Resource parameter shouldn't be required

[dr3s]

Describe the bug
Flagging a potential breaking change for the resource server support. My implementation is serving oauth metadata but not protected resource metadata. When I use the connect button flow, I get the following error:

To Reproduce
Steps to reproduce the behavior:

1. Set up oauth metadata to point to 3rd party (Entra)
2. Don't serve protected resource metadata
3. Connect button flow in Inspector

Expected behavior
Resource param shouldn't be required

Logs
If applicable, add logs to help explain your problem.

Additional context
Add any other context about the problem here.

[pcarleton]

☹ thanks for flagging. we can add the ability to toggle it off via overriding the validateResourceURL conditionally, or we could take the resource metadata being available as the indicator that the resource parameter is supported. Right now we add it in any event.

[dr3s]

I just read the draft spec and was surprised to find that resource metadata and resource parameter support are declared as MUST. I'm afraid that implementations such as Entra are just not going to be able to be used if the bar is that high.

https://modelcontextprotocol.io/specification/draft/basic/authorization#resource-parameter-implementation