@mcp-abap-adt/auth-broker 1.0.0 → 1.0.3

package/CHANGELOG.md

@@ -11,6 +11,27 @@ Thank you to all contributors! See [CONTRIBUTORS.md](CONTRIBUTORS.md) for the co
 
 ## [Unreleased]
 
+## [1.0.3] - 2026-02-11
+
+### Fixed
+- `mcp-sso`: prompt for passcode when not provided and tighten CLI typing.
+
+
+## [1.0.2] - 2026-02-11
+
+### Added
+- New `mcp-sso` CLI for SSO flows (OIDC browser/device/password/token_exchange and SAML2 bearer/pure).
+
+### Changed
+- Bumped `@mcp-abap-adt/auth-providers` to ^1.0.2.
+
+
+
+## [1.0.1] - 2026-02-10
+
+### Fixed
+- Include `tsconfig.cli.json` in git so `npm run build` works in CI.
+
 ## [1.0.0] - 2026-02-10
 
 ### Added

package/README.md

@@ -676,6 +676,55 @@ mcp-auth --service-key ./mcp.json --output ./mcp.env --type xsuaa --credential
 mcp-auth --env ./mcp.env --service-key ./mcp.json --output ./mcp.env --type xsuaa
 ```
 
+### CLI: mcp-sso
+
+Get tokens via SSO providers (OIDC/SAML) and generate `.env`/JSON output:
+
+```bash
+mcp-sso --protocol <oidc|saml2> --flow <flow> --output <path> [--type abap|xsuaa] [--format env|json] [--env <path>] [--config <path>]
+```
+
+**Supported flows:**
+- OIDC: `browser`, `device`, `password`, `token_exchange`
+- SAML2: `bearer`, `pure`
+
+**Examples:**
+```bash
+# OIDC browser flow
+mcp-sso --protocol oidc --flow browser --issuer https://issuer --client-id my-client --output ./sso.env --type xsuaa
+
+# OIDC browser flow (manual code / OOB)
+mcp-sso --protocol oidc --flow browser --token-endpoint https://issuer/token --client-id my-client --code <auth_code> --redirect-uri urn:ietf:wg:oauth:2.0:oob --output ./sso.env --type xsuaa
+
+# OIDC device flow
+mcp-sso --protocol oidc --flow device --issuer https://issuer --client-id my-client --output ./sso.env --type xsuaa
+
+# OIDC password flow (CF passcode)
+mcp-sso --protocol oidc --flow password --cf-api https://api.cf.eu10-004.hana.ondemand.com --client-id cf --passcode <code> --output ./sso.env --type xsuaa
+
+# OIDC token exchange
+mcp-sso --protocol oidc --flow token_exchange --issuer https://issuer --client-id my-client --subject-token <token> --output ./sso.env --type xsuaa
+
+# SAML bearer flow (assertion -> token)
+mcp-sso --protocol saml2 --flow bearer --idp-sso-url https://idp/sso --sp-entity-id my-sp --token-endpoint https://uaa.example/oauth/token --assertion <base64> --output ./sso.env --type xsuaa
+
+# SAML pure flow (cookie)
+mcp-sso --protocol saml2 --flow pure --idp-sso-url https://idp/sso --sp-entity-id my-sp --assertion <base64> --cookie "SAP_SESSION=..." --output ./sso.env --type abap
+```
+
+**Config file:**
+You can pass a JSON file with provider config:
+
+```json
+{
+  "protocol": "oidc",
+  "flow": "device",
+  "issuerUrl": "https://issuer",
+  "clientId": "my-client",
+  "scopes": ["openid", "profile"]
+}
+```
+
 ### Utility Script
 
 Generate `.env` files from service keys:

package/dist/bin/mcp-auth.js

@@ -53,14 +53,13 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const path = __importStar(require("path"));
 const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
 // Use require for CommonJS dist files with absolute path
 const distPath = path.resolve(__dirname, '..', 'index.js');
 const { AuthBroker } = require(distPath);
-const auth_stores_1 = require("@mcp-abap-adt/auth-stores");
 const auth_providers_1 = require("@mcp-abap-adt/auth-providers");
-const auth_stores_2 = require("@mcp-abap-adt/auth-stores");
+const auth_stores_1 = require("@mcp-abap-adt/auth-stores");
 function getVersion() {
     try {
         const candidates = [
@@ -199,7 +198,15 @@ function parseArgs() {
         }
         else if (args[i] === '--browser' && i + 1 < args.length) {
             browser = args[i + 1];
-            if (!['none', 'chrome', 'edge', 'firefox', 'system', 'headless', 'auto'].includes(browser)) {
+            if (![
+                'none',
+                'chrome',
+                'edge',
+                'firefox',
+                'system',
+                'headless',
+                'auto',
+            ].includes(browser)) {
                 console.error(`Invalid browser: ${browser}. Must be one of: none, chrome, edge, firefox, system, headless, auto`);
                 process.exit(1);
             }
@@ -271,20 +278,20 @@ function writeEnvFile(outputPath, authType, token, refreshToken, serviceUrl, uaa
     if (authType === 'abap') {
         // ABAP format
         if (serviceUrl) {
-            lines.push(`${auth_stores_2.ABAP_CONNECTION_VARS.SERVICE_URL}=${serviceUrl}`);
+            lines.push(`${auth_stores_1.ABAP_CONNECTION_VARS.SERVICE_URL}=${serviceUrl}`);
         }
-        lines.push(`${auth_stores_2.ABAP_CONNECTION_VARS.AUTHORIZATION_TOKEN}=${token}`);
+        lines.push(`${auth_stores_1.ABAP_CONNECTION_VARS.AUTHORIZATION_TOKEN}=${token}`);
         if (refreshToken) {
-            lines.push(`${auth_stores_2.ABAP_AUTHORIZATION_VARS.REFRESH_TOKEN}=${refreshToken}`);
