Skip to content

detecting inconsistent .well-known/openid-configuration vs .well-known/oauth-authorization-server on conformance tests #863

Description

@jogu

Vaguely related to #862

It's suggest that the conformance test could fetch the version it's not currently using (so if it's using openid-configuration, also fetch oauth-authorization-server) and raise a warning if the contents are different, suggesting that (as the keys in the document trace back to the same IANA registry) the contents should be consistent and that interoperability / race conditions might occur if they differ.

If the fetch of the other location fails (e.g. 404) that would be ignored (unless #862 comes to a different conclusion).

An opinion from the working group on whether this is a good idea to check would be appreciated.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions