cameleer/cameleer-server
1
0
Fork 0
Code Issues 44 Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix: append .well-known/openid-configuration to issuerUri in token exchanger
All checks were successful
CI / cleanup-branch (push) Has been skipped
Details
CI / build (push) Successful in 1m12s
Details
CI / docker (push) Successful in 40s
Details
CI / deploy-feature (push) Has been skipped
Details
CI / deploy (push) Successful in 38s
Details

Browse Source 
OidcTokenExchanger fetched the discovery document from the issuerUri
as-is, but the database stores the issuer URI (e.g. /oidc), not the
full discovery URL. Logto returns 404 for the bare issuer path.
SecurityConfig already appended the well-known suffix — now the token
exchanger does the same.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
hsiegeln
2026-04-06 01:04:57 +02:00
parent d7563902a7
commit 0fab20e67a
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
cameleer3-server-app/src/main/java/com/cameleer3/server/app/security/OidcTokenExchanger.java
View File

@@ -198,10 +198,10 @@ public class OidcTokenExchanger {
if (providerMetadata == null || !issuerUri.equals(cachedIssuerUri)) { if (providerMetadata == null || !issuerUri.equals(cachedIssuerUri)) {
synchronized (this) { synchronized (this) {
if (providerMetadata == null || !issuerUri.equals(cachedIssuerUri)) { if (providerMetadata == null || !issuerUri.equals(cachedIssuerUri)) {
// Fetch the discovery document from the URI as-is — do not append String discoveryPath = issuerUri.endsWith("/")
// .well-known/openid-configuration automatically, the user provides ? issuerUri + ".well-known/openid-configuration"
// the complete URL. : issuerUri + "/.well-known/openid-configuration";
URL discoveryUrl = new URI(issuerUri).toURL(); URL discoveryUrl = new URI(discoveryPath).toURL();
try (InputStream in = InsecureTlsHelper.openStream(discoveryUrl, securityProperties.isOidcTlsSkipVerify())) { try (InputStream in = InsecureTlsHelper.openStream(discoveryUrl, securityProperties.isOidcTlsSkipVerify())) {
JSONObject json = (JSONObject) new JSONParser(JSONParser.DEFAULT_PERMISSIVE_MODE) JSONObject json = (JSONObject) new JSONParser(JSONParser.DEFAULT_PERMISSIVE_MODE)
.parse(in); .parse(in);