Allow to customize OIDC discovery path by sberyozkin · Pull Request #52667 · quarkusio/quarkus

sberyozkin · 2026-02-18T18:08:30Z

With MCP Authorization highlighting that not only .well-known/openid-configuration well known address for finding the provider metadata is possible it is time to let users customize it.

For ex, a GitHub OAuth2 provider associated with the GitHub MCP Server has its metadata available at .well-known/oauth-authorization-server/login/oauth

...sions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonConfig.java

...idc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/config/OidcCommonConfig.java

github-actions · 2026-02-18T18:50:38Z

🙈 The PR is closed and the preview is expired.

sberyozkin · 2026-02-18T19:01:07Z

Sorry I thought it was green

michalvavrik · 2026-02-18T19:41:43Z

Sorry I thought it was green

If you are not careful Guillaume will knock at your doors.

sberyozkin · 2026-02-19T22:39:33Z

@michalvavrik I run the oidc-tenancy test on my laptop, it was fine, there is some slowness there when it tries to connect to a non existent address for some reasons, so may be it was a timeout

quarkus-bot · 2026-02-19T23:15:40Z

Status for workflow `Quarkus Documentation CI`

This is the status report for running Quarkus Documentation CI on commit 4fa9a0b.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

Warning

There are other workflow runs running, you probably need to wait for their status before merging.

quarkus-bot · 2026-02-19T23:28:15Z

Status for workflow `Quarkus CI`

This is the status report for running Quarkus CI on commit 4fa9a0b.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

You can consult the Develocity build scans.

michalvavrik · 2026-02-20T08:47:38Z

...sions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonConfig.java

+     *
+     * @deprecated use {@link #discoveryPath()} method instead
+     */
+    @Deprecated(forRemoval = true)


personally, I introduce them as private and thus avoid the deprecation, but that is just FYI, it makes no practical difference. IMO we should cut them soon anyway (Quarkus 4?)

Hi @michalvavrik Yeah, sounds like the right time

@michalvavrik Ouch, I messed up with the squash and used the wrong base commit, I'll have to create a new commit, reverting squash did not go according to plan

michalvavrik · 2026-02-20T08:49:34Z

extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcTenantConfig.java

I think you included other PR to avoid merge conflicts. No problem, I am not reviewing these parts.

michalvavrik

OIDC Discovery path - LGTM and makes sense!

michalvavrik · 2026-02-20T08:51:27Z

...nsions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java

-    public static String getDiscoveryUri(String authServerUrl) {
-        return authServerUrl + OidcConstants.WELL_KNOWN_CONFIGURATION;
+    public static String getDiscoveryUri(String authServerUrl, String discoveryPath) {
+        return authServerUrl + prependSlash(discoveryPath != null ? discoveryPath : OidcConstants.WELL_KNOWN_CONFIGURATION);


If you are going to make another push, you could apply "prependSlash" only on discoveryPath, not the constant. If not, let's keep it as is.

@michalvavrik hey, it would not add it if the path already starts with / so I'd probably avoid another push

@michalvavrik hey, it would not add it if the path already starts with / so I'd probably avoid another push

cool, just please check that non-related code, because I think this PR contains changes it shouldn't. Thanks.

state cookie

cescoffier · 2026-02-23T08:53:16Z

🤖 Automatically associated with the WG - OIDC improvements Working Group based on AI classification.

cescoffier · 2026-02-23T09:11:04Z

Removing the working group association.

sberyozkin requested a review from michalvavrik February 18, 2026 18:08

sberyozkin temporarily deployed to ci February 18, 2026 18:08 — with GitHub Actions Inactive

quarkus-bot bot added area/documentation area/oidc labels Feb 18, 2026

michalvavrik reviewed Feb 18, 2026

View reviewed changes

...sions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonConfig.java Outdated Show resolved Hide resolved

This comment has been minimized.

Sign in to view

michalvavrik reviewed Feb 18, 2026

View reviewed changes

...idc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/config/OidcCommonConfig.java Outdated Show resolved Hide resolved

This comment has been minimized.

Sign in to view

sberyozkin marked this pull request as draft February 18, 2026 19:00

Allow to control Same-Site attribute for OIDC state cookie

4fa9a0b

sberyozkin force-pushed the oidc_discovery_path branch from c662c23 to 4fa9a0b Compare February 19, 2026 22:38

sberyozkin temporarily deployed to ci February 19, 2026 22:38 — with GitHub Actions Inactive

sberyozkin marked this pull request as ready for review February 19, 2026 22:38

sberyozkin temporarily deployed to ci February 19, 2026 22:38 — with GitHub Actions Inactive

michalvavrik reviewed Feb 20, 2026

View reviewed changes

michalvavrik approved these changes Feb 20, 2026

View reviewed changes

michalvavrik reviewed Feb 20, 2026

View reviewed changes

sberyozkin closed this Feb 20, 2026

quarkus-bot bot added the triage/invalid This doesn't seem right label Feb 20, 2026

sberyozkin mentioned this pull request Feb 20, 2026

Allow to customize OIDC discovery path #52694

Merged

cescoffier added this to WG - OIDC improvements Feb 23, 2026

cescoffier moved this to Todo in WG - OIDC improvements Feb 23, 2026

github-project-automation bot moved this from Todo to Done in WG - OIDC improvements Feb 23, 2026

cescoffier removed the status in WG - OIDC improvements Feb 23, 2026

cescoffier removed this from WG - OIDC improvements Feb 23, 2026

Conversation

sberyozkin commented Feb 18, 2026

Uh oh!

Uh oh!

This comment has been minimized.

Uh oh!

github-actions bot commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment has been minimized.

sberyozkin commented Feb 18, 2026

Uh oh!

michalvavrik commented Feb 18, 2026

Uh oh!

sberyozkin commented Feb 19, 2026

Uh oh!

quarkus-bot bot commented Feb 19, 2026

Status for workflow Quarkus Documentation CI

Uh oh!

quarkus-bot bot commented Feb 19, 2026 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Status for workflow Quarkus CI

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

michalvavrik left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cescoffier commented Feb 23, 2026

Uh oh!

cescoffier commented Feb 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions bot commented Feb 18, 2026 •

edited

Loading

Status for workflow `Quarkus Documentation CI`

quarkus-bot bot commented Feb 19, 2026 •

edited by github-actions bot

Loading

Status for workflow `Quarkus CI`