+            lines.push(`${auth_stores_1.ABAP_AUTHORIZATION_VARS.REFRESH_TOKEN}=${refreshToken}`);
         }
         if (uaaUrl) {
-            lines.push(`${auth_stores_2.ABAP_AUTHORIZATION_VARS.UAA_URL}=${uaaUrl}`);
+            lines.push(`${auth_stores_1.ABAP_AUTHORIZATION_VARS.UAA_URL}=${uaaUrl}`);
         }
         if (uaaClientId) {
-            lines.push(`${auth_stores_2.ABAP_AUTHORIZATION_VARS.UAA_CLIENT_ID}=${uaaClientId}`);
+            lines.push(`${auth_stores_1.ABAP_AUTHORIZATION_VARS.UAA_CLIENT_ID}=${uaaClientId}`);
         }
         if (uaaClientSecret) {
-            lines.push(`${auth_stores_2.ABAP_AUTHORIZATION_VARS.UAA_CLIENT_SECRET}=${uaaClientSecret}`);
+            lines.push(`${auth_stores_1.ABAP_AUTHORIZATION_VARS.UAA_CLIENT_SECRET}=${uaaClientSecret}`);
         }
     }
     else {
@@ -292,18 +299,18 @@ function writeEnvFile(outputPath, authType, token, refreshToken, serviceUrl, uaa
         if (serviceUrl) {
             lines.push(`XSUAA_MCP_URL=${serviceUrl}`);
         }
-        lines.push(`${auth_stores_2.XSUAA_CONNECTION_VARS.AUTHORIZATION_TOKEN}=${token}`);
+        lines.push(`${auth_stores_1.XSUAA_CONNECTION_VARS.AUTHORIZATION_TOKEN}=${token}`);
         if (refreshToken) {
-            lines.push(`${auth_stores_2.XSUAA_AUTHORIZATION_VARS.REFRESH_TOKEN}=${refreshToken}`);
+            lines.push(`${auth_stores_1.XSUAA_AUTHORIZATION_VARS.REFRESH_TOKEN}=${refreshToken}`);
         }
         if (uaaUrl) {
-            lines.push(`${auth_stores_2.XSUAA_AUTHORIZATION_VARS.UAA_URL}=${uaaUrl}`);
+            lines.push(`${auth_stores_1.XSUAA_AUTHORIZATION_VARS.UAA_URL}=${uaaUrl}`);
         }
         if (uaaClientId) {
-            lines.push(`${auth_stores_2.XSUAA_AUTHORIZATION_VARS.UAA_CLIENT_ID}=${uaaClientId}`);
+            lines.push(`${auth_stores_1.XSUAA_AUTHORIZATION_VARS.UAA_CLIENT_ID}=${uaaClientId}`);
         }
         if (uaaClientSecret) {
-            lines.push(`${auth_stores_2.XSUAA_AUTHORIZATION_VARS.UAA_CLIENT_SECRET}=${uaaClientSecret}`);
+            lines.push(`${auth_stores_1.XSUAA_AUTHORIZATION_VARS.UAA_CLIENT_SECRET}=${uaaClientSecret}`);
         }
     }
     // Ensure output directory exists
@@ -481,7 +488,8 @@ async function main() {
         let serviceKeyAuthConfig = null;
         if (serviceKeyStore?.getAuthorizationConfig) {
             try {
-                serviceKeyAuthConfig = await serviceKeyStore.getAuthorizationConfig(destination);
+                serviceKeyAuthConfig =
+                    await serviceKeyStore.getAuthorizationConfig(destination);
             }
             catch (e) {
                 // Service key parsing might fail - try fallback parsing from raw JSON
@@ -554,20 +562,20 @@ async function main() {
             console.log(`📋 .env file contains:`);
             if (options.authType === 'abap') {
                 if (finalServiceUrl) {
-                    console.log(`   - ${auth_stores_2.ABAP_CONNECTION_VARS.SERVICE_URL}=${finalServiceUrl}`);
+                    console.log(`   - ${auth_stores_1.ABAP_CONNECTION_VARS.SERVICE_URL}=${finalServiceUrl}`);
                 }
-                console.log(`   - ${auth_stores_2.ABAP_CONNECTION_VARS.AUTHORIZATION_TOKEN}=${token.substring(0, 50)}...`);
+                console.log(`   - ${auth_stores_1.ABAP_CONNECTION_VARS.AUTHORIZATION_TOKEN}=${token.substring(0, 50)}...`);
                 if (authConfig?.refreshToken) {
-                    console.log(`   - ${auth_stores_2.ABAP_AUTHORIZATION_VARS.REFRESH_TOKEN}=${authConfig.refreshToken.substring(0, 50)}...`);
+                    console.log(`   - ${auth_stores_1.ABAP_AUTHORIZATION_VARS.REFRESH_TOKEN}=${authConfig.refreshToken.substring(0, 50)}...`);
                 }
             }
             else {
                 if (finalServiceUrl) {
                     console.log(`   - XSUAA_MCP_URL=${finalServiceUrl}`);
                 }
-                console.log(`   - ${auth_stores_2.XSUAA_CONNECTION_VARS.AUTHORIZATION_TOKEN}=${token.substring(0, 50)}...`);
+                console.log(`   - ${auth_stores_1.XSUAA_CONNECTION_VARS.AUTHORIZATION_TOKEN}=${token.substring(0, 50)}...`);
                 if (authConfig?.refreshToken) {
-                    console.log(`   - ${auth_stores_2.XSUAA_AUTHORIZATION_VARS.REFRESH_TOKEN}=${authConfig.refreshToken.substring(0, 50)}...`);
+                    console.log(`   - ${auth_stores_1.XSUAA_AUTHORIZATION_VARS.REFRESH_TOKEN}=${authConfig.refreshToken.substring(0, 50)}...`);
                 }
             }
         }

package/dist/bin/mcp-sso.js

@@ -0,0 +1,817 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * MCP SSO - Get tokens via SSO providers and generate .env files
+ *
+ * Usage:
+ *   mcp-sso --protocol <oidc|saml2> --flow <flow> --output <path> [options]
+ *
+ * Examples:
+ *   # OIDC browser flow (authorization code with local callback)
+ *   mcp-sso --protocol oidc --flow browser --issuer https://issuer --client-id my-client --output ./sso.env --type xsuaa
