Reads a provider's discovery document from the server, not the browser.
Why the server and not the panel
Discovery only says a provider should let browsers read its document, and many do not: the panel's own fetch is blocked by CORS on the very providers self-hosted instances tend to use. The server has no origin, so the fetch works, and it is the same fetch sign-in will make: a document reachable here is reachable from the sign-in path, which a browser could never confirm.
What it does not do
Touch the cache. This is a URL being tried out in a form; caching its answer would let an unsaved value decide what a real sign-in talks to.
Errors
400 for an address this instance would not accept as an issuer, or one
the provider's document cannot be read from. 401, 403 and 404 as for
[list].
sessiontessera_session<token>Set by POST /auth/login. A browser sends it automatically; it is HttpOnly, so page scripts cannot read or set it.
application/json- body
Body of POST /admin/settings/oidc/discovery.
url*stringThe issuer, or the .well-known URL copied from the provider's docs.
Either works: the suffix is stripped before fetching, and issuer is
what comes back.
What the provider says about itself
application/json- response
What a provider says about itself, as the panel needs it.
backchannel_logout_supported*booleanWhether it notifies this instance when a user signs out.
claims_supported*array<string>The claims it advertises. Without email_verified,
link_by_email = when_verified will never link anyone through this
provider; the options left are always, or signing in and linking it.
issuer*stringThe provider's own issuer value, which is what auth.oidc.issuer must
be set to.
scopes_supported*array<string>The scopes it advertises, so a form can offer them instead of having the operator type them.
curl -X POST 'https://example.com/api/v1/admin/settings/oidc/discovery' \ -H 'Content-Type: application/json' \ -d '{ "url": "string"}'{ "backchannel_logout_supported": true, "claims_supported": [ "string" ], "issuer": "string", "scopes_supported": [ "string" ]}