@mcp-abap-adt/auth-broker 1.0.3 → 1.0.6

package/CHANGELOG.md

@@ -11,6 +11,31 @@ Thank you to all contributors! See [CONTRIBUTORS.md](CONTRIBUTORS.md) for the co
 
 ## [Unreleased]
 
+## [1.0.6] - 2026-06-02
+
+### Fixed
+- `getToken`: no longer retries via the `serviceKey` strategy after the `session` strategy fails with an *interactive* browser-login error (timeout / `BROWSER_AUTH_ERROR`). Both strategies call the same `tokenProvider.getTokens()`, so the retry could not succeed and merely started a duplicate browser login on the same redirect port — surfacing a misleading `Port <n> is already in use` instead of the real cause. Transient/non-interactive session failures still fall through to the `serviceKey` attempt.
+
+## [1.0.5] - 2026-02-12
+
+### Added
+- `mcp-auth` subcommands: `auth-code`, `oidc`, `saml2-pure`, `saml2-bearer` (delegates to `mcp-sso`).
+- `mcp-auth saml2-bearer` requires `--dev` and warns otherwise (in progress).
+- `mcp-sso` subcommands: `oidc`, `saml2`, `bearer`.
+- `mcp-sso`: `--saml-metadata` to resolve XSUAA token alias endpoint from SP metadata.
+- `tests/sso-demo`: service key helper script with `--service/--key/--out` overrides.
+
+### Changed
+- `mcp-sso`: allow `--token-endpoint` with `--service-key` for SAML bearer.
+- Docs and test scripts updated for new subcommands.
+- Bumped `@mcp-abap-adt/auth-providers` to `^1.0.5`.
+
+## [1.0.4] - 2026-02-11
+
+### Fixed
+- `mcp-sso`: ensure auth config is seeded for broker and avoid writing placeholder secrets.
+
+
 ## [1.0.3] - 2026-02-11
 
 ### Fixed

package/README.md

@@ -1,4 +1,5 @@
 # @mcp-abap-adt/auth-broker
+[![Stand With Ukraine](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/badges/StandWithUkraine.svg)](https://stand-with-ukraine.pp.ua)
 
 JWT authentication broker for MCP ABAP ADT server. Manages authentication tokens based on destination headers, automatically loading tokens from `.env` files and refreshing them using service keys when needed.
 
@@ -644,6 +645,7 @@ const btpBrokerFull = new AuthBroker({
 Generate or refresh `.env`/JSON output using AuthBroker + stores:
 
 ```bash
+mcp-auth <auth-code|oidc|saml2-pure|saml2-bearer> [options]
 mcp-auth --service-key <path> --output <path> [--env <path>] [--type abap|xsuaa] [--credential] [--browser auto|none|system|chrome|edge|firefox] [--format json|env]
 ```
 
@@ -660,6 +662,18 @@ mcp-auth --service-key <path> --output <path> [--env <path>] [--type abap|xsuaa]
 
 **Examples:**
 ```bash
+# Auth code (default via service key)
+mcp-auth auth-code --service-key ./abap.json --output ./abap.env --type abap
+
+# OIDC SSO (device flow example)
+mcp-auth oidc --flow device --issuer https://issuer --client-id my-client --output ./sso.env --type xsuaa
+
+# SAML2 pure (cookie)
+mcp-auth saml2-pure --idp-sso-url https://idp/sso --sp-entity-id my-sp --output ./saml.env --type abap
+
+# SAML2 bearer (in progress, requires --dev)
+mcp-auth saml2-bearer --dev --service-key ./mcp.json --assertion <base64> --output ./sso.env --type xsuaa
+
 # ABAP: authorization_code (default, opens browser)
 mcp-auth --service-key ./abap.json --output ./abap.env --type abap
 
@@ -681,6 +695,7 @@ mcp-auth --env ./mcp.env --service-key ./mcp.json --output ./mcp.env --type xsua
 Get tokens via SSO providers (OIDC/SAML) and generate `.env`/JSON output:
 
 ```bash
+mcp-sso <oidc|saml2|bearer> [options]
 mcp-sso --protocol <oidc|saml2> --flow <flow> --output <path> [--type abap|xsuaa] [--format env|json] [--env <path>] [--config <path>]
 ```
 
@@ -691,27 +706,64 @@ mcp-sso --protocol <oidc|saml2> --flow <flow> --output <path> [--type abap|xsuaa
 **Examples:**
 ```bash
 # OIDC browser flow
-mcp-sso --protocol oidc --flow browser --issuer https://issuer --client-id my-client --output ./sso.env --type xsuaa
+mcp-sso oidc --flow browser --issuer https://issuer --client-id my-client --output ./sso.env --type xsuaa
 
 # OIDC browser flow (manual code / OOB)
-mcp-sso --protocol oidc --flow browser --token-endpoint https://issuer/token --client-id my-client --code <auth_code> --redirect-uri urn:ietf:wg:oauth:2.0:oob --output ./sso.env --type xsuaa
+mcp-sso oidc --flow browser --token-endpoint https://issuer/token --client-id my-client --code <auth_code> --redirect-uri urn:ietf:wg:oauth:2.0:oob --output ./sso.env --type xsuaa
 
 # OIDC device flow
-mcp-sso --protocol oidc --flow device --issuer https://issuer --client-id my-client --output ./sso.env --type xsuaa
+mcp-sso oidc --flow device --issuer https://issuer --client-id my-client --output ./sso.env --type xsuaa
 