+ *
+ *   # OIDC device flow
+ *   mcp-sso --protocol oidc --flow device --issuer https://issuer --client-id my-client --output ./sso.env --type xsuaa
+ *
+ *   # OIDC password flow (passcode)
+ *   mcp-sso --protocol oidc --flow password --token-endpoint https://uaa.example/oauth/token --client-id cf --passcode <code> --output ./sso.env --type xsuaa
+ *
+ *   # OIDC token exchange
+ *   mcp-sso --protocol oidc --flow token_exchange --issuer https://issuer --client-id my-client --subject-token <token> --output ./sso.env --type xsuaa
+ *
+ *   # SAML bearer flow
+ *   mcp-sso --protocol saml2 --flow bearer --idp-sso-url https://idp/sso --sp-entity-id my-sp --token-endpoint https://uaa.example/oauth/token --assertion <base64> --output ./sso.env --type xsuaa
+ *
+ *   # SAML pure flow (cookie)
+ *   mcp-sso --protocol saml2 --flow pure --idp-sso-url https://idp/sso --sp-entity-id my-sp --assertion <base64> --cookie "SAP_SESSION=..." --output ./sso.env --type abap
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_readline_1 = require("node:readline");
+const axios_1 = __importDefault(require("axios"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+// Use require for CommonJS dist files with absolute path
+const distPath = path.resolve(__dirname, '..', 'index.js');
+const { AuthBroker } = require(distPath);
+const auth_providers_1 = require("@mcp-abap-adt/auth-providers");
+const auth_stores_1 = require("@mcp-abap-adt/auth-stores");
+function getVersion() {
+    try {
+        const candidates = [
+            path.join(__dirname, 'package.json'),
+            path.join(__dirname, '..', 'package.json'),
+            path.join(__dirname, '..', '..', 'package.json'),
+        ];
+        for (const candidate of candidates) {
+            if (fs.existsSync(candidate)) {
+                const packageJson = JSON.parse(fs.readFileSync(candidate, 'utf8'));
+                return packageJson.version || 'unknown';
+            }
+        }
+        const localRequire = require('module').createRequire(__filename);
+        const resolved = localRequire.resolve('@mcp-abap-adt/auth-broker/package.json');
+        const packageJson = JSON.parse(fs.readFileSync(resolved, 'utf8'));
+        return packageJson.version || 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+function showHelp() {
+    console.log('MCP SSO - Get tokens via SSO providers and generate .env files');
+    console.log('');
+    console.log('Usage:');
+    console.log('  mcp-sso --protocol <oidc|saml2> --flow <flow> --output <path> [options]');
+    console.log('');
+    console.log('Required Options:');
+    console.log('  --output <path>           Output file path');
+    console.log('  --protocol <oidc|saml2>   Protocol');
+    console.log('  --flow <flow>             Flow for protocol');
+    console.log('');
+    console.log('Common Options:');
+    console.log('  --type <abap|xsuaa>       Output type (default: abap)');
+    console.log('  --format <env|json>       Output format (default: env)');
+    console.log('  --env <path>              Optional existing env file (used for refresh)');
+    console.log('  --destination <name>      Destination name (default: output file base)');
+    console.log('  --service-url <url>       Service URL (ABAP: SAP URL, XSUAA: MCP URL)');
+    console.log('  --config <path>           JSON config file (SSO provider config)');
+    console.log('  --browser <browser>       Browser: auto|none|system|chrome|edge|firefox');
+    console.log('  --redirect-port <port>    Redirect port for browser flows (default: 3001)');
+    console.log('  --redirect-uri <uri>      Custom redirect URI (OOB/manual code flows)');
+    console.log('');
+    console.log('OIDC Options:');
+    console.log('  --issuer <url>            OIDC issuer/discovery URL');
+    console.log('  --authorization-endpoint <url>  Authorization endpoint');
+    console.log('  --token-endpoint <url>    Token endpoint');
+    console.log('  --device-authorization-endpoint <url>  Device auth endpoint');
+    console.log('  --client-id <id>          OAuth client id');
+    console.log('  --client-secret <secret>  OAuth client secret');
+    console.log('  --scopes <csv>            Scopes list (comma or space-separated)');
+    console.log('  --scope <value>           Scope for token exchange');
+    console.log('  --code <value>            Authorization code (manual)');
+    console.log('  --username <value>        Username for password flow');
+    console.log('  --password <value>        Password for password flow');
+    console.log('  --passcode <value>        Passcode (alias for password, username=passcode)');
+    console.log('  --subject-token <token>   Subject token for token exchange');
+    console.log('  --subject-token-type <type> Subject token type (default: access_token)');
+    console.log('  --audience <value>        Audience for token exchange');
