Support /.well-known/oauth-authorization-server

[mitar]

This allows auto-configuration of the OAuth client.

See more information in this RFC: https://tools.ietf.org/html/rfc8414

Example: https://developer.okta.com/docs/reference/api/oidc/#well-known-oauth-authorization-server

There is similar configuration for OpenID Connect, which could also be provided: https://developer.okta.com/docs/reference/api/oidc/#well-known-openid-configuration

[TomDemeranville]

Hi Mitar,

We already support open id configuration at https://orcid.org/.well-known/openid-configuration but was not aware of https://tools.ietf.org/html/rfc8414

Do you know how different the formats are? Can we simply deliver the same metadata from both?

[mitar]

You can, but the oauth-authorization-server has few more fields, e.g.:

• revocation_endpoint
• revocation_endpoint_auth_methods_supported
• revocation_endpoint_auth_signing_alg_values_supported
• introspection_endpoint
• introspection_endpoint_auth_methods_supported
• introspection_endpoint_auth_signing_alg_values_supported
• code_challenge_methods_supported

At the same time openid-configuration has some extra fields, e.g.:

• acr_values_supported
• subject_types_supported
• id_token_signing_alg_values_supported
• id_token_encryption_alg_values_supported
• id_token_encryption_enc_values_supported
• userinfo_signing_alg_values_supported
• userinfo_encryption_alg_values_supported
• userinfo_encryption_enc_values_supported
• request_object_signing_alg_values_supported
• request_object_encryption_alg_values_supported
• request_object_encryption_enc_values_supported
• display_values_supported
• claim_types_supported
• claims_supported
• claims_locales_supported
• claims_parameter_supported
• request_parameter_supported
• request_uri_parameter_supported
• require_request_uri_registration

Because both of them allow additional parameters, I think it is safe to have only one metadata and serve it at both locations.

[mitar]

We already support open id configuration

Oh, I missed that. I see why. Because it does not allow CORS access. I will open another issue for that.

Edit: Done: #5978