-# OIDC password flow (CF passcode)
-mcp-sso --protocol oidc --flow password --cf-api https://api.cf.eu10-004.hana.ondemand.com --client-id cf --passcode <code> --output ./sso.env --type xsuaa
+# OIDC password flow
+mcp-sso oidc --flow password --token-endpoint https://issuer/oauth/token --client-id my-client --username user --password pass --output ./sso.env --type xsuaa
 
 # OIDC token exchange
-mcp-sso --protocol oidc --flow token_exchange --issuer https://issuer --client-id my-client --subject-token <token> --output ./sso.env --type xsuaa
+mcp-sso oidc --flow token_exchange --issuer https://issuer --client-id my-client --subject-token <token> --output ./sso.env --type xsuaa
 
 # SAML bearer flow (assertion -> token)
-mcp-sso --protocol saml2 --flow bearer --idp-sso-url https://idp/sso --sp-entity-id my-sp --token-endpoint https://uaa.example/oauth/token --assertion <base64> --output ./sso.env --type xsuaa
+mcp-sso bearer --idp-sso-url https://idp/sso --sp-entity-id my-sp --token-endpoint https://uaa.example/oauth/token --assertion <base64> --output ./sso.env --type xsuaa
 
 # SAML pure flow (cookie)
-mcp-sso --protocol saml2 --flow pure --idp-sso-url https://idp/sso --sp-entity-id my-sp --assertion <base64> --cookie "SAP_SESSION=..." --output ./sso.env --type abap
+mcp-sso saml2 --flow pure --idp-sso-url https://idp/sso --sp-entity-id my-sp --assertion <base64> --cookie "SAP_SESSION=..." --output ./sso.env --type abap
+```
+
+**SAML token alias (XSUAA):**
+If your IdP requires the token alias endpoint, pass SAML metadata XML:
+
+```bash
+mcp-sso bearer --saml-metadata ./saml-sp.xml --assertion <base64> --service-key ./service-key.json --output ./sso.env --type xsuaa
 ```
 
+### Local Keycloak (OIDC + SAML Tests)
+
+For local testing of `mcp-sso`, a ready-to-run Keycloak setup is included
+(OIDC browser/password/device + SAML assertion capture).
+
+```bash
+cd tests/keycloak
+docker compose up -d
+```
+
+Then use:
+```bash
+node dist/bin/mcp-sso.js \
+  oidc \
+  --flow browser \
+  --issuer http://localhost:8080/realms/mcp-sso \
+  --client-id mcp-sso-cli \
+  --scopes openid,profile,email \
+  --output /tmp/keycloak.env \
+  --type xsuaa
+```
+
+See `tests/keycloak/README.md` for device flow and SAML examples.
+
+### XSUAA Demo (CAP)
+
+A minimal CAP app for testing XSUAA flows is included at `tests/sso-demo`.
+It enables `authorization_code` and `saml2-bearer` grant types and provides a
+simple `CatalogService`. See `tests/sso-demo/readme.md` for deploy steps.
+
 **Config file:**
 You can pass a JSON file with provider config:
 

package/dist/AuthBroker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthBroker.d.ts","sourceRoot":"","sources":["../src/AuthBroker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,eAAe,EAGrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACd,MAAM,qBAAqB,CAAC;AA6C7B;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mEAAmE;IACnE,YAAY,EAAE,aAAa,CAAC;IAC5B,uEAAuE;IACvE,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC,4IAA4I;IAC5I,aAAa,EAAE,cAAc,CAAC;IAC9B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;GAEG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,MAAM,CAAU;IACxB,OAAO,CAAC,eAAe,CAA+B;IACtD,OAAO,CAAC,YAAY,CAAgB;IACpC,OAAO,CAAC,aAAa,CAAiB;IACtC,OAAO,CAAC,gBAAgB,CAAU;IAElC;;;;;;;;;;;OAWG;gBACS,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO;IAsFxE;;OAEG;YACW,eAAe;IA0D7B;;OAEG;YACW,aAAa;IAoD3B;;OAEG;YACW,oCAAoC;IA4ClD;;OAEG;YACW,kBAAkB;YAkClB,aAAa;YA0Db,kBAAkB;IAkDhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAsJpD;;;;;OAKG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IASxD;;;;OAIG;IACG,sBAAsB,CAC1B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAoEvC;;;;OAIG;IACG,mBAAmB,CACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAuEpC;;;;;;;;;;;;;;;;OAgBG;IACH,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe;CAqB3D"}
+{"version":3,"file":"AuthBroker.d.ts","sourceRoot":"","sources":["../src/AuthBroker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,eAAe,EAGrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACd,MAAM,qBAAqB,CAAC;AA8D7B;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mEAAmE;IACnE,YAAY,EAAE,aAAa,CAAC;IAC5B,uEAAuE;IACvE,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC,4IAA4I;IAC5I,aAAa,EAAE,cAAc,CAAC;IAC9B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;GAEG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,MAAM,CAAU;IACxB,OAAO,CAAC,eAAe,CAA+B;IACtD,OAAO,CAAC,YAAY,CAAgB;IACpC,OAAO,CAAC,aAAa,CAAiB;IACtC,OAAO,CAAC,gBAAgB,CAAU;IAElC;;;;;;;;;;;OAWG;gBACS,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO;IAsFxE;;OAEG;YACW,eAAe;IA0D7B;;OAEG;YACW,aAAa;IAoD3B;;OAEG;YACW,oCAAoC;IA4ClD;;OAEG;YACW,kBAAkB;YA4ClB,aAAa;YA0Db,kBAAkB;IAkDhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAsLpD;;;;;OAKG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IASxD;;;;OAIG;IACG,sBAAsB,CAC1B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAoEvC;;;;OAIG;IACG,mBAAmB,CACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAuEpC;;;;;;;;;;;;;;;;OAgBG;IACH,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe;CAqB3D"}

package/dist/AuthBroker.js

@@ -32,6 +32,20 @@ function hasErrorCode(error) {