+    console.log('  --actor-token <token>     Actor token for token exchange');
+    console.log('  --actor-token-type <type> Actor token type for token exchange');
+    console.log('  --uaa-url <url>           UAA base URL (used to build token endpoint)');
+    console.log('  --cf-api <url>            CF API URL (resolve login/uaa endpoints)');
+    console.log('');
+    console.log('SAML Options:');
+    console.log('  --idp-sso-url <url>        IdP SSO URL');
+    console.log('  --sp-entity-id <id>        SP Entity ID');
+    console.log('  --acs-url <url>            ACS URL (default: http://localhost:<port>/callback)');
+    console.log('  --relay-state <value>      RelayState (optional)');
+    console.log('  --assertion-flow <flow>    browser|manual|assertion (default: browser)');
+    console.log('  --assertion <base64>       SAMLResponse (base64)');
+    console.log('  --cookie <value>           Session cookies (for pure SAML)');
+    console.log('  --token-endpoint <url>     Token endpoint for SAML bearer exchange');
+    console.log('');
+    console.log('  --version, -v              Show version number');
+    console.log('  --help, -h                 Show this help message');
+}
+function parseScopes(value) {
+    if (!value)
+        return undefined;
+    const parts = value
+        .split(/[,\s]+/)
+        .map((p) => p.trim())
+        .filter(Boolean);
+    return parts.length > 0 ? parts : undefined;
+}
+function readManualInput(prompt) {
+    const rl = (0, node_readline_1.createInterface)({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    return new Promise((resolve) => {
+        rl.question(prompt, (answer) => {
+            rl.close();
+            resolve(answer.trim());
+        });
+    });
+}
+function parseArgs() {
+    const args = process.argv.slice(2);
+    if (args.length === 0 || args.includes('--help') || args.includes('-h')) {
+        showHelp();
+        process.exit(0);
+    }
+    if (args.includes('--version') || args.includes('-v')) {
+        console.log(getVersion());
+        process.exit(0);
+    }
+    let outputFile;
+    let envFilePath;
+    let destination;
+    let authType = 'abap';
+    let format = 'env';
+    let protocol;
+    let flow;
+    let configPath;
+    let serviceUrl;
+    let browser;
+    let redirectPort;
+    let redirectUri;
+    let issuerUrl;
+    let authorizationEndpoint;
+    let tokenEndpoint;
+    let deviceAuthorizationEndpoint;
+    let clientId;
+    let clientSecret;
+    let scopes;
+    let scope;
+    let code;
+    let username;
+    let password;
+    let passcode;
+    let subjectToken;
+    let subjectTokenType;
+    let audience;
+    let actorToken;
+    let actorTokenType;
+    let idpSsoUrl;
+    let spEntityId;
+    let acsUrl;
+    let relayState;
+    let assertionFlow;
+    let assertion;
+    let cookie;
+    let uaaUrl;
+    let cfApi;
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        const next = i + 1 < args.length ? args[i + 1] : undefined;
+        switch (arg) {
+            case '--output':
+                outputFile = next;
+                i++;
+                break;
+            case '--env':
+                envFilePath = next;
+                i++;
+                break;
+            case '--destination':
+                destination = next;
+                i++;
+                break;
+            case '--type':
+                if (next === 'abap' || next === 'xsuaa') {
+                    authType = next;
+                }
+                else {
+                    console.error(`Invalid type: ${next}. Use abap or xsuaa.`);
+                    process.exit(1);
+                }
+                i++;
+                break;
+            case '--format':
+                if (next === 'env' || next === 'json') {
+                    format = next;
+                }
+                else {
+                    console.error(`Invalid format: ${next}. Use env or json.`);
+                    process.exit(1);
+                }
+                i++;
+                break;
+            case '--protocol':
+                if (next === 'oidc' || next === 'saml2') {
+                    protocol = next;
+                }
+                else {
+                    console.error(`Invalid protocol: ${next}. Use oidc or saml2.`);
+                    process.exit(1);
+                }
+                i++;
+                break;
+            case '--flow':
+                flow = next;
+                i++;
+                break;
+            case '--config':
+                configPath = next;
+                i++;
+                break;
+            case '--service-url':
+                serviceUrl = next;
+                i++;
+                break;
+            case '--browser':
+                browser = next;
+                i++;
+                break;
+            case '--redirect-port':
+                if (!next)
+                    break;
