Add url of the "https://.../.well-known/openid-configuration."

[daisukenishino]

Requirement

• Reference
  • IdM実験室: [AD FS]OpenID Connectに対応した次期AD FSを試す
    https://idmlab.eidentity.jp/2015/08/ad-fsopenid-connectad-fs.html
  • OAuth & OpenID Connect 関連仕様まとめ > 10. OpenID Connect Discovery 1.0
    https://qiita.com/TakahikoKawasaki/items/185d34814eb9f7ac7ef3#10-openid-connect-discovery-10
• This specification complies with
  • RFC 8414 - OAuth 2.0 Authorization Server Metadata
  • and OpenID Connect Discovery 1.0.

[daisukenishino2]

Example

• https://fqdn/.well-known/oauth-authorization-server

HTTP/1.1 200 OK
Content-Type: application/json

{
 "issuer":
   "https://server.example.com",
 "authorization_endpoint":
   "https://server.example.com/authorize",
 "token_endpoint":
   "https://server.example.com/token",
 "token_endpoint_auth_methods_supported":
   ["client_secret_basic", "private_key_jwt"],
 "token_endpoint_auth_signing_alg_values_supported":
   ["RS256", "ES256"],
 "userinfo_endpoint":
   "https://server.example.com/userinfo",
 "jwks_uri":
   "https://server.example.com/jwks.json",
 "registration_endpoint":
   "https://server.example.com/register",
 "scopes_supported":
   ["openid", "profile", "email", "address",
    "phone", "offline_access"],
 "response_types_supported":
   ["code", "code token"],
 "service_documentation":
   "http://server.example.com/service_documentation.html",
 "ui_locales_supported":
   ["en-US", "en-GB", "en-CA", "fr-FR", "fr-CA"]
}

• https://fqdn/.well-known/openid-configuration

HTTP/1.1 200 OK
Content-Type: application/json

{
  "issuer":"https://adfs.example.com/adfs",
  "authorization_endpoint":"https://adfs.example.com/adfs/oauth2/authorize/",
  "token_endpoint":"https://adfs.example.com/adfs/oauth2/token/",
  "jwks_uri":"https://adfs.example.com/adfs/discovery/keys",
  "token_endpoint_auth_methods_supported":
  [
    "client_secret_post",
    "client_secret_basic",
    "private_key_jwt",
    "windows_client_authentication"
  ],
  "response_types_supported":
  [
    "code",
    "id_token",
    "code id_token",
    "token id_token"
  ],
  "response_modes_supported":
  [
    "query",
    "fragment",
    "form_post"
  ],
    "grant_types_supported":
  [
    "authorization_code",
    "refresh_token",
    "client_credentials",
    "urn:ietf:params:oauth:grant-type:jwt-bearer",
    "implicit",
    "password",
    "srv_challenge"
  ],
  "subject_types_supported":
  [
    "pairwise"
  ],
  "scopes_supported":
  [
    "openid",
    "profile",
    "email",
    "logon_cert",
    "aza",
    "vpn_cert",
    "user_impersonation"
  ],
  "id_token_signing_alg_values_supported":
  [
    "RS256"
  ],
  "token_endpoint_auth_signing_alg_values_supported":
  [
    "RS256"
  ],
  "access_token_issuer":"http://adfs.example.com/adfs/services/trust",
  "claims_supported":
  [
    "aud",
    "iss",
    "iat",
    "exp",
    "auth_time",
    "nonce",
    "at_hash",
    "c_hash",
    "sub",
    "upn",
    "unique_name",
    "pwd_url",
    "pwd_exp"
  ],
  "microsoft_multi_refresh_token":true,
  "userinfo_endpoint":"https://adfs.example.com/adfs/userinfo"
}

Else

• OpenID Connect  |  Google Identity Platform  |  Google Developers
  https://developers.google.com/identity/protocols/OpenIDConnect
• Yahoo! ID連携:OpenID Configurationエンドポイント - Yahoo!デベロッパーネットワーク
  https://developer.yahoo.co.jp/yconnect/v2/hybrid/configuration.html
• OpenID Connect 検出エンドポイント
  https://help.salesforce.com/articleView?id=remoteaccess_using_openid_discovery_endpoint.htm&type=5
• oauth 2.0 - OpenID Connect Configuration for Facebook - Stack Overflow
  https://stackoverflow.com/questions/24402151/openid-connect-configuration-for-facebook
• OpenID Connect & OAuth 2.0 API | Okta Developer
  https://developer.okta.com/docs/api/resources/oidc

[daisukenishino2]

Specification in this product

• https://fqdn/.well-known/openid-configuration

HTTP/1.1 200 OK
Content-Type: application/json

{
  "issuer":"OAuthIssuerIdの値",
  "access_token_issuer":"OAuthIssuerIdの値",
  "authorization_endpoint": ["OAuthAuthorizeEndpointの値", "OAuthAuthorizeEndpoint2の値"],
  "token_endpoint": ["OAuthBearerTokenEndpointの値", "OAuthBearerTokenEndpoint2の値"],
  "userinfo_endpoint":"OAuthGetUserClaimsWebAPIの値",
  "token_endpoint_auth_methods_supported":
  [
    "client_secret_basic",
    "private_key_jwt"
  ],
  "response_types_supported":
  [
    "code",
    "token",
    "id_token token",
    "code token"
    "code id_token",
    "code id_token token"
  ],
  "response_modes_supported":
  [
    "query",
    "form_post"
  ],
  "grant_types_supported":
  [
    "authorization_code",
    "implicit",
    "password",
    "client_credentials",
    "refresh_token",
    "urn:ietf:params:oauth:grant-type:jwt-bearer"
  ],
  "subject_types_supported":
  [
    "pairwise"
  ],
  "scopes_supported":
  [
    "auth",
    "openid",
    "profile",
    "email",
    "phone",
    "address",
    "userid",
    "roles"
  ],
  "token_endpoint_auth_signing_alg_values_supported":
  [
    "RS256"
  ],
  "id_token_signing_alg_values_supported":
  [
    "RS256"
  ],
  "claims_supported":
  [
    "iss",
    "aud",
    "nonce",
    "sub",
    "iat",
    "exp",
    "nbf",
    "iat",
    "jti",
    "at_hash",
    "c_hash"
  ],
  "revocation_endpoint":"OAuthRevokeTokenWebAPIの値",
  "revocation_endpoint_auth_methods_supported":
  [
    "client_secret_basic"
  ],
  "introspection_endpoint":"OAuthIntrospectTokenWebAPIの値",
  "introspection_endpoint_auth_methods_supported":
  [
    "none"
  ],
  "code_challenge_methods_supported":
  [
    "plain",
    "S256"
  ],
  "jwks_uri":"https://fqdn/jwks.json", // config化
  "service_documentation":"・・・"
}