 function getErrorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
+/**
+ * Whether an error represents a failed *interactive* browser login (the user
+ * did not complete the OAuth flow / it timed out), as opposed to a transient or
+ * configuration error. Such failures must not be retried via a second
+ * provider.getTokens() — that would start a duplicate browser login on the same
+ * redirect port and mask the real cause with a "Port in use" error.
+ */
+function isInteractiveAuthFailure(error) {
+    if (hasErrorCode(error) && error.code === 'BROWSER_AUTH_ERROR') {
+        return true;
+    }
+    const message = getErrorMessage(error);
+    return /authentication timeout|browser authentication|already in use/i.test(message);
+}
 /**
  * AuthBroker manages JWT authentication tokens for destinations
  */
@@ -244,12 +258,19 @@ class AuthBroker {
             this.logger?.error(`Failed to save connection config to session for ${destination}: ${getErrorMessage(error)}`);
             throw new Error(`Failed to save connection config for destination "${destination}": ${getErrorMessage(error)}`);
         }
-        try {
-            await this.sessionStore.setAuthorizationConfig(destination, authorizationConfig);
+        if (authorizationConfig.uaaUrl &&
+            authorizationConfig.uaaClientId &&
+            authorizationConfig.uaaClientSecret) {
+            try {
+                await this.sessionStore.setAuthorizationConfig(destination, authorizationConfig);
+            }
+            catch (error) {
+                this.logger?.error(`Failed to save authorization config to session for ${destination}: ${getErrorMessage(error)}`);
+                throw new Error(`Failed to save authorization config for destination "${destination}": ${getErrorMessage(error)}`);
+            }
         }
-        catch (error) {
-            this.logger?.error(`Failed to save authorization config to session for ${destination}: ${getErrorMessage(error)}`);
-            throw new Error(`Failed to save authorization config for destination "${destination}": ${getErrorMessage(error)}`);
+        else {
+            this.logger?.debug(`Skipping authorization config save for ${destination}: missing UAA fields`);
         }
     }
     async requestTokens(destination, sourceLabel) {
@@ -433,11 +454,31 @@ class AuthBroker {
             throw error;
         }
         if (!this.serviceKeyStore) {
+            const tokenType = this.tokenProvider?.tokenType;
+            if (tokenType === 'saml') {
+                const tokenResult = await this.requestTokens(destination, 'session');
+                await this.persistTokenResult(destination, serviceUrl, connConfig, authConfig || {}, tokenResult);
+                this.logger?.info(`[AuthBroker] Token retrieved for ${destination} (SAML without auth config)`, {
+                    authorizationToken: (0, formatting_1.formatToken)(tokenResult.authorizationToken),
+                });
+                return tokenResult.authorizationToken;
+            }
             if (lastError) {
                 throw lastError;
             }
             throw new Error(`Authorization config not found for ${destination}. Session has no auth config and serviceKeyStore is not available.`);
         }
+        // If the session attempt already performed an *interactive* browser login
+        // and it failed (the user didn't complete it / it timed out), the serviceKey
+        // strategy would call the SAME provider.getTokens() again and start a
+        // duplicate browser login on the same redirect port — surfacing a misleading
+        // "Port in use" instead of the real cause. Don't retry interactive failures;
+        // propagate the original error. Transient/non-interactive session failures
+        // still fall through to the serviceKey attempt below.
+        if (lastError && isInteractiveAuthFailure(lastError)) {
+            this.logger?.debug(`Step 2: session login failed interactively for ${destination}; not retrying via service key (${getErrorMessage(lastError)})`);
+            throw lastError;
+        }
         const serviceKeyAuthConfig = await this.getAuthorizationConfigFromServiceKey(destination);
         const tokenResult = await this.requestTokens(destination, 'serviceKey');
         await this.persistTokenResult(destination, serviceUrl, connConfig, serviceKeyAuthConfig, tokenResult);

package/dist/bin/mcp-auth.js

@@ -53,6 +53,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 // Use require for CommonJS dist files with absolute path
@@ -86,6 +87,7 @@ function showHelp() {
     console.log('MCP Auth - Get tokens and generate .env files from service keys');
     console.log('');
     console.log('Usage:');
+    console.log('  mcp-auth <auth-code|oidc|saml2-pure|saml2-bearer> [options]');
     console.log('  mcp-auth --service-key <path> --output <path> [options]');
     console.log('');
     console.log('Required Options:');
@@ -97,6 +99,7 @@ function showHelp() {
     console.log('');
     console.log('Optional Options:');
     console.log('  --type <type>           Auth type: abap or xsuaa (default: abap)');
+    console.log('  --dev                   Enable in-progress commands (saml2-bearer)');
