From a475f5f43dfca46288d9c2ba51590ccf0f4d6ff3 Mon Sep 17 00:00:00 2001
From: Roberto Iskandarani <roberto.iskandarani@authplane.ai>
Date: Tue, 28 Jul 2026 16:27:25 -0300
Subject: [PATCH] Exercise identifier identity with trailing-slash data
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

RFC 8414 §3.3 and RFC 9728 §3.3 require the advertised issuer/resource
to be identical to the configured identifier, but no case data exercised
a trailing-slash identifier, so implementations drifted. Extend three
existing cases (no new case IDs):

- rfc9728-well-known-path-must-derive-from-resource-uri: a resource of
  "https://api.example.com/mcp/" must derive
  "/.well-known/oauth-protected-resource/mcp" — trailing slashes are
  dropped when forming the well-known path, so identifiers differing
  only by a trailing slash resolve to the same metadata document.
- rfc8414-metadata-issuer-must-match-configured-issuer: metadata issuer
  "https://auth.example.com/" against configured
  "https://auth.example.com" must reject — equivalent is not identical.
- rfc9068-issuer-must-match: a token whose iss carries the configured
  trailing slash ("https://auth.example.com/") must verify.
---
 oauth-sdk-conformance-catalog.yaml | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/oauth-sdk-conformance-catalog.yaml b/oauth-sdk-conformance-catalog.yaml
index 0cb0053..570e59a 100644
--- a/oauth-sdk-conformance-catalog.yaml
+++ b/oauth-sdk-conformance-catalog.yaml
@@ -124,6 +124,12 @@ cases:
       metadata_document:
         issuer: "https://evil.example.com"
         jwks_uri: "https://auth.example.com/.well-known/jwks.json"
+      variants:
+        - configured_issuer: "https://auth.example.com"
+          metadata_document:
+            issuer: "https://auth.example.com/"
+            jwks_uri: "https://auth.example.com/.well-known/jwks.json"
+          expected_outcome: "reject"
     stimulus:
       operation: "client.create"
     expected:
@@ -766,6 +772,11 @@ cases:
     setup:
       token_claims:
         iss: "https://wrong-issuer.com"
+      variants:
+        - configured_issuer: "https://auth.example.com/"
+          token_claims:
+            iss: "https://auth.example.com/"
+          expected_outcome: "accept"
     stimulus:
       operation: "verifier.verify"
     expected:
@@ -1365,12 +1376,14 @@ cases:
     surface: "sdk-resource-metadata"
     priority: "medium"
     requirement_summary: "The well-known URI MUST be formed by inserting /.well-known/oauth-protected-resource between the\
-      \ host and path component of the resource URI."
+      \ host and path component of the resource URI. Trailing slashes on the resource path are dropped, so identifiers differing\
+      \ only by a trailing slash resolve to the same metadata document."
     setup:
       resources:
         - "https://api.example.com"
         - "https://api.example.com/mcp"
         - "https://api.example.com/v2/mcp"
+        - "https://api.example.com/mcp/"
     stimulus:
       operation: "well_known_prm_path"
     expected:
@@ -1379,7 +1392,9 @@ cases:
         "https://api.example.com": "/.well-known/oauth-protected-resource"
         "https://api.example.com/mcp": "/.well-known/oauth-protected-resource/mcp"
         "https://api.example.com/v2/mcp": "/.well-known/oauth-protected-resource/v2/mcp"
-    rationale: "Ensures clients can correctly discover PRM documents for resources with or without path components."
+        "https://api.example.com/mcp/": "/.well-known/oauth-protected-resource/mcp"
+    rationale: "Ensures clients can correctly discover PRM documents for resources with or without path components. A resource\
+      \ published with a trailing slash serves its metadata at the slash-less well-known path."
   - id: "rfc8414-introspection-endpoint-required-when-introspection-is-used"
     title: "Require introspection_endpoint when introspection operations are invoked"
     standard_refs: