Configure Your Identity Provider for a Custom MCP App

Published Date: August 18, 2026
Validated: Yes
Audience: Everyone
Products and Versions Covered: 

• Jama Connect® version(s) >= 9.39.0
  • Cloud/CVC
  • Self-hosted
• Jama Connect MCP™

Summary

This guide explains how to configure your identity provider (IdP) so a custom MCP app can authenticate users with your organization’s OAuth provider instead of Jama Connect’s internal OAuth service.

MCP delegates authentication to your IdP. Users sign in through your provider, and MCP validates the resulting OAuth tokens using your issuer metadata and signing keys.

Resolution

Before You Begin

Make sure you have the following:

• Administrator access to your identity provider

• Access to Jama Connect root admin

  • Self-hosted customers can access the Root Admin directly.

  • Cloud customers must create a Support request for assistance.

• The ability to create or manage an OAuth application in your IdP

• A user account in your IdP that also exists in Jama Connect

Step 2: Locate the issuer URL

Find the issuer URL for the OAuth authorization server in your IdP. In many providers, this can be found in the authorization server metadata or OpenID Connect metadata.

The issuer URL is the only value MCP needs to discover:

• token metadata,

• validation endpoints, and

• public signing keys from the JWKS URI.

For example, in Okta, the issuer may be exposed through metadata rather than prominently displayed in the UI.

MCP uses the issuer to download the provider metadata, discover the signing key endpoint, and validate whether incoming tokens were issued by a trusted source.

Step 3: Configure MCP authentication in Jama Connect

When logged into Jama Connect as a root admin, go to System Properties > API Authentication Properties > MCP Authentication.

Select the Customer-Provided OAuth option and provide the required values from your IdP configuration:

• MCP OAuth Issuer URL Audience value (from your identity provider application)

• Match on field - This is how the user from your identity provider will be matched to the user in Jama Connect.

  • If we have SSO enabled when logging into Jama Connect, we recommend using the same field you have set there.

You will also need to copy the audience value for the next step.

Step 4: Configure the audience value in your identity provider

Configure the audience value you copied in your IdP so tokens issued for the MCP application include it as the token audience.

MCP then validates both:

• the issuer, and

• the audience.

Why this matters: Trusting an issuer alone is not enough. Audience validation ensures a token was minted specifically for your MCP application, not just by a trusted provider.

 

Step 5: Set up a custom MCP app in your LLM of choice

Follow the steps for setting up a custom MCP app found here: Setting up the ChatGPT App to connect with Jama Connect MCP using OAuth. However, use the Client ID and Client secret from the application you set up in your identity provider. The rest of the values should come from the Connect URL as shown in the documentation.

These credentials are used by the MCP application to initiate the login flow against your IdP.

Do not use user-specific credentials. Use application-level registration credentials. User-specific client credentials are harder to manage at scale and are generally a weaker security pattern for this use case.

 

Step 6: Test the login flow

Start the MCP application and initiate authentication.

If configuration is correct:

• the browser should redirect users to your IdP login screen, not a Jama Connect login screen,

• users authenticate with their IdP credentials, and

• MCP receives and validates the OAuth token.

Successful outcome: Redirecting to your IdP confirms that MCP has delegated the login experience to your identity provider.

User Identity Matching

After authentication succeeds at the IdP, MCP must map the token subject to a Jama Connect user.

In many environments, the sub claim may correspond to:

• email address, or

• username

This value must align with how Jama Connect identifies the user.

Based on the walkthrough, current subject matching behavior may follow the same matching convention used elsewhere in Jama Connect identity configuration, commonly aligned with SAML matching behavior.

Recommendation: Verify ahead of time whether your IdP sends the user’s email address or username in the sub claim, and confirm that Jama Connect can match users using that same value.

Common Issues and Troubleshooting

Best Practices

• Use a dedicated application registration for MCP

• Use an unpredictable audience value, ideally a UUID

• Prefer application-level client credentials over user-specific credentials

• Verify subject mapping before rollout

• Test with a real user who exists in both the IdP and Jama Connect

• Document which field your IdP sends in the sub claim

FAQ

Can we keep using Jama Connect OAuth for MCP at the same time?
The current intended behavior for MCP is to use either internal Jama OAuth or customer-provided OAuth, not both at once.

Why is audience required if the issuer is already trusted?
The issuer proves who created the token. The audience proves the token was created specifically for your MCP application. Both checks are needed to prevent token reuse across tenants or applications.

What happens if the token subject does not match a Jama Connect user?
Authentication should fail with a 401. This prevents a valid IdP token from being used when Jama Connect cannot confidently identify the user.

Should multiple end users share the same client ID and secret?
If the client ID and secret represent an application-level registration, that is the expected pattern. End users still authenticate individually at the IdP login step.

Additional Resources 

• Setting up the ChatGPT App to connect with Jama Connect MCP using OAuth
• Success Programs
• Success Catalog
• Datasheets
• Request a Solution Offering or Training from the Success Catalog

Feedback:
We welcome your input! Please sign in to leave any comments, suggestions, or ideas for improvement below.