     console.log('  --credential            Use client_credentials flow (clientId/clientSecret, no browser)');
     console.log('                          By default uses authorization_code flow');
     console.log('  --browser <browser>     Browser for authorization_code flow (default: auto):');
@@ -111,6 +114,18 @@ function showHelp() {
     console.log('  --help, -h             Show this help message');
     console.log('');
     console.log('Examples:');
+    console.log('  # Auth code (default flow via service key)');
+    console.log('  mcp-auth auth-code --service-key ./service-key.json --output ./mcp.env --type xsuaa');
+    console.log('');
+    console.log('  # OIDC SSO (device/password/browser/token-exchange)');
+    console.log('  mcp-auth oidc --flow device --issuer https://issuer --client-id my-client --output ./sso.env --type xsuaa');
+    console.log('');
+    console.log('  # SAML2 pure (cookies)');
+    console.log('  mcp-auth saml2-pure --idp-sso-url https://idp/sso --sp-entity-id my-sp --output ./saml.env --type abap');
+    console.log('');
+    console.log('  # SAML2 bearer (in progress, requires --dev)');
+    console.log('  mcp-auth saml2-bearer --dev --service-key ./service-key.json --assertion <base64> --output ./sso.env --type xsuaa');
+    console.log('');
     console.log('  # XSUAA with authorization_code (default, opens browser)');
     console.log('  mcp-auth --service-key ./service-key.json --output ./mcp.env --type xsuaa');
     console.log('');
@@ -151,8 +166,7 @@ function showHelp() {
     console.log('  - For ABAP, serviceUrl (SAP URL) is required - can be provided via --service-url or service key');
     console.log('  - SAP_URL/XSUAA_MCP_URL is written to .env (from --service-url, service key, or placeholder)');
 }
-function parseArgs() {
-    const args = process.argv.slice(2);
+function parseArgs(args = process.argv.slice(2)) {
     // Handle --version and --help first
     if (args.length === 0 || args.includes('--help') || args.includes('-h')) {
         showHelp();
@@ -348,8 +362,76 @@ function writeJsonFile(outputPath, token, refreshToken, serviceUrl, uaaUrl, uaaC
     // Write to file
     fs.writeFileSync(outputPath, JSON.stringify(outputData, null, 2), 'utf8');
 }
+function runMcpSso(args) {
+    const mcpSsoPath = path.resolve(__dirname, 'mcp-sso.js');
+    const result = (0, child_process_1.spawnSync)(process.execPath, [mcpSsoPath, ...args], {
+        stdio: 'inherit',
+    });
+    if (result.error) {
+        throw result.error;
+    }
+    process.exit(result.status ?? 1);
+}
 async function main() {
-    const options = parseArgs();
+    const rawArgs = process.argv.slice(2);
+    const subcommand = rawArgs[0];
+    const hasSubcommand = subcommand && !subcommand.startsWith('-') && subcommand.length > 0;
+    if (hasSubcommand) {
+        const remaining = rawArgs.slice(1);
+        const ensureNoProtocol = () => {
+            if (remaining.includes('--protocol')) {
+                console.error('❌ --protocol is not supported with subcommands.');
+                process.exit(1);
+            }
+        };
+        switch (subcommand) {
+            case 'auth-code': {
+                break;
+            }
+            case 'oidc': {
+                ensureNoProtocol();
+                runMcpSso(['oidc', ...remaining]);
+                return;
+            }
+            case 'saml2-pure': {
+                ensureNoProtocol();
+                if (remaining.includes('--flow')) {
+                    const idx = remaining.indexOf('--flow');
+                    const flow = remaining[idx + 1];
+                    if (flow && flow !== 'pure') {
+                        console.error('❌ saml2-pure requires --flow pure.');
+                        process.exit(1);
+                    }
+                }
+                else {
+                    remaining.unshift('pure');
+                    remaining.unshift('--flow');
+                }
+                runMcpSso(['saml2', ...remaining]);
+                return;
+            }
+            case 'saml2-bearer': {
+                ensureNoProtocol();
+                if (!remaining.includes('--dev')) {
+                    console.error('⚠️  saml2-bearer is in progress. Re-run with --dev to enable.');
+                    process.exit(1);
+                }
+                const filtered = remaining.filter((arg) => arg !== '--dev');
+                if (filtered.includes('--flow')) {
+                    console.error('❌ saml2-bearer does not accept --flow.');
+                    process.exit(1);
+                }
+                runMcpSso(['bearer', ...filtered]);
+                return;
+            }
+            default: {
+                console.error(`Unknown command: ${subcommand}`);
+                showHelp();
+                process.exit(1);
+            }
+        }
+    }
+    const options = parseArgs(hasSubcommand ? rawArgs.slice(1) : rawArgs);
     if (!options) {
         // Help or version was shown, exit already handled
         return;

package/dist/bin/mcp-sso.js

@@ -4,26 +4,27 @@
  * MCP SSO - Get tokens via SSO providers and generate .env files
