Add resource_owner field in the introspection process

Author: yukuanj

examples/servers/simple-auth/mcp_simple_auth/auth_server.py

@@ -123,6 +123,7 @@ async def introspect_handler(request: Request) -> Response:
                 "iat": int(time.time()),
                 "token_type": "Bearer",
                 "aud": access_token.resource,  # RFC 8707 audience claim
+                "sub": access_token.resource_owner,  # Resource owner
             }
         )
 

examples/servers/simple-auth/mcp_simple_auth/token_verifier.py

@@ -75,6 +75,7 @@ async def verify_token(self, token: str) -> AccessToken | None:
                     scopes=data.get("scope", "").split() if data.get("scope") else [],
                     expires_at=data.get("exp"),
                     resource=data.get("aud"),  # Include resource in token
+                    resource_owner=data.get("sub"),  # Use 'sub' claim as resource owner
                 )
             except Exception as e:
                 logger.warning(f"Token introspection failed: {e}")