# `ExMCP.Authorization.EnterpriseFlow`
[🔗](https://github.com/azmaveth/ex_mcp/blob/v1.0.0/lib/ex_mcp/authorization/enterprise_flow.ex#L1)

Client-side enterprise SSO orchestrator for MCP.

Implements the enterprise-managed authorization flow using ID-JAG:
1. (Pre-step) User authenticates with IdP via OIDC → obtains ID token
2. Token Exchange at IdP: exchange ID token for ID-JAG
3. JWT Bearer Grant at AS: present ID-JAG to get access token

# `config`

```elixir
@type config() :: %{
  :id_token => String.t(),
  :idp_token_endpoint => String.t(),
  :as_issuer => String.t(),
  optional(:as_token_endpoint) => String.t(),
  optional(:resource_url) => String.t(),
  optional(:client_id) => String.t(),
  optional(:scope) => String.t(),
  optional(:http_client) => module() | function(),
  optional(:metadata_fetch) => keyword()
}
```

# `execute`

```elixir
@spec execute(config()) :: {:ok, map()} | {:error, term()}
```

Executes the enterprise-managed authorization flow.

Takes an OIDC ID token (from a prior authentication step) and:
1. Discovers the AS token endpoint if not provided
2. Exchanges the ID token for an ID-JAG at the IdP
3. Presents the ID-JAG to the AS via JWT bearer grant to get an access token

## Config
  - `:id_token` (required) - OIDC ID token from prior authentication
  - `:idp_token_endpoint` (required) - IdP's token endpoint for token exchange
  - `:as_issuer` (required) - Authorization server's issuer URI
  - `:as_token_endpoint` - AS token endpoint (discovered if not provided)
  - `:resource_url` - MCP server resource URL
  - `:client_id` - OAuth client identifier
  - `:scope` - Requested scope
  - `:http_client` - Custom pinned-address HTTP client for discovery
  - `:metadata_fetch` - Metadata timeout, size, DNS and redirect-policy options

# `prepare_oidc_auth`

```elixir
@spec prepare_oidc_auth(keyword()) :: {:ok, map()} | {:error, term()}
```

Discovers the IdP's OIDC endpoints and builds an authorization URL for Step 1.

This is a helper for initiating the OIDC authentication step before
the enterprise flow can proceed.

## Options
  - `:idp_issuer` (required) - The IdP's issuer URI
  - `:client_id` (required) - OAuth client identifier at the IdP
  - `:redirect_uri` (required) - Callback URI for OIDC code flow
  - `:scope` - Requested OIDC scopes (default: "openid")
  - `:state` - CSRF state parameter
  - `:nonce` - OIDC nonce parameter
  - `:http_client` - Custom HTTP client module

---

*Consult [api-reference.md](api-reference.md) for complete listing*