Sandeep More created KNOX-3542:
----------------------------------
Summary: Serve OAuth well-known metadata at the Knox gateway root
Key: KNOX-3542
URL: https://issues.apache.org/jira/browse/KNOX-3542
Project: Apache Knox
Issue Type: Improvement
Components: Server
Reporter: Sandeep More
Assignee: Sandeep More
Knox serves OIDC discovery inside topologies (e.g.
`/gateway/<topology>/knoxidf/api/v1/.well-known/openid-configuration`).
MCP clients discover an issuer with a path through the RFC 8414 path-insertion
URL `https://<knox>/.well-known/oauth-authorization-server/<issuer-path>`. The
fallbacks are `/.well-known/openid-configuration/<issuer-path>` and
`<issuer>/.well-known/openid-configuration`.
Knox serves nothing at the root, so a gateway rewrite route forwards to the
topology's discovery document. MCP endpoints that Knox fronts need RFC 9728
Protected Resource Metadata at
`https://<knox>/.well-known/oauth-protected-resource/<resource-path>`, and Knox
serves none. The capability belongs at the Knox {*}gateway root{*}, not per
topology.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