  *
  * Usage:
+ *   mcp-sso <oidc|saml2|bearer> [options]
  *   mcp-sso --protocol <oidc|saml2> --flow <flow> --output <path> [options]
  *
  * Examples:
  *   # OIDC browser flow (authorization code with local callback)
- *   mcp-sso --protocol oidc --flow browser --issuer https://issuer --client-id my-client --output ./sso.env --type xsuaa
+ *   mcp-sso oidc --flow browser --issuer https://issuer --client-id my-client --output ./sso.env --type xsuaa
  *
  *   # OIDC device flow
- *   mcp-sso --protocol oidc --flow device --issuer https://issuer --client-id my-client --output ./sso.env --type xsuaa
+ *   mcp-sso oidc --flow device --issuer https://issuer --client-id my-client --output ./sso.env --type xsuaa
  *
- *   # OIDC password flow (passcode)
- *   mcp-sso --protocol oidc --flow password --token-endpoint https://uaa.example/oauth/token --client-id cf --passcode <code> --output ./sso.env --type xsuaa
+ *   # OIDC password flow
+ *   mcp-sso oidc --flow password --token-endpoint https://issuer/oauth/token --client-id my-client --username user --password pass --output ./sso.env --type xsuaa
  *
  *   # OIDC token exchange
- *   mcp-sso --protocol oidc --flow token_exchange --issuer https://issuer --client-id my-client --subject-token <token> --output ./sso.env --type xsuaa
+ *   mcp-sso oidc --flow token_exchange --issuer https://issuer --client-id my-client --subject-token <token> --output ./sso.env --type xsuaa
  *
  *   # SAML bearer flow
- *   mcp-sso --protocol saml2 --flow bearer --idp-sso-url https://idp/sso --sp-entity-id my-sp --token-endpoint https://uaa.example/oauth/token --assertion <base64> --output ./sso.env --type xsuaa
+ *   mcp-sso bearer --idp-sso-url https://idp/sso --sp-entity-id my-sp --token-endpoint https://uaa.example/oauth/token --assertion <base64> --output ./sso.env --type xsuaa
  *
  *   # SAML pure flow (cookie)
- *   mcp-sso --protocol saml2 --flow pure --idp-sso-url https://idp/sso --sp-entity-id my-sp --assertion <base64> --cookie "SAP_SESSION=..." --output ./sso.env --type abap
+ *   mcp-sso saml2 --flow pure --idp-sso-url https://idp/sso --sp-entity-id my-sp --assertion <base64> --cookie "SAP_SESSION=..." --output ./sso.env --type abap
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -58,17 +59,14 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 const node_readline_1 = require("node:readline");
-const axios_1 = __importDefault(require("axios"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 // Use require for CommonJS dist files with absolute path
 const distPath = path.resolve(__dirname, '..', 'index.js');
 const { AuthBroker } = require(distPath);
+const logger_1 = require("@mcp-abap-adt/logger");
 const auth_providers_1 = require("@mcp-abap-adt/auth-providers");
 const auth_stores_1 = require("@mcp-abap-adt/auth-stores");
 function getVersion() {
@@ -97,14 +95,16 @@ function showHelp() {
     console.log('MCP SSO - Get tokens via SSO providers and generate .env files');
     console.log('');
     console.log('Usage:');
+    console.log('  mcp-sso <oidc|saml2|bearer> [options]');
     console.log('  mcp-sso --protocol <oidc|saml2> --flow <flow> --output <path> [options]');
     console.log('');
     console.log('Required Options:');
     console.log('  --output <path>           Output file path');
-    console.log('  --protocol <oidc|saml2>   Protocol');
-    console.log('  --flow <flow>             Flow for protocol');
+    console.log('  --protocol <oidc|saml2>   Protocol (if no subcommand)');
+    console.log('  --flow <flow>             Flow for protocol (if no subcommand)');
     console.log('');
     console.log('Common Options:');
+    console.log('  --service-key <path>      Service key JSON (XSUAA/ABAP)');
     console.log('  --type <abap|xsuaa>       Output type (default: abap)');
     console.log('  --format <env|json>       Output format (default: env)');
     console.log('  --env <path>              Optional existing env file (used for refresh)');
@@ -134,12 +134,12 @@ function showHelp() {
     console.log('  --actor-token <token>     Actor token for token exchange');
     console.log('  --actor-token-type <type> Actor token type for token exchange');
     console.log('  --uaa-url <url>           UAA base URL (used to build token endpoint)');
-    console.log('  --cf-api <url>            CF API URL (resolve login/uaa endpoints)');
     console.log('');
     console.log('SAML Options:');
     console.log('  --idp-sso-url <url>        IdP SSO URL');
     console.log('  --sp-entity-id <id>        SP Entity ID');
     console.log('  --acs-url <url>            ACS URL (default: http://localhost:<port>/callback)');
+    console.log('  --saml-metadata <path>     SAML metadata XML (to resolve token alias)');
     console.log('  --relay-state <value>      RelayState (optional)');
     console.log('  --assertion-flow <flow>    browser|manual|assertion (default: browser)');
     console.log('  --assertion <base64>       SAMLResponse (base64)');
@@ -170,8 +170,47 @@ function readManualInput(prompt) {
         });
     });
 }
+function createCliLogger(prefix = 'SSO') {
+    const isEnabled = () => {
+        if (process.env.DEBUG_SSO === 'false' ||
