Flow 1
Discover an OP
- 1
Start from an issuer (IdP URL or from PRM/AS metadata).
- 2
GET openid-configuration. If that fails, MCP also tries RFC 8414 paths.
- 3
Reject issuer mismatch. Cache JWKS from jwks_uri.
OIDF · Final (errata updates ongoing)
OpenID Connect Discovery 1.0
OpenID.Discovery
OIDF FinalStableIdentity + Authn + AuthzFoundationField guide
Runtime discovery of 'where does this user authenticate' is mandatory once agents use many IdPs.
At a glance
- Problem
- Relying parties need to discover OP endpoints and capabilities from an issuer URL.
- Identity / authn / authz
- Discovery for the identity layer, parallel to RFC 8414.
Actors
- Relying party
- OpenID provider
01
The gap for agents
Relying parties need to discover OP endpoints and capabilities from an issuer URL. Runtime discovery of 'where does this user authenticate' is mandatory once agents use many IdPs. MCP clients must support this in addition to RFC 8414.
02
Actors and trust boundaries
Issuer URL comparison is exact. A document that lies about issuer is an attack. Path insertion/append variants exist; implement the ones MCP requires so you do not miss a multi-tenant OP.
03
Mechanics
GET {issuer}/.well-known/openid-configuration (with path insertion/append variants). Validate issuer. Use authorization_endpoint, token_endpoint, jwks_uri, userinfo_endpoint, id_token_signing_alg_values_supported, etc.
- issuerfrom spec
- Quoted: must match the identifier used to construct the well-known URL.
04
Step-by-step flows
05
Identity vs authentication vs authorization
Discovery for the identity layer, parallel to RFC 8414. Some OPs publish both documents; they should agree on issuer.
06
How it composes
- OpenID Connect Core
How you use the endpoints you discovered.
- AS metadata
OAuth-only ASes may only have 8414. MCP requires both client-side.
- MCP authorization
MUST support both discovery mechanisms.
07
What bites agent implementers
Trailing slash / path issuers
https://issuer.example/tenant is not https://issuer.example/tenant/. Implement the spec's path rules.
08
Stability — what you can ship
OIDF Final (errata updates ongoing). Stable. https://openid.net/specs/openid-connect-discovery-1_0.html
Catalog claims (short form)
- issuer
- Must match the identifier used to construct the well-known URL.
Implementer notes
Issuer URL comparison is exact. A document that lies about issuer is an attack.
Relationship to others
Primary sources
- Discovery spechttps://openid.net/specs/openid-connect-discovery-1_0.html