# Teradata MCP Server - OAuth Configuration Example
# Copy this file to .env and modify the values for your environment
# =============================================================================
# DATABASE CONFIGURATION
# =============================================================================
DATABASE_URI=teradatasql://username:password@hostname/database
# Database connection resilience settings
DB_MAX_RETRIES=3
DB_INITIAL_BACKOFF=1.0
DB_MAX_BACKOFF=30.0
# =============================================================================
# MCP SERVER CONFIGURATION
# =============================================================================
MCP_TRANSPORT=sse
MCP_HOST=0.0.0.0
MCP_PORT=8000
MCP_PATH=/mcp
# =============================================================================
# OAUTH 2.1 CONFIGURATION
# =============================================================================
# Enable/disable OAuth authentication
OAUTH_ENABLED=false
# Keycloak server configuration (required when OAUTH_ENABLED=true)
KEYCLOAK_URL=https://your-keycloak-server.com
KEYCLOAK_REALM=teradata-realm
KEYCLOAK_CLIENT_ID=teradata-mcp
# Client secret (for confidential clients)
KEYCLOAK_CLIENT_SECRET=your-client-secret
# Resource server identification (required when OAUTH_ENABLED=true)
# This should be the URL of your MCP server
OAUTH_RESOURCE_SERVER_URL=https://your-mcp-server.com
# Required scopes (comma-separated, optional)
# If not specified, all requests will be allowed regardless of scopes
OAUTH_REQUIRED_SCOPES=teradata:read,teradata:query
# Security settings (optional, defaults shown)
OAUTH_VALIDATE_AUDIENCE=true
OAUTH_VALIDATE_SCOPES=true
OAUTH_REQUIRE_HTTPS=true
# =============================================================================
# OAUTH ENDPOINT OVERRIDES (OPTIONAL)
# =============================================================================
# These endpoints are automatically generated from KEYCLOAK_URL and KEYCLOAK_REALM
# Override only if you have custom endpoints
# Token introspection endpoint for opaque token validation
# OAUTH_TOKEN_VALIDATION_ENDPOINT=https://keycloak.example.com/auth/realms/teradata-realm/protocol/openid-connect/token/introspect
# JWKS endpoint for JWT token validation
# OAUTH_JWKS_ENDPOINT=https://keycloak.example.com/auth/realms/teradata-realm/protocol/openid-connect/certs
# =============================================================================
# DEVELOPMENT SETTINGS
# =============================================================================
# For development/testing with local Keycloak instance
# Example local development configuration:
# OAUTH_ENABLED=true
# KEYCLOAK_URL=http://localhost:8080
# KEYCLOAK_REALM=teradata-realm
# KEYCLOAK_CLIENT_ID=teradata-mcp
# KEYCLOAK_CLIENT_SECRET=teradata-mcp-secret
# OAUTH_RESOURCE_SERVER_URL=http://localhost:8000
# OAUTH_REQUIRE_HTTPS=false
# OAUTH_REQUIRED_SCOPES=teradata:read
# =============================================================================
# LOGGING CONFIGURATION
# =============================================================================
LOG_LEVEL=INFO
PYTHONPATH=/app/src
# =============================================================================
# DOCKER CONFIGURATION
# =============================================================================
# When running in Docker, these are typically set in docker-compose.yml
# CONTAINER_NAME=mcp-teradata-oauth
# RESTART_POLICY=unless-stopped
# =============================================================================
# KEYCLOAK REALM CONFIGURATION REFERENCE
# =============================================================================
# After setting up your Keycloak realm, you'll need these client scopes:
#
# Client Scopes:
# - teradata:read (Read access to database resources)
# - teradata:write (Write access to database resources)
# - teradata:query (Execute SQL queries)
# - teradata:admin (Administrative access)
# - teradata:schema (Schema management access)
#
# Client Configuration:
# - Client ID: teradata-mcp
# - Client Protocol: openid-connect
# - Access Type: confidential (if using client secret)
# - Standard Flow: enabled
# - Service Accounts: enabled (for client credentials flow)
# - Valid Redirect URIs: https://your-mcp-server.com/*
#
# Use the provided setup-keycloak.sh script to automatically configure Keycloak:
# ./scripts/setup-keycloak.sh http://localhost:8080 admin admin