+            process.env.DEBUG_AUTH_SSO === 'false') {
+            return false;
+        }
+        if (process.env.DEBUG_SSO === 'true' ||
+            process.env.DEBUG_AUTH_SSO === 'true' ||
+            process.env.DEBUG === 'true' ||
+            process.env.DEBUG?.includes('sso') === true ||
+            process.env.DEBUG?.includes('auth-sso') === true) {
+            return true;
+        }
+        return false;
+    };
+    const baseLogger = new logger_1.DefaultLogger((0, logger_1.getLogLevel)());
+    return {
+        debug: (message, meta) => {
+            if (isEnabled()) {
+                baseLogger.debug(`[${prefix}] ${message}`, meta);
+            }
+        },
+        info: (message, meta) => {
+            if (isEnabled()) {
+                baseLogger.info(`[${prefix}] ${message}`, meta);
+            }
+        },
+        warn: (message, meta) => {
+            if (isEnabled()) {
+                baseLogger.warn(`[${prefix}] ${message}`, meta);
+            }
+        },
+        error: (message, meta) => {
+            if (isEnabled()) {
+                baseLogger.error(`[${prefix}] ${message}`, meta);
+            }
+        },
+    };
+}
 function parseArgs() {
-    const args = process.argv.slice(2);
+    let args = process.argv.slice(2);
     if (args.length === 0 || args.includes('--help') || args.includes('-h')) {
         showHelp();
         process.exit(0);
@@ -183,6 +222,7 @@ function parseArgs() {
     let outputFile;
     let envFilePath;
     let destination;
+    let serviceKeyPath;
     let authType = 'abap';
     let format = 'env';
     let protocol;
@@ -217,7 +257,26 @@ function parseArgs() {
     let assertion;
     let cookie;
     let uaaUrl;
-    let cfApi;
+    let samlMetadataPath;
+    const firstArg = args[0];
+    if (firstArg && !firstArg.startsWith('-')) {
+        if (firstArg === 'oidc') {
+            protocol = 'oidc';
+        }
+        else if (firstArg === 'saml2') {
+            protocol = 'saml2';
+        }
+        else if (firstArg === 'bearer') {
+            protocol = 'saml2';
+            flow = 'bearer';
+        }
+        else {
+            console.error(`Unknown command: ${firstArg}`);
+            showHelp();
+            process.exit(1);
+        }
+        args = args.slice(1);
+    }
     for (let i = 0; i < args.length; i++) {
         const arg = args[i];
         const next = i + 1 < args.length ? args[i + 1] : undefined;
@@ -230,6 +289,10 @@ function parseArgs() {
                 envFilePath = next;
                 i++;
                 break;
+            case '--service-key':
+                serviceKeyPath = next;
+                i++;
+                break;
             case '--destination':
                 destination = next;
                 i++;
@@ -402,8 +465,8 @@ function parseArgs() {
                 uaaUrl = next;
                 i++;
                 break;
-            case '--cf-api':
-                cfApi = next;
+            case '--saml-metadata':
+                samlMetadataPath = next;
                 i++;
                 break;
             default:
@@ -414,6 +477,7 @@ function parseArgs() {
         outputFile,
         envFilePath,
         destination,
+        serviceKeyPath,
         authType,
         format,
         protocol,
@@ -448,9 +512,14 @@ function parseArgs() {
         assertion,
         cookie,
         uaaUrl,
-        cfApi,
+        samlMetadataPath,
     };
 }
+function resolveSamlTokenAlias(metadataXml) {
+    const regex = /<md:AssertionConsumerService[^>]*Location="([^"]*\/oauth\/token\/alias\/[^"]+)"/i;
+    const match = metadataXml.match(regex);
+    return match?.[1];
+}
 function normalizeProviderConfig(raw) {
     if (!raw || typeof raw !== 'object') {
         return null;
@@ -520,10 +589,13 @@ function buildSamlConfig(options) {
         : assertionFlow === 'assertion'
             ? async () => readManualInput('Paste SAMLResponse: ')
             : undefined;
-    const cookieProvider = async () => {
+    const cookieProvider = async (samlResponse) => {
         if (options.cookie) {
             return options.cookie;
         }
+        if (assertionFlow === 'assertion') {
+            return `SAMLResponse=${samlResponse}`;
+        }
         return readManualInput('Paste session cookies: ');
     };
     return {
@@ -632,18 +704,12 @@ function buildProviderConfig(options, existingAuth, existingConn, fileConfig) {
     }
     return result;
 }
-async function resolveCfEndpoints(apiUrl) {
-    const response = await axios_1.default.get(apiUrl);
-    const data = response.data;
-    const loginUrl = data?.links?.login?.href;
-    const uaaUrl = data?.links?.uaa?.href;
-    return { loginUrl, uaaUrl };
-}
 async function main() {
     const options = parseArgs();
     if (!options) {
         return;
     }
+    const logger = createCliLogger();
     if (!options.outputFile) {
         console.error('❌ Missing required --output');
         process.exit(1);
@@ -653,6 +719,19 @@ async function main() {
         ? path.resolve(options.envFilePath)
         : undefined;
     let destination = options.destination;
+    if (options.serviceKeyPath) {
