServerUrl">The MCP authorization server URL.</param>
     /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests.</param>
     /// <returns>A <see cref="TokenContainer"/> containing the access token.</returns>
-    /// <exception cref="CrossApplicationAccessException">Thrown when any step of the flow fails.</exception>
+    /// <exception cref="IdentityAssertionGrantException">Thrown when any step of the flow fails.</exception>
     public async Task<TokenContainer> GetAccessTokenAsync(
         Uri resourceUrl,
         Uri authorizationServerUrl,
@@ -114,15 +114,15 @@ public async Task<TokenContainer> GetAccessTokenAsync(
         _logger.LogDebug("Starting Cross-Application Access flow for resource {ResourceUrl}", resourceUrl);
 
         // Step 1: Discover MCP authorization server metadata to find the token endpoint
-        var mcpAuthMetadata = await CrossApplicationAccess.DiscoverAuthServerMetadataAsync(
+        var mcpAuthMetadata = await IdentityAssertionGrant.DiscoverAuthServerMetadataAsync(
             authorizationServerUrl, _httpClient, cancellationToken).ConfigureAwait(false);
 
         var mcpTokenEndpoint = mcpAuthMetadata.TokenEndpoint?.ToString()
-            ?? throw new CrossApplicationAccessException(
+            ?? throw new IdentityAssertionGrantException(
                 $"MCP authorization server metadata at {authorizationServerUrl} missing token_endpoint.");
 
         // Step 2: Call the ID token callback to get the caller's OIDC ID token
-        var context = new CrossApplicationAccessContext
+        var context = new IdentityAssertionGrantContext
         {
             ResourceUrl = resourceUrl,
             AuthorizationServerUrl = authorizationServerUrl,
@@ -133,14 +133,14 @@ public async Task<TokenContainer> GetAccessTokenAsync(
 
         if (string.IsNullOrEmpty(idToken))
         {
-            throw new CrossApplicationAccessException("ID token callback returned a null or empty token.");
+            throw new IdentityAssertionGrantException("ID token callback returned a null or empty token.");
         }
 
         // Step 3: RFC 8693 token exchange — ID token → JWT Authorization Grant (JAG) at the enterprise IdP
         _logger.LogDebug("Performing RFC 8693 token exchange at IdP");
         var idpTokenEndpoint = await ResolveIdpTokenEndpointAsync(cancellationToken).ConfigureAwait(false);
 
-        var jag = await CrossApplicationAccess.RequestJwtAuthorizationGrantAsync(
+        var jag = await IdentityAssertionGrant.RequestJwtAuthorizationGrantAsync(
             new RequestJwtAuthGrantOptions
             {
                 TokenEndpoint = idpTokenEndpoint,
@@ -154,7 +154,7 @@ public async Task<TokenContainer> GetAccessTokenAsync(
 
         // Step 4: RFC 7523 JWT bearer grant — JAG → access token at the MCP authorization server
         _logger.LogDebug("Exchanging JAG for access token at {McpTokenEndpoint}", mcpTokenEndpoint);
-        var tokens = await CrossApplicationAccess.ExchangeJwtBearerGrantAsync(
+        var tokens = await IdentityAssertionGrant.ExchangeJwtBearerGrantAsync(
             new ExchangeJwtBearerGrantOptions
             {
                 TokenEndpoint = mcpTokenEndpoint,
@@ -194,13 +194,14 @@ private async Task<string> ResolveIdpTokenEndpointAsync(CancellationToken cancel
         }
 
         // Discover from IdpUrl
-        var idpMetadata = await CrossApplicationAccess.DiscoverAuthServerMetadataAsync(
+        var idpMetadata = await IdentityAssertionGrant.DiscoverAuthServerMetadataAsync(
             new Uri(_options.IdpUrl!), _httpClient, cancellationToken).ConfigureAwait(false);
 
-        _resolvedIdpTokenEndpoint = idpMetadata.TokenEndpoint?.ToString()
-            ?? throw new CrossApplicationAccessException(
+        var resolved = idpMetadata.TokenEndpoint?.ToString()
+            ?? throw new IdentityAssertionGrantException(
                 $"IdP metadata discovery for {_options.IdpUrl} did not return a token_endpoint.");
 
-        return _resolvedIdpTokenEndpoint;
+        _resolvedIdpTokenEndpoint = resolved;
+        return resolved;
     }
 }

…CrossApplicationAccessProviderOptions.cs …IdentityAssertionGrantProviderOptions.cssrc/ModelContextProtocol.Core/Authentication/CrossApplicationAccessProviderOptions.cs renamed to src/ModelContextProtocol.Core/Authentication/IdentityAssertionGrantProviderOptions.cs src/ModelContextProtocol.Core/Authentication/CrossApplicationAccessProviderOptions.cs renamed to src/ModelContextProtocol.Core/Authentication/IdentityAssertionGrantProviderOptions.cs

@@ -1,9 +1,9 @@
 namespace ModelContextProtocol.Authentication;
 
 /// <summary>
-/// Configuration options for the <see cref="CrossApplicationAccessProvider"/>.
+/// Configuration options for the <see cref="IdentityAssertionGrantProvider"/>.
 /// </summary>
-public sealed class CrossApplicationAccessProviderOptions
+public sealed class IdentityAssertionGrantProviderOptions
 {
     /// <summary>
     /// Gets or sets the MCP client ID used for the JWT Bearer grant (RFC 7523) at the MCP authorization server.
@@ -55,7 +55,7 @@ public sealed class CrossApplicationAccessProviderOptions
     /// <remarks>
     /// <para>
     /// This callback is invoked after the MCP resource and authorization server URLs have been discovered.
-    /// It receives a <see cref="CrossApplicationAccessContext"/> with these URLs and should return the
+    /// It receives a <see cref="IdentityAssertionGrantContext"/> with these URLs and should return the
     /// OIDC ID token string obtained from the enterprise Identity Provider (e.g., from an SSO login session).
     /// </para>
     /// <para>
@@ -64,5 +64,5 @@ public sealed class CrossApplicationAccessProviderOptions
     /// the MCP authorization server via RFC 7523.
     /// </para>
     /// </remarks>
-    public required CrossApplicationAccessIdTokenCallback IdTokenCallback { get; set; }
+    public required IdentityAssertionGrantIdTokenCallback IdTokenCallback { get; set; }
 }

src/ModelContextProtocol.Core/Authentication/JagTokenExchangeResponse.cs

@@ -15,7 +15,7 @@ internal sealed class JagTokenExchangeResponse
 
     /// <summary>
     /// Gets or sets the type of the security token issued.
-    /// This MUST be <see cref="CrossApplicationAccess.TokenTypeIdJag"/>.
+    /// This MUST be <see cref="IdentityAssertionGrant.TokenTypeIdJag"/>.
     /// </summary>
     [System.Text.Json.Serialization.JsonPropertyName("issued_token_type")]
     public string IssuedTokenType { get; set; } = null!;