+                redirectPort = parseInt(next, 10);
+                if (Number.isNaN(redirectPort) ||
+                    redirectPort < 1 ||
+                    redirectPort > 65535) {
+                    console.error(`Invalid redirect port: ${next}`);
+                    process.exit(1);
+                }
+                i++;
+                break;
+            case '--redirect-uri':
+                redirectUri = next;
+                i++;
+                break;
+            case '--issuer':
+                issuerUrl = next;
+                i++;
+                break;
+            case '--authorization-endpoint':
+                authorizationEndpoint = next;
+                i++;
+                break;
+            case '--token-endpoint':
+                tokenEndpoint = next;
+                i++;
+                break;
+            case '--device-authorization-endpoint':
+                deviceAuthorizationEndpoint = next;
+                i++;
+                break;
+            case '--client-id':
+                clientId = next;
+                i++;
+                break;
+            case '--client-secret':
+                clientSecret = next;
+                i++;
+                break;
+            case '--scopes':
+                scopes = parseScopes(next);
+                i++;
+                break;
+            case '--scope':
+                scope = next;
+                i++;
+                break;
+            case '--code':
+                code = next;
+                i++;
+                break;
+            case '--username':
+                username = next;
+                i++;
+                break;
+            case '--password':
+                password = next;
+                i++;
+                break;
+            case '--passcode':
+                passcode = next;
+                i++;
+                break;
+            case '--subject-token':
+                subjectToken = next;
+                i++;
+                break;
+            case '--subject-token-type':
+                subjectTokenType = next;
+                i++;
+                break;
+            case '--audience':
+                audience = next;
+                i++;
+                break;
+            case '--actor-token':
+                actorToken = next;
+                i++;
+                break;
+            case '--actor-token-type':
+                actorTokenType = next;
+                i++;
+                break;
+            case '--idp-sso-url':
+                idpSsoUrl = next;
+                i++;
+                break;
+            case '--sp-entity-id':
+                spEntityId = next;
+                i++;
+                break;
+            case '--acs-url':
+                acsUrl = next;
+                i++;
+                break;
+            case '--relay-state':
+                relayState = next;
+                i++;
+                break;
+            case '--assertion-flow':
+                if (next === 'browser' || next === 'manual' || next === 'assertion') {
+                    assertionFlow = next;
+                }
+                else {
+                    console.error(`Invalid assertion flow: ${next}. Use browser, manual, or assertion.`);
+                    process.exit(1);
+                }
+                i++;
+                break;
+            case '--assertion':
+                assertion = next;
+                i++;
+                break;
+            case '--cookie':
+                cookie = next;
+                i++;
+                break;
+            case '--uaa-url':
+                uaaUrl = next;
+                i++;
+                break;
+            case '--cf-api':
+                cfApi = next;
+                i++;
+                break;
+            default:
+                break;
+        }
+    }
+    return {
+        outputFile,
+        envFilePath,
+        destination,
+        authType,
+        format,
+        protocol,
+        flow: flow,
+        configPath,
+        serviceUrl,
+        browser,
+        redirectPort,
+        redirectUri,
+        issuerUrl,
+        authorizationEndpoint,
+        tokenEndpoint,
+        deviceAuthorizationEndpoint,
+        clientId,
+        clientSecret,
+        scopes,
+        scope,
+        code,
+        username,
+        password,
+        passcode,
+        subjectToken,
+        subjectTokenType,
+        audience,
+        actorToken,
+        actorTokenType,
+        idpSsoUrl,
+        spEntityId,
+        acsUrl,
+        relayState,
+        assertionFlow,
+        assertion,
+        cookie,
+        uaaUrl,
+        cfApi,
+    };
+}
+function normalizeProviderConfig(raw) {
+    if (!raw || typeof raw !== 'object') {
+        return null;
+    }
+    if (raw.provider) {
+        return raw.provider;
+    }
+    if (raw.protocol && raw.flow) {
+        const { protocol, flow, config, ...rest } = raw;
