zed-industries/zed · error

authorization server supports neither CIMD nor DCR

Error message

authorization server supports neither CIMD nor DCR

What it means

To obtain a client_id, Zed's MCP OAuth flow supports exactly two mechanisms, tried in MCP-spec order by determine_registration_strategy(): Client-Id Metadata Documents (CIMD) when metadata sets client_id_metadata_document_supported=true, and Dynamic Client Registration (RFC 7591) when metadata provides registration_endpoint. If the auth server metadata has neither, resolve_client_registration() bails here — there is no static client_id/secret configuration path, so the flow cannot continue.

Source

Thrown at crates/context_server/src/oauth.rs:917

            client_id,
            client_secret: None,
        }),
        ClientRegistrationStrategy::Dcr {
            registration_endpoint,
        } => {
            perform_dcr(
                http_client,
                &registration_endpoint,
                redirect_uri,
                discovery
                    .auth_server_metadata
                    .grant_types_supported
                    .as_deref(),
            )
            .await
        }
        ClientRegistrationStrategy::Unavailable => {
            bail!("authorization server supports neither CIMD nor DCR")
        }
    }
}

// -- Dynamic Client Registration (RFC 7591) ----------------------------------

/// Perform Dynamic Client Registration with the authorization server.
pub async fn perform_dcr(
    http_client: &Arc<dyn HttpClient>,
    registration_endpoint: &Url,
    redirect_uri: &str,
    server_grant_types: Option<&[String]>,
) -> Result<OAuthClientRegistration> {
    validate_oauth_url(registration_endpoint)?;

    let body = dcr_registration_body(redirect_uri, server_grant_types);
    let body_bytes = serde_json::to_vec(&body)?;

View on GitHub (pinned to f4178619ac)

Solutions

1. Enable Dynamic Client Registration on the authorization server and make sure registration_endpoint appears in its discovery/metadata document
2. Alternatively expose an RFC 7592-style client-id metadata document and advertise client_id_metadata_document_supported=true
3. If the provider cannot do either, put a supporting OAuth proxy/gateway (one that supports DCR) in front of it and list that as the authorization server
4. Verify with curl that the served metadata actually contains registration_endpoint before retrying

Example fix

// before (metadata has neither mechanism)
{ "issuer": "https://auth.example.com", "token_endpoint": "..." }

// after
{ "issuer": "https://auth.example.com", "token_endpoint": "...",
  "registration_endpoint": "https://auth.example.com/register" }

// client-side: check registration capability before launching the browser flow
let can_register = metadata.get("client_id_metadata_document_supported")
    .and_then(|v| v.as_bool()) == Some(true)
    || metadata.get("registration_endpoint").and_then(|v| v.as_str()).is_some();
anyhow::ensure!(can_register,
    "auth server supports neither CIMD nor DCR; OAuth cannot proceed");

fn registration_available(doc: &serde_json::Value) -> bool {
    doc.get("client_id_metadata_document_supported").and_then(|v| v.as_bool()) == Some(true)
        || doc.get("registration_endpoint").and_then(|v| v.as_str()).is_some()
}

match resolve_client_registration(&client, &discovery, &redirect_uri).await {
    Err(err) if err.to_string().contains("neither CIMD nor DCR") => {
        // no client registration path — surface a clear setup error instead of retrying
        show_setup_error("enable DCR (registration_endpoint) or CIMD on the auth server");
        Err(err)
    }
    other => other,
}

When it happens

Trigger: Auth server metadata JSON contains neither "client_id_metadata_document_supported": true nor a "registration_endpoint" URL, and resolve_client_registration() reaches ClientRegistrationStrategy::Unavailable.

Common situations: Enterprise OIDC providers with DCR disabled by policy (registration_endpoint absent) and no CIMD support; auth server that expects pre-registered static clients, which this client cannot express; field renamed or nested incorrectly in a custom metadata implementation.

Related errors

• DCR failed with status {}: {}
• OAuth endpoint must use HTTPS (got {}://{})
• OAuth endpoint must not point to private/reserved IP: {}
• OAuth endpoint must not point to private/reserved IP: ::ffff
• OAuth endpoint must not point to reserved IPv6 address: {}

AI-assisted analysis of zed-industries/zed@f4178619ac (2026-08-20). Data as JSON: /api/errors/a2b7974337408ba7. Report an issue: GitHub.