Add RFC 8414 path-aware OAuth authorization server metadata endpoint

[vitorhugo-java]

Summary

This PR adds support for RFC 8414 §3.1 path-aware authorization server metadata discovery, enabling OAuth2 clients like ChatGPT that request metadata with path suffixes (e.g., /.well-known/oauth-authorization-server/mcp) to properly discover the authorization server configuration.

Key Changes

• New Controller: Added OAuthAuthorizationServerMetadataController that handles both root-level and path-aware metadata requests at /.well-known/oauth-authorization-server and /.well-known/oauth-authorization-server/**

  • Ensures "none" (public PKCE clients) is included in token_endpoint_auth_methods_supported and revocation_endpoint_auth_methods_supported
  • Constructs complete OAuth2 metadata response including issuer, endpoints, supported methods, and scopes

• Security Configuration Updates:

  • Updated AuthorizationServerConfig to explicitly support ClientAuthenticationMethod.NONE in the authorization server metadata customizer
  • Updated SecurityConfig to permit access to /.well-known/oauth-authorization-server/** for metadata discovery
  • Changed /connect/register from permitAll() to denyAll() in both security chains for consistency

Implementation Details

• The controller uses LinkedHashMap to maintain consistent metadata field ordering
• Supports both RFC 8414 root endpoint and path-aware variant in a single mapping
• Integrates with existing AuthorizationServerSettings and McpOAuthProperties for configuration
• Fallback registration endpoint defaults to /connect/register if not explicitly configured

https://claude.ai/code/session_01KUx3DVuxMyfGQaRCsfVtfx

[github-actions]

Qodana for JVM

3 new problems were found

Inspection name	Severity	Problems
Nullability and data flow problems	🔶 Warning	1
Mismatched query and update of 'StringBuilder'	🔶 Warning	1
Simplifiable conditional expression	🔶 Warning	1

View the detailed Qodana report

To be able to view the detailed Qodana report, you can either:

• Register at Qodana Cloud and configure the action
• Use GitHub Code Scanning with Qodana
• Host Qodana report at GitHub Pages
• Inspect and use qodana.sarif.json (see the Qodana SARIF format for details)

To get *.log files or any other Qodana artifacts, run the action with upload-result option set to true,
so that the action will upload the files as the job artifacts:

      - name: 'Qodana Scan'
        uses: JetBrains/qodana-action@v2025.3.2
        with:
          upload-result: true

Contact Qodana team

Contact us at qodana-support@jetbrains.com

• Or via our issue tracker: https://jb.gg/qodana-issue
• Or share your feedback: https://jb.gg/qodana-discussions