Update OIDC metadata section with mtls_endpoint_aliases #127923
Conversation
Added information about mtls_endpoint_aliases in OIDC metadata for Mutual-TLS Client Authentication.
|
@jsoveral : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
|
Learn Build status updates of commit 3cb3d7c: ✅ Validation status: passed
For more details, please refer to the build report. |
There was a problem hiding this comment.
Pull Request Overview
This PR updates the OIDC metadata documentation to inform users that mtls_endpoint_aliases is included in the metadata as part of Mutual-TLS Client Authentication support, referencing RFC 8705.
Key Changes:
- Enhanced the OIDC metadata section with information about
mtls_endpoint_aliasessupport for Mutual-TLS Client Authentication
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| > - Your app must provide the client secret if you want users to acquire access tokens using the interactive authorization code flow. If you don't want to acquire access tokens, you don't need to use a secret. | ||
| You also need the provider's OIDC metadata. This metadata is often exposed in a [configuration metadata document](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig) that you can get at the path formed by appending `/.well-known/openid-configuration` to the provider's issuer URL. | ||
| You also need the provider's OIDC metadata. This metadata is often exposed in a [configuration metadata document](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig) that you can get at the path formed by appending `/.well-known/openid-configuration` to the provider's issuer URL. We are including mtls_endpoint_aliases in the metadata as part of [Mutual-TLS Client Authentication](https://datatracker.ietf.org/doc/html/rfc8705). |
There was a problem hiding this comment.
[nitpick] The sentence structure is awkward with 'We are including' which implies the document author is implementing this feature. Consider rephrasing to: 'The metadata includes mtls_endpoint_aliases as part of Mutual-TLS Client Authentication.' This maintains a more neutral, descriptive tone appropriate for documentation.
| You also need the provider's OIDC metadata. This metadata is often exposed in a [configuration metadata document](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig) that you can get at the path formed by appending `/.well-known/openid-configuration` to the provider's issuer URL. We are including mtls_endpoint_aliases in the metadata as part of [Mutual-TLS Client Authentication](https://datatracker.ietf.org/doc/html/rfc8705). | |
| You also need the provider's OIDC metadata. This metadata is often exposed in a [configuration metadata document](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig) that you can get at the path formed by appending `/.well-known/openid-configuration` to the provider's issuer URL. The metadata includes `mtls_endpoint_aliases` as part of [Mutual-TLS Client Authentication](https://datatracker.ietf.org/doc/html/rfc8705). |
|
Can you review the proposed changes? IMPORTANT: When the changes are ready for publication, adding a #label:"aq-pr-triaged" |
prmerger-automator
bot
added
the
aq-pr-triaged
3 participants
Added information about mtls_endpoint_aliases in OIDC metadata for Mutual-TLS Client Authentication.