Discover OIDC endpoints from the issuer's well-known configuration. Validates that the discovery document's `issuer` field matches the configured issuer URL to prevent SSRF or misdirection.
(issuer: &str, insecure: bool)
| 43 | /// Validates that the discovery document's `issuer` field matches the |
| 44 | /// configured issuer URL to prevent SSRF or misdirection. |
| 45 | async fn discover(issuer: &str, insecure: bool) -> Result<OidcDiscovery> { |
| 46 | let normalized_issuer = issuer.trim_end_matches('/'); |
| 47 | let url = format!("{normalized_issuer}/.well-known/openid-configuration"); |
| 48 | let client = http_client(insecure); |
| 49 | let resp: OidcDiscovery = client |
| 50 | .get(&url) |
| 51 | .send() |
| 52 | .await |
| 53 | .into_diagnostic()? |
| 54 | .json() |
| 55 | .await |
| 56 | .into_diagnostic()?; |
| 57 | |
| 58 | let discovered_issuer = resp.issuer.trim_end_matches('/'); |
| 59 | if discovered_issuer != normalized_issuer { |
| 60 | return Err(miette::miette!( |
| 61 | "OIDC discovery issuer mismatch: expected '{}', got '{}'", |
| 62 | normalized_issuer, |
| 63 | discovered_issuer |
| 64 | )); |
| 65 | } |
| 66 | Ok(resp) |
| 67 | } |
| 68 | |
| 69 | fn http_client(insecure: bool) -> reqwest::Client { |
| 70 | let mut builder = reqwest::ClientBuilder::new().redirect(reqwest::redirect::Policy::none()); |