identityserver/configuration/dcr/

[giscus[bot]]

identityserver/configuration/dcr/

Learn how to configure and use Dynamic Client Registration (DCR) to automatically register OAuth clients with IdentityServer

https://docs.duendesoftware.com/identityserver/configuration/dcr/

[normandev92]

When using RegistrationEndpointMode.Static to publish a DCR endpoint hosted on a separate service (e.g. a dedicated Configuration API), the discovery document will contain a registration_endpoint on a different host than the
authority. Any downstream service that fetches the discovery document via IDiscoveryCache or DiscoveryCache will fail with:

"Policy error while contacting discovery endpoint: Endpoint is on a different host than authority"

The docs should mention that callers need to set ValidateEndpoints = false on their DiscoveryPolicy to allow this cross-host endpoint:

new DiscoveryCache(authority, () => factory.CreateClient(), new DiscoveryPolicy
{
    ValidateEndpoints = false
});

The same applies independently to OAuth2IntrospectionOptions.DiscoveryPolicy — it has its own discovery policy instance that also needs ValidateEndpoints = false, separate from any IDiscoveryCache registration.

A note under the "Adding the Registration Endpoint to the Discovery Document" section explaining this cross-host caveat and the required client-side fix would save a lot of head-scratching.

Unless there is another way to get this to work when registration endpoint is different to the host?

[maartenba]

This is the correct approach, and thanks for flagging! A PR with docs improvements is in the works (DuendeSoftware/docs.duendesoftware.com#1089).