malsamiri-oai 8e2afc0912 Recover OAuth metadata discovery from 503 responses via OIDC (#44636) ...

## Why

A `503` from an issuer's OAuth metadata endpoint can block discovery even when its OIDC metadata is available, preventing expired OAuth tokens from being refreshed during MCP startup.

## What changed

Try the same issuer's OIDC discovery endpoints when an OAuth authorization-server metadata GET returns `503`. Support issuers with path components and keep all attempts within the original request's timeout.

Reuse existing header, origin, and response-size checks, leave issuer validation to RMCP, and do not follow fallback redirects. Preserve discovery errors when fallback fails instead of enabling legacy endpoint fallback, and propagate terminal HTTP failures.

## Testing

Add tests for OIDC candidate order, malformed metadata, issuer mismatches, header isolation, redirects, terminal failures, unaffected requests, and the shared timeout. Add startup coverage for refreshing expired persisted tokens after OIDC fallback in both legacy and coordinated refresh modes.

GitOrigin-RevId: 6d94fd09e9ba26cb83e029171449e91410a0f6cb

2026-09-10 20:50:10 +00:00

..

src

Recover OAuth metadata discovery from 503 responses via OIDC (#44636)

2026-09-10 20:50:10 +00:00

tests

Recover OAuth metadata discovery from 503 responses via OIDC (#44636)

2026-09-10 20:50:10 +00:00

BUILD.bazel

[3/4] Add executor-backed RMCP HTTP client (#18583)

2026-04-22 17:38:04 -07:00

Cargo.toml

Close MCP stderr readers on client teardown (#43870)

2026-09-08 17:42:14 +00:00