Path‑aware OAuth discovery builds an invalid URL #128
Description
1 mcp‑remote fetches ( I use Keycloack as my auth server )
GET http://localhost:54001/.well-known/oauth-protected-resource
and receives:
{ "authorization_servers": [ "https://xxx:40020/auth/realms/myRealm" ], … }
2 It then tries to load OAuth metadata for that issuer, but the URL it constructs is invalid:
https://xxx:40020/.well-known/oauth-authorization-server/auth/realms/myRealm
3 Discovery fails, CLI falls back to root discovery, Keycloak still rejects the subsequent token request with
nvalid OAuth error response: SyntaxError: Unexpected token '<', "<bod"...
Expected behaviour
mcp‑remote should request the RFC 8414 path‑aware discovery document at
https://xxx:40020/auth/realms/myRealm/.well-known/oauth-authorization-server
and proceed with the OAuth flow.
Root cause (code)
function buildWellKnownPath(pathname)
{
if(pathname.endsWith('/')) {
pathname = pathname.slice(0, -1);
}
let wellKnownPath = `${pathname}/.well-known/oauth-authorization-server`;
return wellKnownPath;
}