[daviddanialy]

Fixes #1404

The ID-JAG validation in transport/auth/enterprise.rs required a resource claim, but the claim is optional in draft-ietf-oauth-identity-assertion-authz-grant, and the MCP EMA extension only constrains it when present. Okta Cross App Access omits it, so rmcp clients couldn't use Okta-issued ID-JAGs.

• IdJagClaims.resource is now Option<Resource>. An omitted claim is accepted; an explicit null is still rejected.
• When present, the claim (and the token-exchange response's resource) must still exactly match the requested resource. Without it, the ID-JAG is bound to the resource AS by aud.
• Tests cover the omitted, matching, mismatched and null cases, and an end-to-end redemption without the claim.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T16:45:21.999375Z	9720ea8	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

@gocamille is on triage rotation this week and is the reviewer for this one.

Labels come from the PR labeler. Please review the change.

_{Automated triage. Labels are a first pass and the assigned maintainer has the final say.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 51e8177fc5

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[gocamille]

This looks good to me, thanks @daviddanialy! I checked the two new tests against main and they both fail there for the right reason. I left a few small optional ones inline but none of them are blocking 👍

[daviddanialy]

@gocamille Pushed the two optional suggestions, which dismissed the approval. Mind re-approving when you get a chance?

[daviddanialy]

@gocamille Approved and green, ready to merge whenever you get a chance