Where should openIdConnectUrl point to?

[m-mohr]

I'm trying to use the openIdConnect security scheme as defined in OpenAPI 3.1 and I think openIdConnectUrl is lacking some information.

What is expected to be provided for openIdConnectUrl?

• The issuer URL, e.g. https://openapi.example (so tooling would append need to append /.well-known/openid-configuration)
• The well-known document directly, e.g. https://openapi.example/.well-known/openid-configuration

Once answered, happy to create a PR to clarify this.

[SensibleWood]

Of your two examples it should be the latter i.e. the URL is expected to point to the discovery document for a given OpenID Provider.

This section of the OpenAPI specification points to the OpenID Discovery specification, hence it should be the discovery document not the issuer URL.

Looking at the wording of the OpenAPI specification it could indeed be more explicit (in my opinion) although it does say:

OpenId Connect URL to discover OAuth2 configuration values

So there is some reference to discovery in there.

[m-mohr]

Thanks for verifying that. I agree that it could be made a bit more explicit, e.g. with an example.

[handrews]

@m-mohr I think this was clarified for the next patch release by PR #3607, so between that and the answer here being accepted, I'm going to close out this discussion.

[m-mohr]

PR #3607 doesn't clarify it for me.

[m-mohr]

Trying to clarify in #3718

[handrews]

@m-mohr thanks for the PR, I've added it to the weekly call agenda in case it doesn't get reviewed before then (Thursday).