What this test does
Derives the well-known URL from the issuer — /.well-known/oauth-authorization-server inserted between the host and the issuer's path — and fetches it.
How it passes
The document is served there and names the same issuer. Not serving it is a warning: a client that starts from the issuer rather than from a profile page cannot find the metadata.
- Specification
- RFC 8414 §3
- Needs
- S105 Issuer identifier is valid