[halter73]

Summary

• Reuse the exact validated ProtectedResourceMetadata.Resource string for silent token refresh instead of reconstructing it from the outgoing request URI. Preserve authority-only identifiers, meaningful trailing slashes, and resource omission in the existing legacy flow.
• Retain the resource together with authorization-server metadata only after client registration is ready, or immediately before returning from a successful challenge-driven refresh. This enables future silent refreshes after a cold start without leaving partially initialized refresh state after failed registration. Clear the pair together when the authorization server changes.
• Preserve the supplied resource's Uri.OriginalString in identity-assertion grants and pass the discovered canonical resource, rather than the transport endpoint, through the conformance enterprise flow.

Authorization requests, authorization-code exchanges, and challenge-triggered refreshes already used the metadata resource verbatim. This does not change metadata-match rules, issuer validation, scopes, token-cache contracts, or introduce a retry that omits resource.

Regression coverage

Deterministically expire cached access tokens, without delays, and assert the exact refresh resource, successful refresh, no extra challenge, and no additional interactive authorization or code exchange. Coverage includes bare-host resources without an added slash, /mcp endpoints with an authority-only resource, explicit root/path trailing slashes, legacy absent-resource flows, cold-start cached-token refresh, and authorization-server migration.

Also reject the first dynamic-registration request with expired, unbound legacy cached tokens and retry the same provider. The retry must register and authorize successfully rather than attempt refresh without a client ID. Identity-assertion coverage checks root/path spelling, trailing slashes, and percent-encoding.

The resource regressions were demonstrated failing before the production fix. The failed-registration retry regression was demonstrated failing with the earlier readiness-state assignment and passing with the revised ordering.

Validation

• dotnet build --no-restore --nologo --verbosity quiet — succeeded with zero warnings and errors.
• dotnet test --no-build --no-restore --nologo --filter "FullyQualifiedName~.OAuth.|FullyQualifiedName~IdentityAssertionGrantTests|FullyQualifiedName~ClientOAuthProviderApplicationTypeTests" --verbosity quiet — all 487 related cases passed: 129 OAuth cases on each of .NET 10, .NET 9, and .NET 8, plus 25 core authentication cases on each of those frameworks and .NET Framework 4.7.2.

Note

This pull request's code and description were generated with GitHub Copilot.

[Copilot]

🟢 Approval recommended

No active review issues remain for the changes preserving canonical OAuth resource identifiers.

No open issues 🎉

What changed in this PR

This PR preserves canonical OAuth resource identifiers across token refresh and identity-assertion flows in the C# SDK, avoiding changes caused by reconstructing identifiers from transport URLs.

Changes:

• Retain the validated resource alongside authorization-server metadata for silent refresh, including cold starts and server migration.
• Preserve exact resource spelling in identity-assertion grants and use the discovered resource in the enterprise conformance flow.
• Add regression coverage for resource formatting, legacy omission, and retries after failed registration.

File	Description
tests/​ModelContextProtocol.Tests/​IdentityAssertionGrantTests.cs	Verify exact resource spelling, trailing slashes, and percent-encoding.
tests/​ModelContextProtocol.ConformanceClient/​ConformanceOAuthHelpers.cs	Pass the discovered canonical resource to enterprise token acquisition.
tests/​ModelContextProtocol.AspNetCore.Tests/​OAuth/​TokenCacheTests.cs	Cover canonical refresh resources, cold starts, registration retries, and issuer migration.
src/​ModelContextProtocol.Core/​Authentication/​ProtectedResourceMetadata.cs	Document exact resource identifier preservation.
src/​ModelContextProtocol.Core/​Authentication/​IdentityAssertionGrantProvider.cs	Use Uri.OriginalString for the resource parameter.
src/​ModelContextProtocol.Core/​Authentication/​ClientOAuthProvider.cs	Retain and clear canonical resource state alongside authorization-server metadata.

_{Review effort: Balanced}