OpenID Connect ".well-known" provider config

[sparty02]

Summary

Currently, all of the OpenID Conenct provider configuration (authorization-uri, token-uri, user-info-uri, jwk-set-uri) can be established in the spring security environment using application.yml. However, the OpenID Connect spec also defines a ".well-known" discovery endpoint that can be used to get all of this provider config as well. The spring config should allow for some kind of "well-known" endpoint uri to be set that would then provide the rest of the related uris,

Actual Behavior

All provider configuration must be explicitly defined in the application environment properties, e.g.:

spring:
  security:
    oauth2:
      client:
        provider:
          okta:
            authorization-uri: https://dev-119999.oktapreview.com/oauth2/v1/authorize
            token-uri: https://dev-119999.oktapreview.com/oauth2/v1/token
            user-info-uri: https://dev-119999.oktapreview.com/oauth2/v1/userinfo
            jwk-set-uri: https://dev-119999.oktapreview.com/oauth2/v1/keys
            user-name-attribute: sub

Expected Behavior

An abbreviated configuration could be done using the spec'ed "well-known" provider configuration discovery mechanism, e.g.:

spring:
  security:
    oauth2:
      client:
        provider:
          okta:
            openid-configuration-uri: https://dev-119999.oktapreview.com/.well-known/openid-configuration

Note, the above "openic-configuration-uri" is live and show an example of the spec'ed well-known openid-configuration uri.

Comments

Version

5.0.3.RELEASE

[sparty02]

Implementation note: This could be done somewhere around here, where the config originally gets loaded/set.

[rwinch]

Thanks for the report @sparty02! This issue is a duplicate of #4413

[sparty02]

Thanks @rwinch . I searched around, but totally missed that issue.

[rwinch]

Not a problem...it took me a few searches to find it myself :) Thanks for taking the time to report the improvement request!