fix: accept the full discovery URL as the authority #13

Merged

ryan.mcgee merged 3 commits from fix/authority-discovery-url into main

2026-10-17 02:55:05 +00:00

ryan.mcgee commented

2026-10-17 02:33:11 +00:00

Owner

Summary

Make provider setup less error-prone: accept the full discovery URL as the Authority, and explain providers that sign id_tokens with a shared secret.

Changes

OidcClient.NormalizeAuthority/DiscoveryUrl reduce an Authority written either way to the issuer and discovery URLs; sign-in and Test provider both use them. Test provider notes when the full discovery URL was pasted, with no false issuer-mismatch warning.
Test provider now explains a provider that advertises only HS algorithms and publishes no signing keys (Authentik without a Signing Key selected): the plugin accepts only asymmetric signatures, so select a signing key at the provider. Other empty-key cases keep the generic message.
Form help text and README: which URL the Authority field expects, and the asymmetric signing key requirement. All examples use placeholder endpoints.

Verification

Regression tests written first and seen failing: full discovery URL (with and without a trailing slash) through Test provider and the sign-in discovery path; HS256-only provider with no keys. Mutations that disable the fix make them fail again.
89 tests pass, build 0 warnings, format clean.

## Summary - Make provider setup less error-prone: accept the full discovery URL as the Authority, and explain providers that sign id_tokens with a shared secret. ## Changes - `OidcClient.NormalizeAuthority`/`DiscoveryUrl` reduce an Authority written either way to the issuer and discovery URLs; sign-in and **Test provider** both use them. Test provider notes when the full discovery URL was pasted, with no false issuer-mismatch warning. - **Test provider** now explains a provider that advertises only HS algorithms and publishes no signing keys (Authentik without a Signing Key selected): the plugin accepts only asymmetric signatures, so select a signing key at the provider. Other empty-key cases keep the generic message. - Form help text and README: which URL the Authority field expects, and the asymmetric signing key requirement. All examples use placeholder endpoints. ## Verification - Regression tests written first and seen failing: full discovery URL (with and without a trailing slash) through Test provider and the sign-in discovery path; HS256-only provider with no keys. Mutations that disable the fix make them fail again. - 89 tests pass, build 0 warnings, format clean.

ryan.mcgee added 1 commit

2026-10-17 02:33:11 +00:00

fix: accept the full discovery URL as the authority

CI / verify (pull_request) Successful in 50s

Details

a828a5fbb1

- identity providers such as Authentik display the full
  .well-known/openid-configuration URL, and pasting it made discovery
  request the well-known path twice
- one helper now turns an authority written either way into the
  discovery URL, for sign-in and for Test provider
- Test provider notes when the full discovery URL was used
- the form help text and README say which URL the field expects

ryan.mcgee added 2 commits

2026-10-17 02:53:50 +00:00

docs: use neutral example endpoints 29444a06a5

- replace the application slug in the README example and the
  discovery tests with a placeholder

feat: explain providers that sign tokens with a shared secret

CI / verify (pull_request) Successful in 48s

Details

d67b9dc6c2

- a provider that advertises only HS algorithms and publishes no
  signing keys now gets a specific message from Test provider
- document that id_tokens must be signed with an asymmetric key

ryan.mcgee merged commit 03b121ee6f into main

2026-10-17 02:55:05 +00:00

ryan.mcgee deleted branch fix/authority-discovery-url

2026-10-17 02:55:05 +00:00

ryan.mcgee referenced this pull request from a commit

2026-10-17 02:55:05 +00:00

fix: accept the full discovery URL as the authority (#13)