Description

Keycloak does not support RFC8414, and the .well-known endpoint that returns server metadata has the following format:

https://keycloak.example.com/realms/{realm}/.well-known/oauth-authorization-server

RFC8414 specifies the following format:

https://keycloak.example.com/.well-known/oauth-authorization-server/realms/{realm}

It would be better to add a feature that supports well-known endpoints in RFC8414 format while maintaining backward compatibility.

Discussion

#40809

Motivation

It is better to comply with RFC8414 to support specifications such as OpenId4VCI.

Details

For classes that accept realms/{realm}/.well-known/ and return metadata, how about accepting /.well-known/realms/{realm} as well?