# `ExMCP.Authorization.OIDCDiscovery`
[🔗](https://github.com/azmaveth/ex_mcp/blob/v1.0.0/lib/ex_mcp/authorization/oidc_discovery.ex#L1)

OpenID Connect Discovery support for MCP authorization.

Implements OIDC Discovery (OpenID Connect Discovery 1.0) which allows
fetching and parsing `.well-known/openid-configuration` documents.

This extends the OAuth 2.1 authorization server metadata discovery
with OIDC-specific fields like `userinfo_endpoint` and
`id_token_signing_alg_values_supported`.

Available in protocol version 2025-11-25.

# `oidc_metadata`

```elixir
@type oidc_metadata() :: %{required(String.t()) => term()}
```

# `build_metadata`

```elixir
@spec build_metadata() :: oidc_metadata()
```

Builds local OIDC-compatible metadata from application configuration.

Extends the base OAuth metadata from `AuthorizationServerMetadata.build_metadata/0`
with OIDC-specific fields.

# `discover`

```elixir
@spec discover(
  String.t(),
  keyword()
) :: {:ok, oidc_metadata()} | {:error, term()}
```

Discovers authorization server metadata using OIDC Discovery with
fallback to OAuth 2.0 Authorization Server Metadata (RFC 8414).

Tries `.well-known/openid-configuration` first, then falls back to
`.well-known/oauth-authorization-server`.

## Parameters
- `issuer` - The issuer URL to discover metadata for
- `opts` - Hardened metadata-fetch options. Custom clients use
  `get(uri, approved_address, opts)` so DNS validation cannot be bypassed by
  re-resolving the hostname.

## Returns
- `{:ok, metadata}` - Successfully fetched metadata
- `{:error, reason}` - Failed to fetch metadata

Discovery metadata is HTTPS-only, bounded, address-pinned, and issuer-checked
before it is returned.

# `oidc_compliant?`

```elixir
@spec oidc_compliant?(oidc_metadata()) :: boolean()
```

Checks if the metadata is OIDC-compliant (vs plain OAuth 2.0).

Returns true if the metadata contains OIDC-specific fields.

# `validate_metadata`

```elixir
@spec validate_metadata(oidc_metadata(), String.t(), keyword()) ::
  :ok | {:error, term()}
```

Validates that the discovered metadata contains required OIDC fields.

## Required Fields
- `issuer` - Must match the expected issuer
- `authorization_endpoint` - URL of the authorization endpoint
- `token_endpoint` - URL of the token endpoint

## OIDC-specific Fields (optional but recommended)
- `userinfo_endpoint`
- `jwks_uri`
- `id_token_signing_alg_values_supported`
- `subject_types_supported`

---

*Consult [api-reference.md](api-reference.md) for complete listing*