[Openid-specs-risc] Conformance Iss/JWKS_URl and Discovery

[Thomas Darimont]

Sending again because I didn't include the mailing list.

Hi Phil,

Thank you for your question, the short answer is that issuer1 is not an encoded URL. It's simply the path component of the issuer URL.

The iss is a full URL, e.g. https://transmitter.example.com/issuer1. Discovery follows the RFC 8414 §3 "path insertion" rule,
described in https://datatracker.ietf.org/doc/html/rfc8414#section-3  (the same approach OAuth Authorization Server Metadata uses): the well-known segment is inserted
between the host and the issuer's path, rather than appended.

Some examples:
- iss = https://transmitter.example.com/issuer1
→ GET https://transmitter.example.com/.well-known/ssf-configuration/issuer1
- iss = https://transmitter.example.com (no path)
→ GET https://transmitter.example.com/.well-known/ssf-configuration

That last case is probably what made issuer1 look like it might be encoded it's just the trailing path segment, as is.

One clarification on the "must be the same value" point: the equality the tests enforce is that the issuer value inside the returned configuration document
must match the URL the document was retrieved from (an anti-impersonation check, mirroring OIDC/RFC 8414 issuer validation).
This is not a requirement that iss equals jwks_uri, since jwks_uri is a separate URL pointing to the transmitter's signing keys and can be any value the transmitter chooses.
The transmitter assigns iss/aud/jwks_uri itself, and the receiver can't override them.

Hope that helps,
Thomas

---------------------
Thomas Darimont
Certification Specialist | Certification Team
OpenID Foundation

________________________________
From: Openid-specs-risc <openid-specs-risc-bounces at lists.openid.net> on behalf of Phillip Hunt via Openid-specs-risc <openid-specs-risc at lists.openid.net>
Sent: Monday, June 22, 2026 11:41 PM
To: OpenID RISC List <openid-specs-risc at lists.openid.net>
Subject: [Openid-specs-risc] Conformance Iss/JWKS_URl and Discovery

Hi,

I see in the conformance tests that the SSF Transmitters assign values iss/aud/jwks url values and cannot be suggested by the receivers. Also, that iss and jwks_url must be the same value.

If “iss” is now a URL, how does well-known discovery work given the format is:

GET /.well-known/ssf-configuration/issuer1

Is issuer1 an encoded URL value?   Am I reading this wrong?

Phil
phil.hunt at independentid.com






-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs-risc/attachments/20260623/8685c467/attachment-0001.htm>