Support OAuth2 metadata RFC (RFC 8414)

[mooreds]

Support OAuth2 metadata RFC

Problem

I want my clients to be able to dynamically find the OAuth endpoints for FusionAuth.

Solution

Implement https://tools.ietf.org/html/rfc8414

Alternatives/workarounds

Read the documentation

Additional context

FusionAuth/fusionauth-jwt#23
FusionAuth/fusionauth-jwt#23 (comment)

Related

• signal support for PKCE in discovery document #1177
• Support OAuth 2.0 Authorization Server Issuer Identification standard #1383
• Support Authorization Server Metadata #1832

How to vote

Please give us a thumbs up or thumbs down as a reaction to help us prioritize this feature. Feel free to comment if you have a particular need or comment on how this feature should work.

[JuliusPC]

In my opinion you should just let /.well-known/oauth-authorization-server point to the same contents as /.well-known/openid-configuration. This should be allowed, evidence for that in the spec:

Some OAuth applications will choose to use the well-known URI suffix "openid-configuration". As described in Section 5, despite the identifier "/.well-known/openid-configuration", appearing to be OpenID specific, its usage in this specification is actually referring to a general OAuth 2.0 feature that is not specific to OpenID Connect.

[robotdan]

@mooreds are #1383 & #1832 dups of this?

[mooreds]

@robotdan #1832 is (and is now closed), but #1383 is different.

The latter adds a new parameter iss to the various endpoints and is useful in situations where you have more than one OAuth server being used by a client and want to ensure that the client is really interacting with the server it expects it is.

[mooreds]

https://evertpot.com/oauth2-usability/ has some hot takes.