+        const resolvedServiceKeyPath = path.resolve(options.serviceKeyPath);
+        if (!fs.existsSync(resolvedServiceKeyPath)) {
+            console.error(`❌ Service key file not found: ${resolvedServiceKeyPath}`);
+            process.exit(1);
+        }
+        const serviceKeyFileName = path.basename(resolvedServiceKeyPath, path.extname(resolvedServiceKeyPath));
+        if (destination && destination !== serviceKeyFileName) {
+            console.error(`❌ Destination mismatch: service key (${serviceKeyFileName}) vs output (${destination})`);
+            process.exit(1);
+        }
+        destination = serviceKeyFileName;
+    }
     if (!destination) {
         destination = path.basename(resolvedOutputPath, path.extname(resolvedOutputPath));
     }
@@ -663,6 +742,24 @@ async function main() {
             process.exit(1);
         }
     }
+    const allowTokenEndpointWithServiceKey = options.protocol === 'saml2' && options.flow === 'bearer';
+    const serviceKeyConflicts = options.serviceKeyPath &&
+        (options.configPath ||
+            options.issuerUrl ||
+            options.authorizationEndpoint ||
+            (!allowTokenEndpointWithServiceKey && options.tokenEndpoint) ||
+            options.deviceAuthorizationEndpoint ||
+            options.clientId ||
+            options.clientSecret ||
+            options.uaaUrl);
+    if (serviceKeyConflicts) {
+        console.error('❌ Use either --service-key or explicit OIDC/SAML parameters (issuer/token/client/uaa).');
+        process.exit(1);
+    }
+    if (options.serviceKeyPath && options.authType !== 'xsuaa') {
+        console.error('❌ --service-key is supported only for XSUAA flows.');
+        process.exit(1);
+    }
     let providerConfigFromFile = null;
     if (options.configPath) {
         const resolvedConfigPath = path.resolve(options.configPath);
@@ -677,13 +774,50 @@ async function main() {
             process.exit(1);
         }
     }
-    if (options.cfApi) {
-        const cfInfo = await resolveCfEndpoints(options.cfApi);
-        if (cfInfo.uaaUrl && !options.uaaUrl) {
-            options.uaaUrl = cfInfo.uaaUrl;
+    if (options.serviceKeyPath) {
+        const resolvedServiceKeyPath = path.resolve(options.serviceKeyPath);
+        const serviceKeyDir = path.dirname(resolvedServiceKeyPath);
+        const serviceKeyStore = new auth_stores_1.XsuaaServiceKeyStore(serviceKeyDir);
+        const authConfig = await serviceKeyStore.getAuthorizationConfig(destination);
+        if (!authConfig) {
+            console.error(`❌ Authorization config not found for ${destination}. Service key must contain clientid, clientsecret, and url fields.`);
+            process.exit(1);
         }
-        if (cfInfo.loginUrl) {
-            console.log(`🔗 CF passcode URL: ${cfInfo.loginUrl.replace(/\/+$/, '')}/passcode`);
+        const uaaUrl = authConfig.uaaUrl;
+        if (!uaaUrl) {
+            console.error(`❌ Service key missing UAA URL for ${destination}.`);
+            process.exit(1);
+        }
+        options.uaaUrl = uaaUrl;
+        options.clientId = authConfig.uaaClientId;
+        options.clientSecret = authConfig.uaaClientSecret;
+        if (!options.issuerUrl) {
+            options.issuerUrl = uaaUrl;
+        }
+        if (!options.tokenEndpoint) {
+            options.tokenEndpoint = `${uaaUrl.replace(/\/+$/, '')}/oauth/token`;
+        }
+        if (!options.authorizationEndpoint) {
+            options.authorizationEndpoint = `${uaaUrl.replace(/\/+$/, '')}/oauth/authorize`;
+        }
+    }
+    if (options.samlMetadataPath) {
+        const resolvedMetadataPath = path.resolve(options.samlMetadataPath);
+        if (!fs.existsSync(resolvedMetadataPath)) {
+            console.error(`❌ SAML metadata file not found: ${resolvedMetadataPath}`);
+            process.exit(1);
+        }
+        const metadataXml = fs.readFileSync(resolvedMetadataPath, 'utf8');
+        const aliasUrl = resolveSamlTokenAlias(metadataXml);
+        if (!aliasUrl) {
+            console.error('❌ SAML metadata does not contain token alias endpoint.');
+            process.exit(1);
+        }
+        options.tokenEndpoint = aliasUrl;
+    }
+    if (options.protocol === 'oidc' && options.flow === 'password') {
+        if (options.uaaUrl && !options.tokenEndpoint) {
+            options.tokenEndpoint = `${options.uaaUrl.replace(/\/+$/, '')}/oauth/token`;
         }
     }
     if (options.protocol === 'oidc' && options.flow) {
@@ -713,10 +847,13 @@ async function main() {
         const tempEnvPath = path.join(tempSessionDir, `${destination}.env`);
         fs.copyFileSync(resolvedEnvPath, tempEnvPath);
     }
-    const defaultServiceUrl = options.serviceUrl || '';
+    const placeholderServiceUrl = '<SERVICE_URL>';
+    const defaultServiceUrl = options.authType === 'xsuaa'
+        ? options.serviceUrl || placeholderServiceUrl
+        : options.serviceUrl || '';
     const sessionStore = options.authType === 'xsuaa'
         ? new auth_stores_1.XsuaaSessionStore(tempSessionDir, defaultServiceUrl)
-        : new auth_stores_1.AbapSessionStore(tempSessionDir);
+        : new auth_stores_1.AbapSessionStore(tempSessionDir, undefined, options.serviceUrl);