+        return {
+            protocol,
+            flow,
+            config: config ?? rest,
+        };
+    }
+    return null;
+}
+function mergeConfig(target, source) {
+    const result = { ...target };
+    for (const [key, value] of Object.entries(source)) {
+        if (value !== undefined) {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+function buildOidcConfig(options) {
+    const scopeList = options.scopes;
+    const tokenEndpoint = options.tokenEndpoint ||
+        (options.uaaUrl
+            ? `${options.uaaUrl.replace(/\/+$/, '')}/oauth/token`
+            : undefined);
+    const passcode = options.passcode;
+    const username = options.username || (passcode ? 'passcode' : undefined);
+    const password = options.password || passcode;
+    return {
+        issuerUrl: options.issuerUrl,
+        authorizationEndpoint: options.authorizationEndpoint,
+        tokenEndpoint,
+        deviceAuthorizationEndpoint: options.deviceAuthorizationEndpoint,
+        clientId: options.clientId,
+        clientSecret: options.clientSecret,
+        scopes: scopeList,
+        scope: options.scope,
+        authorizationCode: options.code,
+        username,
+        password,
+        subjectToken: options.subjectToken,
+        subjectTokenType: options.subjectTokenType ||
+            'urn:ietf:params:oauth:token-type:access_token',
+        audience: options.audience,
+        actorToken: options.actorToken,
+        actorTokenType: options.actorTokenType,
+        browser: options.browser,
+        redirectPort: options.redirectPort,
+        redirectUri: options.redirectUri,
+    };
+}
+function buildSamlConfig(options) {
+    const assertionFlow = options.assertionFlow || (options.assertion ? 'assertion' : 'browser');
+    const tokenUrl = options.tokenEndpoint ||
+        (options.uaaUrl
+            ? `${options.uaaUrl.replace(/\/+$/, '')}/oauth/token`
+            : undefined);
+    const assertionProvider = options.assertion
+        ? async () => options.assertion
+        : assertionFlow === 'assertion'
+            ? async () => readManualInput('Paste SAMLResponse: ')
+            : undefined;
+    const cookieProvider = async () => {
+        if (options.cookie) {
+            return options.cookie;
+        }
+        return readManualInput('Paste session cookies: ');
+    };
+    return {
+        idpSsoUrl: options.idpSsoUrl,
+        spEntityId: options.spEntityId,
+        acsUrl: options.acsUrl,
+        relayState: options.relayState,
+        assertionFlow,
+        assertionProvider,
+        tokenUrl,
+        uaaUrl: options.uaaUrl,
+        clientId: options.clientId,
+        clientSecret: options.clientSecret,
+        browser: options.browser,
+        redirectPort: options.redirectPort,
+        cookieProvider,
+    };
+}
+function buildProviderConfig(options, existingAuth, existingConn, fileConfig) {
+    let configFromCli = null;
+    if (options.protocol && options.flow) {
+        if (options.protocol === 'oidc') {
+            switch (options.flow) {
+                case 'browser':
+                    configFromCli = {
+                        protocol: 'oidc',
+                        flow: 'browser',
+                        config: buildOidcConfig(options),
+                    };
+                    break;
+                case 'device':
+                    configFromCli = {
+                        protocol: 'oidc',
+                        flow: 'device',
+                        config: buildOidcConfig(options),
+                    };
+                    break;
+                case 'password':
+                    configFromCli = {
+                        protocol: 'oidc',
+                        flow: 'password',
+                        config: buildOidcConfig(options),
+                    };
+                    break;
+                case 'token_exchange':
+                    configFromCli = {
+                        protocol: 'oidc',
+                        flow: 'token_exchange',
+                        config: buildOidcConfig(options),
+                    };
+                    break;
+                default:
+                    throw new Error(`Unsupported OIDC flow: ${options.flow}`);
+            }
+        }
+        else if (options.protocol === 'saml2') {
+            switch (options.flow) {
+                case 'bearer':
+                    configFromCli = {
+                        protocol: 'saml2',
+                        flow: 'bearer',
+                        config: buildSamlConfig(options),
+                    };
+                    break;
+                case 'pure':
+                    configFromCli = {
+                        protocol: 'saml2',
+                        flow: 'pure',
+                        config: buildSamlConfig(options),
+                    };
+                    break;
+                default:
+                    throw new Error(`Unsupported SAML flow: ${options.flow}`);
