title: Issuer mismatch with OpenID Connect discovery on WSO2 Identity Server
body: <p>I'm working on a small proof-of-concept implementation involving <a href="http://openid.net/connect/" rel="nofollow noreferrer">OpenID Connect</a> and <a href="http://wso2.com/products/identity-server/" rel="nofollow noreferrer">WSO2 Identity Server</a> 5.3.0.</p>
  
  <p>On the client side, I'm using python with the <a href="https://pypi.python.org/pypi/oic" rel="nofollow noreferrer"><code>oic</code></a> library to attempt to get the discovery mechanism working. I'm executing the following code, based on the <a href="http://pyoidc.readthedocs.io/en/latest/howto/rp.html" rel="nofollow noreferrer"><code>oic</code> documentation</a>:</p>
  
  <pre><code>from oic.oic import Client
  
  oic_client = Client(verify_ssl=False)
  
  uid = "admin@172.22.0.2"
  issuer = oic_client.discover(uid)
  provider_info = oic_client.provider_config(issuer)
  </code></pre>
  
  <p>This results in the following error:</p>
  
  <blockquote>
    <p>oic.exception.IssuerMismatch:
    '<a href="https://172.22.0.2:443/oauth2/oidcdiscovery" rel="nofollow noreferrer">https://172.22.0.2:443/oauth2/oidcdiscovery</a>' !=
    '<a href="https://172.22.0.2:443/oauth2/token" rel="nofollow noreferrer">https://172.22.0.2:443/oauth2/token</a>'</p>
  </blockquote>
  
  <p>The problem here is that with the default configuration, the <code>discover()</code> step will return an <code>issuer</code> value of <code>https://172.22.0.2:443/oauth2/oidcdiscovery</code>, but the subsequent <code>provider_config()</code> step will return a document containing an issuer value of <code>https://172.22.0.2:443/oauth2/token</code>.</p>
  
  <p>The <code>oic</code> library seems to be correct in reporting this mismatch as an error, as the <a href="https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata" rel="nofollow noreferrer">OpenID Connect Discovery specification</a> states the following about the <code>issuer</code> value presented in the provider metadata (emphasis mine):</p>
  
  <blockquote>
    <p>REQUIRED. URL using the <code>https</code> scheme with no query or
    fragment component that the OP asserts as its Issuer Identifier. If
    Issuer discovery is supported (see Section 2), <strong>this value MUST be
    identical to the issuer value returned by WebFinger</strong>. This also MUST
    be identical to the <code>iss</code> Claim value in ID Tokens issued from this
    Issuer.</p>
  </blockquote>
  
  <p>So, my question is the following: </p>
  
  <ol>
  <li>Am I correct in concluding that (at least with the default configuration) WSO2 Identity Server does not behave conform to the OpenID Connect specification, at least as far as discovery is concerned?</li>
  <li>Is it possible to configure WSO2 Identity Server in such a way that will conform to the spec? I have tried specifying various combinations of <code>OIDCDiscoveryEPUrl</code> and <code>IDTokenIssuerID</code> in the <code>identity.xml</code> file, but no luck so far.</li>
  </ol>
  
  <p>For now, after reading through the <code>oic</code> source code, I'm using the following workaround to ignore the issuer mismatch:</p>
  
  <pre><code>oic_client.allow["issuer_mismatch"] = True
  </code></pre>
  
  <p>I would, however, much prefer to find a solution in which WSO2 Identity Server is made to behave according to spec.</p>