mirror of
https://github.com/infiniflow/ragflow.git
synced 2026-08-28 03:06:30 +08:00
89d35d1b17
### Summary
OIDC discovery builds its URL as
`f"{issuer}/.well-known/openid-configuration"`. Providers whose issuer
carries a trailing slash therefore get asked for a URL with a double
slash in it, which 404s. authentik is one of them: its issuer is
`https://auth.example.com/application/o/<app>/`, so the request goes to
`.../o/<app>//.well-known/openid-configuration` and login fails right at
the start with `Failed to fetch OIDC metadata`.
Stripping trailing slashes off the issuer before joining the well-known
path is enough. The `issuer` used later for ID token validation still
comes from the discovery document itself, so nothing else about the flow
changes.
Co-authored-by: Krim <git@krim.dev>