+            }
+        }
+    }
+    const base = fileConfig ?? configFromCli;
+    if (!base) {
+        throw new Error('Provider config is missing. Use --config or --protocol/--flow options.');
+    }
+    let result = base;
+    if (options.protocol) {
+        result = { ...result, protocol: options.protocol };
+    }
+    if (options.flow) {
+        result = { ...result, flow: options.flow };
+    }
+    if (configFromCli) {
+        result = {
+            ...result,
+            config: mergeConfig(result.config || {}, configFromCli.config || {}),
+        };
+    }
+    const accessToken = existingConn?.authorizationToken;
+    const refreshToken = existingAuth?.refreshToken;
+    if ((result.protocol === 'oidc' ||
+        (result.protocol === 'saml2' && result.flow === 'bearer')) &&
+        (accessToken || refreshToken)) {
+        result = {
+            ...result,
+            config: mergeConfig(result.config || {}, {
+                accessToken,
+                refreshToken,
+            }),
+        };
+    }
+    return result;
+}
+async function resolveCfEndpoints(apiUrl) {
+    const response = await axios_1.default.get(apiUrl);
+    const data = response.data;
+    const loginUrl = data?.links?.login?.href;
+    const uaaUrl = data?.links?.uaa?.href;
+    return { loginUrl, uaaUrl };
+}
+async function main() {
+    const options = parseArgs();
+    if (!options) {
+        return;
+    }
+    if (!options.outputFile) {
+        console.error('❌ Missing required --output');
+        process.exit(1);
+    }
+    const resolvedOutputPath = path.resolve(options.outputFile);
+    const resolvedEnvPath = options.envFilePath
+        ? path.resolve(options.envFilePath)
+        : undefined;
+    let destination = options.destination;
+    if (!destination) {
+        destination = path.basename(resolvedOutputPath, path.extname(resolvedOutputPath));
+    }
+    if (resolvedEnvPath) {
+        const envName = path.basename(resolvedEnvPath, path.extname(resolvedEnvPath));
+        if (destination && envName !== destination) {
+            console.error(`❌ Destination mismatch: env file (${envName}) vs output (${destination})`);
+            process.exit(1);
+        }
+    }
+    let providerConfigFromFile = null;
+    if (options.configPath) {
+        const resolvedConfigPath = path.resolve(options.configPath);
+        if (!fs.existsSync(resolvedConfigPath)) {
+            console.error(`❌ Config file not found: ${resolvedConfigPath}`);
+            process.exit(1);
+        }
+        const raw = JSON.parse(fs.readFileSync(resolvedConfigPath, 'utf8'));
+        providerConfigFromFile = normalizeProviderConfig(raw);
+        if (!providerConfigFromFile) {
+            console.error(`❌ Config file does not contain provider config`);
+            process.exit(1);
+        }
+    }
+    if (options.cfApi) {
+        const cfInfo = await resolveCfEndpoints(options.cfApi);
+        if (cfInfo.uaaUrl && !options.uaaUrl) {
+            options.uaaUrl = cfInfo.uaaUrl;
+        }
+        if (cfInfo.loginUrl) {
+            console.log(`🔗 CF passcode URL: ${cfInfo.loginUrl.replace(/\/+$/, '')}/passcode`);
+        }
+    }
+    if (options.protocol === 'oidc' && options.flow) {
+        const valid = ['browser', 'device', 'password', 'token_exchange'];
+        if (!valid.includes(options.flow)) {
+            console.error(`❌ Invalid OIDC flow: ${options.flow}. Use one of: ${valid.join(', ')}`);
+            process.exit(1);
+        }
+    }
+    if (options.protocol === 'saml2' && options.flow) {
+        const valid = ['bearer', 'pure'];
+        if (!valid.includes(options.flow)) {
+            console.error(`❌ Invalid SAML flow: ${options.flow}. Use one of: ${valid.join(', ')}`);
+            process.exit(1);
+        }
+    }
+    if (options.protocol === 'oidc' && options.flow === 'password') {
+        if (!options.passcode && !options.password) {
+            options.passcode = await readManualInput('Paste passcode: ');
+        }
+    }
+    const tempSessionDir = path.join(path.dirname(resolvedOutputPath), '.tmp');
+    if (!fs.existsSync(tempSessionDir)) {
+        fs.mkdirSync(tempSessionDir, { recursive: true });
+    }
+    if (resolvedEnvPath && fs.existsSync(resolvedEnvPath)) {
+        const tempEnvPath = path.join(tempSessionDir, `${destination}.env`);
+        fs.copyFileSync(resolvedEnvPath, tempEnvPath);
+    }
+    const defaultServiceUrl = options.serviceUrl || '';
+    const sessionStore = options.authType === 'xsuaa'
+        ? new auth_stores_1.XsuaaSessionStore(tempSessionDir, defaultServiceUrl)
+        : new auth_stores_1.AbapSessionStore(tempSessionDir);
+    const existingConn = await sessionStore.getConnectionConfig(destination);
+    const existingAuth = await sessionStore.getAuthorizationConfig(destination);
+    const serviceUrl = options.serviceUrl || existingConn?.serviceUrl;
