You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sling.apache.org by ro...@apache.org on 2026/03/13 13:10:00 UTC
(sling-org-apache-sling-mcp-server) branch issue/admin-access created (now 5267703)
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a change to branch issue/admin-access
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-mcp-server.git
at 5267703 fix: require admin access for McpServlet
This branch includes the following new commits:
new 5267703 fix: require admin access for McpServlet
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(sling-org-apache-sling-mcp-server) 01/01: fix: require admin access for McpServlet
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to branch issue/admin-access
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-mcp-server.git
commit 52677036c67787afae17474fbfc16ba153f1fb2e
Author: Robert Munteanu <ro...@apache.org>
AuthorDate: Fri Mar 13 14:09:36 2026 +0100
fix: require admin access for McpServlet
---
README.md | 16 ++++++++++-
pom.xml | 5 ++++
.../apache/sling/mcp/server/impl/McpServlet.java | 33 ++++++++++++++++++++++
3 files changed, 53 insertions(+), 1 deletion(-)
diff --git a/README.md b/README.md
index b189d5d..ed82a21 100644
--- a/README.md
+++ b/README.md
@@ -16,7 +16,21 @@ Then build and deploy the [MCP server contributions bundle from the Sling Whiteb
$ mvn -f whiteboard/mcp-server-contributions/ install sling:install
```
-Then open up your coding assistant tool and add an remote MCP server with location http://localhost:8080/mcp .
+Then open up your coding assistant tool and add an remote MCP server with location http://localhost:8080/mcp . Access is only
+permitted for the `admin` user therefore basic authentication headers need to be specified. In case of the default credentials
+the configuration can look as follows
+
+```json
+"aem-cs-sdk": {
+ "type": "streamable-http",
+ "url": "http://localhost:4502/bin/mcp",
+ "headers": {
+ "Authorization": "Basic YWRtaW46YWRtaW4="
+ }
+}
+```
+
+Please refer to the documentation of your coding assistant tool for details on how to add a remote MCP server and specify authentication headers.
## Legacy artifact
diff --git a/pom.xml b/pom.xml
index be655a9..c76aa7b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -121,6 +121,11 @@
<artifactId>jakarta.servlet-api</artifactId>
<scope>compile</scope>
</dependency>
+ <dependency>
+ <groupId>org.apache.jackrabbit</groupId>
+ <artifactId>oak-jackrabbit-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
<dependency>
<groupId>org.apache.felix</groupId>
<artifactId>org.apache.felix.http.wrappers</artifactId>
diff --git a/src/main/java/org/apache/sling/mcp/server/impl/McpServlet.java b/src/main/java/org/apache/sling/mcp/server/impl/McpServlet.java
index d3a68d0..2cdfc72 100644
--- a/src/main/java/org/apache/sling/mcp/server/impl/McpServlet.java
+++ b/src/main/java/org/apache/sling/mcp/server/impl/McpServlet.java
@@ -18,8 +18,11 @@
*/
package org.apache.sling.mcp.server.impl;
+import javax.jcr.RepositoryException;
+import javax.jcr.Session;
import javax.servlet.Servlet;
import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.lang.invoke.MethodHandle;
@@ -40,6 +43,8 @@ import io.modelcontextprotocol.spec.McpSchema;
import io.modelcontextprotocol.spec.McpSchema.ServerCapabilities;
import org.apache.felix.http.jakartawrappers.HttpServletRequestWrapper;
import org.apache.felix.http.jakartawrappers.HttpServletResponseWrapper;
+import org.apache.jackrabbit.api.JackrabbitSession;
+import org.apache.jackrabbit.api.security.user.User;
import org.apache.sling.api.SlingHttpServletRequest;
import org.apache.sling.api.SlingHttpServletResponse;
import org.apache.sling.api.servlets.SlingAllMethodsServlet;
@@ -218,6 +223,13 @@ public class McpServlet extends SlingAllMethodsServlet {
@Override
protected void doGet(@NotNull SlingHttpServletRequest request, @NotNull SlingHttpServletResponse response)
throws ServletException, IOException {
+
+ User user = getCurrentUser(request);
+ if (user == null || !user.isAdmin()) {
+ response.sendError(HttpServletResponse.SC_FORBIDDEN, "Access denied");
+ return;
+ }
+
try {
doGetMethod.invoke(
transportProvider,
@@ -230,9 +242,30 @@ public class McpServlet extends SlingAllMethodsServlet {
}
}
+ protected User getCurrentUser(SlingHttpServletRequest request) {
+ if (request.getResourceResolver().adaptTo(Session.class) instanceof JackrabbitSession jcrSession) {
+
+ String userId = jcrSession.getUserID();
+
+ try {
+ return jcrSession.getUserManager().getAuthorizable(userId, User.class);
+ } catch (RepositoryException e) {
+ logger.warn("Failed to retrieve user for ID {}, access will be denied", userId, e);
+ }
+ }
+ return null;
+ }
+
@Override
protected void doPost(@NotNull SlingHttpServletRequest request, @NotNull SlingHttpServletResponse response)
throws ServletException, IOException {
+
+ User user = getCurrentUser(request);
+ if (user == null || !user.isAdmin()) {
+ response.sendError(HttpServletResponse.SC_FORBIDDEN, "Access denied");
+ return;
+ }
+
try {
doPostMethod.invoke(
transportProvider,