Support multi-tenancy using the path component for issuer

[frederikz]

Hi,

The openid-configuration endpoint is always available under /.well-known/openid-configuration . For an issuer https://example.com/issuer1 I would have expected it to be availabe under /issuer1/.well-known/openid-configuration according to https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest .

Related gh-1435 gh-663

[jgrandja]

@frederikz Are you having an issue with your current set up? Are you trying to set up multi-tenancy and running into an issue?

[frederikz]

Yes, in a multitenant setup I have multiple issuers for one host. I saw in the spec that you can add a path to the issuer which is then also expected in the configuration endpoint. But at the moment OidcProviderConfigurationEndpointFilter uses a request matcher with a fixed path not according to the issuer path and you can't configure it to use your own request matcher that e.g. uses /*/.well-known/openid-configuration. I can also add it to gh-663 but I don't think it is only missing documentation - at least the way how I implement multi-tenancy.
I classified it as a bug as e.g. the OidcProviderConfigurationTests configures an issuer https://example.com/issuer1 and then expects the configuraion endpoint to be /.well-known/openid-configuration but shouldn't it even in a single tenant setup be /issuer1/.well-known/openid-configuration?

[jgrandja]

@frederikz Thanks for the details. We'll look at this shortly.

[FoxNeo]

This is the same issue I've had trying to have an OIDC Discovery endpoint on a different path /
As mentioned in #1409
The Builder could be modified to override OidcProviderConfigurationEndpointFilter like:

	public static Builder builder() {
		return new Builder()
		        .discoveryEndpoint("/metadata/.well-known/openid-configuration")
			.authorizationEndpoint("/oauth2/authorize")
			.deviceAuthorizationEndpoint("/oauth2/device_authorization")
			.deviceVerificationEndpoint("/oauth2/device_verification")
			.tokenEndpoint("/oauth2/token")
			.tokenIntrospectionEndpoint("/oauth2/introspect")
			.tokenRevocationEndpoint("/oauth2/revoke")
			.jwkSetEndpoint("/oauth2/jwks")
			.oidcLogoutEndpoint("/connect/logout")
			.oidcUserInfoEndpoint("/userinfo")
			.oidcClientRegistrationEndpoint("/connect/register");
	}

Or add a Builder with Prefix

            public static Builder builderWithPrefix(@NonNull String prefix) {
		return new Builder()
				.metadataPrefix(prefix + "/.well-known/openid-configuration")
				.authorizationEndpoint(prefix + "/oauth2/authorize")
				.tokenEndpoint(prefix +"/oauth2/token")
				.jwkSetEndpoint(prefix +"/oauth2/jwks")
				.tokenRevocationEndpoint(prefix +"/oauth2/revoke")
				.tokenIntrospectionEndpoint(prefix +"/oauth2/introspect")
				.oidcClientRegistrationEndpoint(prefix +"/connect/register")
				.oidcUserInfoEndpoint(prefix + "/userinfo");
	}