|
| Description: |
Github Issue Link: [Also expose OAuth AS metadata at .well-known/oauth-authorization-server by Splashing23 - Pull Request #138 - xwiki-contrib/oidc|https://github.com/xwiki-contrib/oidc/pull/138]
h2.
Summary
* Register the existing OIDC discovery handler for {{.well-known/oauth-authorization-server}} in addition to {{{}.well-known/openid-configuration{}}}.
* Lets MCP/OAuth clients that follow RFC 8414 discover XWiki's authorization/token/registration endpoints instead of falling back to guessing {{/authorize}} on the host root.
h2. Context
XWiki already returns correct OpenID Connect Discovery JSON at {{{}/oidc/.well-known/openid-configuration{}}}. MCP clients (and similar OAuth resource clients) often request {{/oidc/.well-known/oauth-authorization-server}} first per RFC 8414. That path currently 404s, which breaks discovery even when Protected Resource Metadata correctly points at the {{/oidc}} issuer.
h2. Test plan
* {{GET /oidc/.well-known/oauth-authorization-server}} returns 200 with the same metadata JSON as openid-configuration
* {{GET /oidc/.well-known/openid-configuration}} still returns 200 unchanged
* Confirm {{{}authorization_endpoint{}}}, {{{}token_endpoint{}}}, {{{}issuer{}}}, and {{registration_endpoint}} are present |
|
