feat: Add RFC 8414 OAuth 2.0 Authorization Server Metadata endpoint by zacharypodbela · Pull Request #1665 · django-oauth/django-oauth-toolkit

zacharypodbela · 2026-03-04T19:24:44Z

Summary

Implements the /.well-known/oauth-authorization-server discovery endpoint per RFC 8414 — OAuth 2.0 Authorization Server Metadata.

Closes #1099

Changes

New oauth2_provider/views/metadata.py — contains ServerMetadataViewMixin (shared URL-building logic for discovery views) and OAuthServerMetadataView (the RFC 8414 endpoint). The view is available regardless of whether OIDC is enabled and has no OIDCOnlyMixin dependency.
Refactored ConnectDiscoveryInfoView — now inherits ServerMetadataViewMixin, eliminating the duplicated if/else URL-building logic that previously existed for the request-relative vs OIDC_ISS_ENDPOINT-anchored cases.
New settings with sensible defaults:
- OAUTH2_RESPONSE_TYPES_SUPPORTED
- OAUTH2_GRANT_TYPES_SUPPORTED
- OAUTH2_TOKEN_ENDPOINT_AUTH_METHODS_SUPPORTED
New oauth2_metadata_issuer() helper on OAuth2ProviderSettings, mirroring the existing oidc_issuer().
New URL oauth-server-metadata registered in base_urlpatterns.
Tests covering: full response structure, request-derived issuer (no OIDC_ISS_ENDPOINT), jwks_uri conditional on RSA key presence, CORS header, and availability when OIDC is disabled.

Relationship to OIDC discovery

RFC 8414 is the OAuth 2.0 equivalent of OpenID Connect discovery. The key differences from ConnectDiscoveryInfoView:

	`/.well-known/openid-configuration`	`/.well-known/oauth-authorization-server`
Spec	OpenID Connect Discovery 1.0	RFC 8414
Requires OIDC	Yes	No
`userinfo_endpoint`	Yes	No
`jwks_uri`	Always	Only if RSA key configured
`grant_types_supported`	No	Yes
`revocation_endpoint`	No	Yes
`introspection_endpoint`	No	Yes

zacharypodbela · 2026-03-11T14:13:50Z

@dopry could I get a review on this?

Copilot

Pull request overview

Adds an RFC 8414-compliant OAuth 2.0 Authorization Server Metadata discovery endpoint and refactors existing OIDC discovery code to reuse shared URL-building logic.

Changes:

Added /.well-known/oauth-authorization-server endpoint with RFC 8414 metadata response and CORS header.
Introduced ServerMetadataViewMixin and refactored ConnectDiscoveryInfoView to remove duplicated endpoint URL-building logic.
Added new settings defaults + documentation, and tests for endpoint behavior (issuer derivation, JWKS conditional, CORS, OIDC disabled).

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/test_oidc_views.py	Adds tests validating RFC 8414 metadata response shape and key conditionals.
oauth2_provider/views/oidc.py	Refactors OIDC discovery to reuse shared endpoint URL builder.
oauth2_provider/views/metadata.py	Implements the RFC 8414 metadata endpoint + shared URL-building mixin.
oauth2_provider/views/init.py	Exposes the new metadata view for URL registration.
oauth2_provider/urls.py	Registers the `/.well-known/oauth-authorization-server` route.
oauth2_provider/settings.py	Adds OAuth2 metadata settings and an issuer helper method.
docs/settings.rst	Documents new settings related to the metadata endpoint.
docs/oauth2_server_metadata.rst	Adds user-facing docs for the RFC 8414 endpoint.
docs/index.rst	Adds the new docs page to the documentation index.
CHANGELOG.md	Notes the new endpoint in the unreleased changelog.

codecov · 2026-03-12T21:16:14Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

dopry · 2026-03-13T02:46:16Z

@zacharypodbela can you review the copilot comments and address them?

zacharypodbela · 2026-04-13T14:44:19Z

I'll address the last round of copilot review by end of day today and ping back when that's done.

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.

zacharypodbela · 2026-04-14T00:38:18Z

@dopry I addressed all the feedback.

Once of the suggestions from Copilot is not valid. I left a comment explaining why. Let me know if anything else is needed to finalize PR!

zacharypodbela · 2026-04-14T02:41:05Z

One thing I just realized is that between this PR and #1667, whichever PR is merged second will need to enhance the metadata endpoint to also return the DCR "registration_endpoint" for clients that discover the DCR endpoint via metadata.

I'd actually suggest we merge #1667 first and then we make that enhancement in this PR.

zacharypodbela · 2026-04-27T15:13:18Z

@dopry just want to bump this -- do we think we can get this merged this week? I have ample time to address more feedback if needed.

leiserfg · 2026-04-30T12:02:07Z

I think the base for the reverse used in _get_endpoint_url should be configurable ('cause the url might be mounted inside of another app) if that is too convoluted then at least split that part into another method so users can override it in a custom view.

zacharypodbela · 2026-05-01T14:52:24Z

@leiserfg can you provide example code of the use case you are talking about? Happy to make sure we support it but a code snippet will help me better understand your needs and also test locally.

dopry · 2026-05-05T19:56:56Z

@zacharypodbela looks like CI isn't happy, can you address the test and lint issues?

leiserfg · 2026-05-10T20:33:51Z

@leiserfg can you provide example code of the use case you are talking about? Happy to make sure we support it but a code snippet will help me better understand your needs and also test locally.

I'm talking for instance in the case of a user overriding the authorize view or in the case of that url to be mounted in another app, the reverse won't work and the meta will be missing the links.

