Package org.mockserver.oidc

Class OidcIssuerResolver

java.lang.Object
org.mockserver.oidc.OidcIssuerResolver
public final class OidcIssuerResolver extends Object
Resolves the OIDC issuer for a request.

OIDC Discovery §4.3 requires that the issuer in the discovery document be identical to the URL the relying party used to fetch it — every conformant client library (Spring Security, nimbus, pac4j, `oidc-client`, MSAL) validates this and refuses to proceed when it does not match.

The issuer therefore cannot be a fixed string. It was previously hardcoded to http://localhost:1080, which broke the single most common way people run a mock OIDC provider: a Testcontainers-mapped random port. The relying party fetches discovery from http://localhost:49173, is told the issuer is http://localhost:1080, and fails.

So the issuer is derived per request from the Host header, unless OidcProviderConfiguration.getIssuer() was explicitly configured — an explicit value always wins, so a test that needs a stable, externally-meaningful issuer can still pin one.

  • Method Details

    • resolve

      public static String resolve(OidcProviderConfiguration config, HttpRequest request)
      Resolves the issuer to advertise for this request.
      Parameters:
      config - the provider configuration; an explicit issuer wins
      request - the inbound request, used to derive scheme + authority when no issuer is configured
      Returns:
      the issuer, never null and never with a trailing slash