{"record":{"id":"a2b7974337408ba7","repo":"zed-industries/zed","slug":"authorization-server-supports-neither-cimd-nor-dcr","errorCode":null,"errorMessage":"authorization server supports neither CIMD nor DCR","messagePattern":"authorization server supports neither CIMD nor DCR","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/context_server/src/oauth.rs","lineNumber":917,"sourceCode":"            client_id,\n            client_secret: None,\n        }),\n        ClientRegistrationStrategy::Dcr {\n            registration_endpoint,\n        } => {\n            perform_dcr(\n                http_client,\n                &registration_endpoint,\n                redirect_uri,\n                discovery\n                    .auth_server_metadata\n                    .grant_types_supported\n                    .as_deref(),\n            )\n            .await\n        }\n        ClientRegistrationStrategy::Unavailable => {\n            bail!(\"authorization server supports neither CIMD nor DCR\")\n        }\n    }\n}\n\n// -- Dynamic Client Registration (RFC 7591) ----------------------------------\n\n/// Perform Dynamic Client Registration with the authorization server.\npub async fn perform_dcr(\n    http_client: &Arc<dyn HttpClient>,\n    registration_endpoint: &Url,\n    redirect_uri: &str,\n    server_grant_types: Option<&[String]>,\n) -> Result<OAuthClientRegistration> {\n    validate_oauth_url(registration_endpoint)?;\n\n    let body = dcr_registration_body(redirect_uri, server_grant_types);\n    let body_bytes = serde_json::to_vec(&body)?;\n","sourceCodeStart":899,"sourceCodeEnd":935,"githubUrl":"https://github.com/zed-industries/zed/blob/f4178619acd0d47ea1f76a2025c42962c6d6638c/crates/context_server/src/oauth.rs#L899-L935","documentation":"To obtain a client_id, Zed's MCP OAuth flow supports exactly two mechanisms, tried in MCP-spec order by determine_registration_strategy(): Client-Id Metadata Documents (CIMD) when metadata sets client_id_metadata_document_supported=true, and Dynamic Client Registration (RFC 7591) when metadata provides registration_endpoint. If the auth server metadata has neither, resolve_client_registration() bails here — there is no static client_id/secret configuration path, so the flow cannot continue.","triggerScenarios":"Auth server metadata JSON contains neither \"client_id_metadata_document_supported\": true nor a \"registration_endpoint\" URL, and resolve_client_registration() reaches ClientRegistrationStrategy::Unavailable.","commonSituations":"Enterprise OIDC providers with DCR disabled by policy (registration_endpoint absent) and no CIMD support; auth server that expects pre-registered static clients, which this client cannot express; field renamed or nested incorrectly in a custom metadata implementation.","solutions":["Enable Dynamic Client Registration on the authorization server and make sure registration_endpoint appears in its discovery/metadata document","Alternatively expose an RFC 7592-style client-id metadata document and advertise client_id_metadata_document_supported=true","If the provider cannot do either, put a supporting OAuth proxy/gateway (one that supports DCR) in front of it and list that as the authorization server","Verify with curl that the served metadata actually contains registration_endpoint before retrying"],"exampleFix":"// before (metadata has neither mechanism)\n{ \"issuer\": \"https://auth.example.com\", \"token_endpoint\": \"...\" }\n\n// after\n{ \"issuer\": \"https://auth.example.com\", \"token_endpoint\": \"...\",\n  \"registration_endpoint\": \"https://auth.example.com/register\" }","handlingStrategy":"validation","validationCode":"// client-side: check registration capability before launching the browser flow\nlet can_register = metadata.get(\"client_id_metadata_document_supported\")\n    .and_then(|v| v.as_bool()) == Some(true)\n    || metadata.get(\"registration_endpoint\").and_then(|v| v.as_str()).is_some();\nanyhow::ensure!(can_register,\n    \"auth server supports neither CIMD nor DCR; OAuth cannot proceed\");","typeGuard":"fn registration_available(doc: &serde_json::Value) -> bool {\n    doc.get(\"client_id_metadata_document_supported\").and_then(|v| v.as_bool()) == Some(true)\n        || doc.get(\"registration_endpoint\").and_then(|v| v.as_str()).is_some()\n}","tryCatchPattern":"match resolve_client_registration(&client, &discovery, &redirect_uri).await {\n    Err(err) if err.to_string().contains(\"neither CIMD nor DCR\") => {\n        // no client registration path — surface a clear setup error instead of retrying\n        show_setup_error(\"enable DCR (registration_endpoint) or CIMD on the auth server\");\n        Err(err)\n    }\n    other => other,\n}","preventionTips":["Before offering OAuth in your MCP setup, confirm the auth server exposes registration_endpoint or CIMD support","Enterprise OIDC deployments often disable DCR — plan an OAuth proxy or CIMD document in advance","Lint the discovery document for these two fields as part of integration smoke tests"],"tags":["oauth","mcp","dcr","client-registration","rfc-7591"],"backgroundTag":"oauth-client-registration-unsupported","analyzedSha":"f4178619acd0d47ea1f76a2025c42962c6d6638c","analyzedAt":"2026-08-20T19:29:52.058Z","contentChangedAt":"2026-08-20T19:29:52.058Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}