     const existingConn = await sessionStore.getConnectionConfig(destination);
     const existingAuth = await sessionStore.getAuthorizationConfig(destination);
     const serviceUrl = options.serviceUrl || existingConn?.serviceUrl;
@@ -730,18 +867,47 @@ async function main() {
         console.error('❌ SAML pure flow is only supported for ABAP sessions (cookies)');
         process.exit(1);
     }
+    const isSamlPureAbap = options.authType === 'abap' &&
+        options.protocol === 'saml2' &&
+        options.flow === 'pure';
     await sessionStore.setConnectionConfig(destination, {
         serviceUrl: serviceUrl ||
             (options.authType === 'xsuaa' ? defaultServiceUrl : undefined),
-        authorizationToken: existingConn?.authorizationToken,
+        authorizationToken: isSamlPureAbap
+            ? existingConn?.authorizationToken || '__init__'
+            : existingConn?.authorizationToken,
         sessionCookies: existingConn?.sessionCookies,
     });
+    let stripClientSecret = false;
+    const authUaaUrl = options.uaaUrl || options.tokenEndpoint || options.issuerUrl || undefined;
+    if (options.clientId && authUaaUrl) {
+        let clientSecret = options.clientSecret;
+        if (!clientSecret) {
+            clientSecret = '__public__';
+            stripClientSecret = true;
+        }
+        await sessionStore.setAuthorizationConfig(destination, {
+            uaaUrl: authUaaUrl,
+            uaaClientId: options.clientId,
+            uaaClientSecret: clientSecret,
+            refreshToken: existingAuth?.refreshToken,
+        });
+    }
     const providerConfig = buildProviderConfig(options, existingAuth, existingConn, providerConfigFromFile);
-    const tokenProvider = auth_providers_1.SsoProviderFactory.create(providerConfig);
+    const providerConfigWithLogger = providerConfig.config
+        ? {
+            ...providerConfig,
+            config: {
+                ...providerConfig.config,
+                logger: providerConfig.config?.logger ?? logger,
+            },
+        }
+        : providerConfig;
+    const tokenProvider = auth_providers_1.SsoProviderFactory.create(providerConfigWithLogger);
     const broker = new AuthBroker({
         sessionStore,
         tokenProvider,
-    }, options.browser);
+    }, options.browser, logger);
     console.log(`🔐 Getting token for destination "${destination}"...`);
     await broker.getToken(destination);
     console.log(`✅ Token obtained successfully`);
@@ -766,7 +932,21 @@ async function main() {
         if (!fs.existsSync(outputDir)) {
             fs.mkdirSync(outputDir, { recursive: true });
         }
-        fs.copyFileSync(tempEnvPath, resolvedOutputPath);
+        let envContent = fs.readFileSync(tempEnvPath, 'utf8');
+        if (options.authType === 'xsuaa' && !serviceUrl) {
+            const lines = envContent
+                .split('\n')
+                .filter((line) => !line.startsWith('XSUAA_MCP_URL='));
+            envContent = `${lines.join('\n')}\n`;
+        }
+        if (stripClientSecret) {
+            const lines = envContent
+                .split('\n')
+                .filter((line) => !line.startsWith('XSUAA_UAA_CLIENT_SECRET=') &&
+                !line.startsWith('SAP_UAA_CLIENT_SECRET='));
+            envContent = `${lines.join('\n')}\n`;
+        }
+        fs.writeFileSync(resolvedOutputPath, envContent, 'utf8');
         console.log(`✅ .env file created: ${resolvedOutputPath}`);
     }
     else {
@@ -792,7 +972,9 @@ async function main() {
             outputData.uaaClientId = authConfig.uaaClientId;
         }
         if (authConfig?.uaaClientSecret) {
-            outputData.uaaClientSecret = authConfig.uaaClientSecret;
+            if (!stripClientSecret) {
+                outputData.uaaClientSecret = authConfig.uaaClientSecret;
+            }
         }
         const outputDir = path.dirname(resolvedOutputPath);
         if (!fs.existsSync(outputDir)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/auth-broker",
-  "version": "1.0.3",
+  "version": "1.0.6",
   "description": "JWT authentication broker for MCP ABAP ADT - manages tokens based on destination headers",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -45,6 +45,11 @@
     "build:fast": "tsc -p tsconfig.json && tsc -p tsconfig.cli.json",
     "test": "NODE_OPTIONS=--experimental-vm-modules jest",
     "test:check": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json",
+    "test:mcp-auth": "sh tests/sso-demo/run-mcp-auth.sh",
+    "test:mcp-sso": "sh tests/sso-demo/run-mcp-sso.sh",
+    "test:device-code": "sh tests/keycloak/run-oidc.sh",
+    "test:saml-pure": "sh tests/keycloak/run-saml.sh",
+    "test:sso": "sh tests/keycloak/run-interactive.sh",
     "prepublishOnly": "npm run build",
     "prepack": "npm run build",
     "generate-env": "tsx bin/generate-env-from-service-key.ts"
@@ -57,8 +62,8 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
-    "@mcp-abap-adt/auth-providers": "^1.0.2",
-    "@mcp-abap-adt/auth-stores": "^1.0.1",
+    "@mcp-abap-adt/auth-providers": "^1.0.5",
+    "@mcp-abap-adt/auth-stores": "^1.0.2",
     "@mcp-abap-adt/interfaces": "^2.3.0",
     "axios": "^1.13.5",
     "tsx": "^4.21.0"