Implements the /.well-known/oauth-authorization-server discovery endpoint per RFC 8414. Unlike the existing OIDC discovery endpoint, this is available regardless of whether OIDC is enabled. - Add OAuthServerMetadataView and ServerMetadataViewMixin in new metadata.py - Refactor ConnectDiscoveryInfoView to use ServerMetadataViewMixin, removing duplicated URL-building logic - Add OAUTH2_RESPONSE_TYPES_SUPPORTED, OAUTH2_GRANT_TYPES_SUPPORTED, and OAUTH2_TOKEN_ENDPOINT_AUTH_METHODS_SUPPORTED settings with defaults - Add oauth2_metadata_issuer() helper to OAuth2ProviderSettings - Register endpoint in base_urlpatterns as oauth-server-metadata Closes django-oauth#1099 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Add oauth2_server_metadata.rst with endpoint description and example response - Link from index.rst toctree after oidc - Document OAUTH2_RESPONSE_TYPES_SUPPORTED, OAUTH2_GRANT_TYPES_SUPPORTED, and OAUTH2_TOKEN_ENDPOINT_AUTH_METHODS_SUPPORTED in settings.rst Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Derive the well-known path via reverse() instead of hardcoding the suffix in oauth2_metadata_issuer(), and sort scopes_supported for deterministic metadata output. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…ndpoint The JWKS endpoint is served by JwksInfoView which requires OIDCOnlyMixin, so jwks_uri should only appear in metadata when OIDC is actually enabled. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…erns RFC 8414 requires the metadata endpoint at {issuer}/.well-known/oauth-authorization-server. When base_urlpatterns is mounted at a prefix (e.g., /o/), the metadata endpoint ends up at /o/.well-known/oauth-authorization-server, which clients cannot discover. Move the metadata view into its own metadata_urlpatterns list so downstream apps can mount it at the root separately from prefixed toolkit URLs. The default urlpatterns still includes everything for simple setups. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

_get_endpoint_url() now catches NoReverseMatch and returns None instead of letting it propagate as a 500. The metadata view omits any endpoint URLs that couldn't be resolved, so downstream apps that don't include all of base_urlpatterns won't crash the metadata endpoint. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

oauth2_metadata_issuer() was reversing the metadata view's URL name and stripping the .well-known path to derive the issuer. This broke when the metadata view was mounted outside the oauth2_provider namespace (as recommended after moving it to metadata_urlpatterns). Use the request's scheme + host directly instead — this is correct per RFC 8414 and doesn't depend on URL routing internals. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Include revocation_endpoint_auth_methods_supported and introspection_endpoint_auth_methods_supported in the RFC 8414 metadata response. Both reuse the token_endpoint_auth_methods_supported value, and are only included when the corresponding endpoint is registered. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

zacharypodbela mentioned this pull request Mar 4, 2026

RFC 8414 .well-known/oauth-authorization-server metadata #1099

Open

dopry force-pushed the rfc-8414-oauth-server-metadata branch from b6b1c88 to d5108c7 Compare March 12, 2026 19:50

dopry requested a review from Copilot March 12, 2026 19:50

Copilot AI reviewed Mar 12, 2026

View reviewed changes

Comment thread oauth2_provider/settings.py Outdated

Comment thread oauth2_provider/views/metadata.py Outdated

Comment thread tests/test_oidc_views.py

Copilot started reviewing on behalf of dopry March 12, 2026 20:48 View session

dopry force-pushed the rfc-8414-oauth-server-metadata branch from d5108c7 to 2a42baa Compare March 13, 2026 02:46

zacharypodbela requested a review from Copilot April 13, 2026 23:45

Copilot started reviewing on behalf of zacharypodbela April 13, 2026 23:46 View session

Copilot AI reviewed Apr 13, 2026

View reviewed changes

Comment thread oauth2_provider/views/metadata.py Outdated

Comment thread tests/test_oidc_views.py

Comment thread docs/oauth2_server_metadata.rst Outdated

Comment thread oauth2_provider/settings.py Outdated

zacharypodbela mentioned this pull request Apr 16, 2026

feat: Dynamic Client Registration Protocol (RFC 7591 / RFC 7592) #1667

Open

2 tasks

dopry force-pushed the rfc-8414-oauth-server-metadata branch from cd186e5 to 7b56f04 Compare May 21, 2026 19:59

dopry force-pushed the rfc-8414-oauth-server-metadata branch from 7b56f04 to 92b3ce0 Compare May 30, 2026 05:28

zacharypodbela and others added 7 commits June 12, 2026 01:43

dopry force-pushed the rfc-8414-oauth-server-metadata branch from 92b3ce0 to 378c7b3 Compare June 12, 2026 05:43

Conversation

zacharypodbela commented Mar 4, 2026

Summary

Changes

Relationship to OIDC discovery

Uh oh!

zacharypodbela commented Mar 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Mar 12, 2026

Codecov Report

Uh oh!

dopry commented Mar 13, 2026

Uh oh!

zacharypodbela commented Apr 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

zacharypodbela commented Apr 14, 2026

Uh oh!

zacharypodbela commented Apr 14, 2026

Uh oh!

zacharypodbela commented Apr 27, 2026

Uh oh!

leiserfg commented Apr 30, 2026

Uh oh!

zacharypodbela commented May 1, 2026

Uh oh!

dopry commented May 5, 2026

Uh oh!

leiserfg commented May 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

leiserfg commented May 10, 2026 •

edited

Loading