Question: Need different domains from metadata response

Due to some unfortunate infrastructure we have the server hosted on one domain and the Cypress browser accessing it from another domain.

Dotnet allows me to specify a URL to get the metadata but that response needs to contain url that the browser can use.

http://auth0sim:5070/.well-known/openid-configuration

response:

{
issuer: "http://localhost:5070/.well-known/openid-configuration",
authorization_endpoint: "http://localhost:5070/.well-known/openid-configuration/authorize",
...

[mrsladek]

@ybelMekk The problem with Host header is that it is not longer supported to change it since JDK 12 (https://bugs.openjdk.org/browse/JDK-8213696).

Would it be possible to fix host of the metadata (or only the issuer) to a particular value with a config parameter? I think it would be necessary in this kind of scenarios.

[ybelMekk]

@ybelMekk The problem with Host header is that it is not longer supported to change it since JDK 12 (https://bugs.openjdk.org/browse/JDK-8213696).

Would it be possible to fix host of the metadata (or only the issuer) to a particular value with a config parameter? I think it would be necessary in this kind of scenarios.

It sounds useful yes, but the container, when requesting metadata e.g. a call to curl http://oauth2:8080/default/.well-known/openid-configuration gives:

{
  "issuer" : "http://oauth2:8080/default",
  "authorization_endpoint" : "http://oauth2:8080/default/authorize",
  "end_session_endpoint" : "http://oauth2:8080/default/endsession",
  "token_endpoint" : "http://oauth2:8080/default/token",
  "userinfo_endpoint" : "http://oauth2:8080/default/userinfo",
  "jwks_uri" : "http://oauth2:8080/default/jwks",
  "introspection_endpoint" : "http://oauth2:8080/default/introspect",
  "response_types_supported" : [ "query", "fragment", "form_post" ],
  "subject_types_supported" : [ "public" ],
  "id_token_signing_alg_values_supported" : [ "ES256", "ES384", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512" ]
}

then you call the jwks endpoint: curl http://oauth2:8080/default/jwks you will get some data, but if you say change the well known metadata issuer to: yolo

you’ll get what you want

{
  "issuer" : "http://yolo:8080/default"
......

but a curl to “http://yolo:8080/default” will give you curl: (6) Could not resolve host: yolo

So host of container and returned metadata must match, but we could set the issuer and metadata issuer to SERVER_HOSTNAME value as specified.