Configure url rewrite for OAuth

AtOther Nutsparties useslook theup RFC8615your specnode's forOAuth2 metadata at a .well-known URIsURL, (https://www.rfc-editor.org/rfc/rfc8615.html).which Thisalways meansstarts well-known resources, like the OAuth server, are resolved fromat the root of the domain (sub)domain.RFC 8615). If youyour hostnode runs at the Nutsroot of its own (sub)domain, e.g. https://nuts.example.com, you don't need to do anything.

If the node runs on a subpath, youe.g. needhttps://example.com/nuts, your reverse proxy must forward the OAuth2 metadata URL to dothe somenode. URLExample rewriting.

for

On Azure Application Gateway, it would look something like this (given your Nutsa node runs on /nuts)nuts:

//Routewell-knownOther endpointsparties request Forward to Nutsthe node //as The URL: // https://<host>/example.com/.well-known/oauth-authorization-server/nuts/oauth2/<subject-idsubject ID> // should map to: // /.well-known/oauth-authorization-server/oauth2/<subject-idsubject ID>

In short: remove the subpath (/nuts) after the .well-known/... part.

NGINX

location /.well-known/oauth-authorization-server/nuts/ {
    proxy_pass http://nuts-node:8080/.well-known/oauth-authorization-server/;
}

Azure Application Gateway

path: '/.well-known/oauth-authorization-server/nuts'
rewriteCondition: '/.well-known/oauth-authorization-server/nuts(.*)'
rewriteRule: '/.well-known/oauth-authorization-server{var_uri_path_1}'

Check that it works

From outside your network, open:

https://example.com/.well-known/oauth-authorization-server/nuts/oauth2/<subject ID>

It should return JSON with your node's OAuth2 metadata, e.g. an issuer of https://example.com/nuts/oauth2/<subject ID>.