OIDC Discovery URL Builder

Every identity provider speaking OpenID Connect publishes a discovery document with the endpoint addresses, the public keys, the scopes and the supported algorithms. Knowing the issuer, a client assembles that URL, fetches the document and configures itself — which saves pasting half a dozen addresses by hand into every application.

Enter the issuer and the page assembles the URL. The rule is fixed: the discovery path is appended to the issuer, with no doubled slash. It is worth paying attention because the issuer sometimes already carries a path — with providers hosting multiple logical domains, the issuer may end in something like an organisation identifier, and the discovery path goes after it, not at the domain root.

One detail causes a failure that is hard to diagnose: the issuer value inside the returned document must match exactly the issuer you used to build the URL, including the presence or absence of a trailing slash. The specification requires that check, and serious libraries perform it — the symptom of a mismatch is an invalid-issuer error right after the document downloaded successfully.