+    if (options.authType === 'abap' && !serviceUrl) {
+        console.error('❌ ABAP requires --service-url or existing env with SAP URL');
+        process.exit(1);
+    }
+    if (options.protocol === 'saml2' &&
+        options.flow === 'pure' &&
+        options.authType === 'xsuaa') {
+        console.error('❌ SAML pure flow is only supported for ABAP sessions (cookies)');
+        process.exit(1);
+    }
+    await sessionStore.setConnectionConfig(destination, {
+        serviceUrl: serviceUrl ||
+            (options.authType === 'xsuaa' ? defaultServiceUrl : undefined),
+        authorizationToken: existingConn?.authorizationToken,
+        sessionCookies: existingConn?.sessionCookies,
+    });
+    const providerConfig = buildProviderConfig(options, existingAuth, existingConn, providerConfigFromFile);
+    const tokenProvider = auth_providers_1.SsoProviderFactory.create(providerConfig);
+    const broker = new AuthBroker({
+        sessionStore,
+        tokenProvider,
+    }, options.browser);
+    console.log(`🔐 Getting token for destination "${destination}"...`);
+    await broker.getToken(destination);
+    console.log(`✅ Token obtained successfully`);
+    const connConfig = await sessionStore.getConnectionConfig(destination);
+    const authConfig = await sessionStore.getAuthorizationConfig(destination);
+    if (!connConfig) {
+        throw new Error('Connection config not found after authentication');
+    }
+    const isSaml = !!connConfig.sessionCookies && !connConfig.authorizationToken;
+    const token = isSaml
+        ? connConfig.sessionCookies
+        : connConfig.authorizationToken;
+    if (!token) {
+        throw new Error('Token provider did not return authorization token');
+    }
+    if (options.format === 'env') {
+        const tempEnvPath = path.join(tempSessionDir, `${destination}.env`);
+        if (!fs.existsSync(tempEnvPath)) {
+            throw new Error(`Temp env file not found: ${tempEnvPath}`);
+        }
+        const outputDir = path.dirname(resolvedOutputPath);
+        if (!fs.existsSync(outputDir)) {
+            fs.mkdirSync(outputDir, { recursive: true });
+        }
+        fs.copyFileSync(tempEnvPath, resolvedOutputPath);
+        console.log(`✅ .env file created: ${resolvedOutputPath}`);
+    }
+    else {
+        const outputData = {
+            tokenType: isSaml ? 'saml' : 'jwt',
+        };
+        if (isSaml) {
+            outputData.sessionCookies = token;
+        }
+        else {
+            outputData.accessToken = token;
+        }
+        if (authConfig?.refreshToken) {
+            outputData.refreshToken = authConfig.refreshToken;
+        }
+        if (serviceUrl) {
+            outputData.serviceUrl = serviceUrl;
+        }
+        if (authConfig?.uaaUrl) {
+            outputData.uaaUrl = authConfig.uaaUrl;
+        }
+        if (authConfig?.uaaClientId) {
+            outputData.uaaClientId = authConfig.uaaClientId;
+        }
+        if (authConfig?.uaaClientSecret) {
+            outputData.uaaClientSecret = authConfig.uaaClientSecret;
+        }
+        const outputDir = path.dirname(resolvedOutputPath);
+        if (!fs.existsSync(outputDir)) {
+            fs.mkdirSync(outputDir, { recursive: true });
+        }
+        fs.writeFileSync(resolvedOutputPath, JSON.stringify(outputData, null, 2), 'utf8');
+        console.log(`✅ JSON file created: ${resolvedOutputPath}`);
+    }
+    try {
+        fs.rmSync(tempSessionDir, { recursive: true, force: true });
+    }
+    catch {
+        // ignore cleanup errors
+    }
+}
+main().catch((error) => {
+    console.error(`❌ Error: ${error.message}`);
+    if (error.stack) {
+        console.error(error.stack);
+    }
+    process.exit(1);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/auth-broker",
-  "version": "1.0.0",
+  "version": "1.0.3",
   "description": "JWT authentication broker for MCP ABAP ADT - manages tokens based on destination headers",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -50,25 +50,26 @@
     "generate-env": "tsx bin/generate-env-from-service-key.ts"
   },
   "bin": {
-    "mcp-auth": "./dist/bin/mcp-auth.js"
+    "mcp-auth": "./dist/bin/mcp-auth.js",
+    "mcp-sso": "./dist/bin/mcp-sso.js"
   },
   "engines": {
     "node": ">=18.0.0"
   },
   "dependencies": {
-    "@mcp-abap-adt/auth-providers": "^1.0.0",
-    "@mcp-abap-adt/auth-stores": "^1.0.0",
+    "@mcp-abap-adt/auth-providers": "^1.0.2",
+    "@mcp-abap-adt/auth-stores": "^1.0.1",
     "@mcp-abap-adt/interfaces": "^2.3.0",
-    "axios": "^1.13.4",
+    "axios": "^1.13.5",
     "tsx": "^4.21.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.3.13",
+    "@biomejs/biome": "^2.3.14",
     "@mcp-abap-adt/logger": "^0.1.4",
     "@types/express": "^5.0.5",
     "@types/jest": "^30.0.0",
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^24.2.1",
+    "@types/node": "^25.2.3",
     "jest": "^30.2.0",
     "jest-util": "^30.2.0",
     "js-yaml": "^4.1.1",