JMAPKit: derive the OpenID issuer from JMAP autodiscovery when WebFinger has none (Lately iOS sign-in for conradkramer.com) #189

Open

founder wants to merge 1 commit from claude/lately-oidc-issuer-from-jmap-autodiscovery into main

founder commented

2026-08-23 06:09:26 +00:00

Owner

Lately iOS browser sign-in for conrad@conradkramer.com failed with The WebFinger response did not include an OpenID issuer link: conradkramer.com/.well-known/webfinger is now served by Mastodon (social.conradkramer.com) with Fediverse links only, while mail.8914.la (Stalwart) is healthy and is its own OpenID provider.

Fix: when WebFinger yields no issuer and no explicit server was typed, follow RFC 8620 §2.2 autodiscovery (https://<domain>/.well-known/jmap, unauthenticated) to the JMAP server and use its origin as the issuer candidate; fetchProviderMetadata still verifies it against the provider's own issuer, so a wrong guess fails closed with the original WebFinger error.

Tests: the Mastodon-WebFinger + Stalwart case resolves metadata from the JMAP origin; a domain without a JMAP server still reports the WebFinger error. bazel test //:lately_jmapkit_tests passes.

Workaround with today's build: enter https://mail.8914.la in the Server field before "Sign in with browser".

🤖 Generated with Claude Code

Lately iOS browser sign-in for conrad@conradkramer.com failed with `The WebFinger response did not include an OpenID issuer link`: `conradkramer.com/.well-known/webfinger` is now served by Mastodon (social.conradkramer.com) with Fediverse links only, while `mail.8914.la` (Stalwart) is healthy and is its own OpenID provider. **Fix:** when WebFinger yields no issuer and no explicit server was typed, follow RFC 8620 §2.2 autodiscovery (`https://<domain>/.well-known/jmap`, unauthenticated) to the JMAP server and use its origin as the issuer candidate; `fetchProviderMetadata` still verifies it against the provider's own `issuer`, so a wrong guess fails closed with the original WebFinger error. **Tests:** the Mastodon-WebFinger + Stalwart case resolves metadata from the JMAP origin; a domain without a JMAP server still reports the WebFinger error. `bazel test //:lately_jmapkit_tests` passes. **Workaround with today's build:** enter `https://mail.8914.la` in the Server field before "Sign in with browser". 🤖 Generated with [Claude Code](https://claude.com/claude-code)

founder added 1 commit

2026-08-23 06:09:26 +00:00

JMAPKit: derive the OpenID issuer from JMAP autodiscovery when WebFinger has none

Build: KaiOS / Build (KaiOS) (pull_request) Successful in 2m29s

Details

Build: Apple / Check (SwiftLint) (pull_request) Successful in 2m45s

Details

Build: Web / Build (Web) (pull_request) Successful in 3m22s

Details

Build: Apple / Build (visionOS) (pull_request) Successful in 25s

Details

Build: Apple / Build (iOS) (pull_request) Successful in 1m26s

Details

Build: Linux / Build (Linux x86_64) (pull_request) Successful in 4m16s

Details

Build: Linux / Build (keystore-forge x86_64) (pull_request) Has been skipped

Details

Build: Apple / Build (macOS) (pull_request) Successful in 4m29s

Details

dd023ad3e2

Browser sign-in for conrad@conradkramer.com failed with "The WebFinger
response did not include an OpenID issuer link": the domain's
/.well-known/webfinger is now served by Mastodon (social.conradkramer.com)
and carries only Fediverse links, while the mail server (mail.8914.la,
Stalwart) is healthy and is its own OpenID provider.

When WebFinger yields no issuer and no explicit server was entered, follow
RFC 8620 §2.2 autodiscovery (https://<domain>/.well-known/jmap, unauthenticated)
to the JMAP server and use that origin as the issuer candidate;
fetchProviderMetadata still verifies it against the provider's own issuer
claim, so a wrong guess fails closed with the original WebFinger error.

Tests: the Mastodon-WebFinger + Stalwart case resolves the metadata from the
JMAP origin; a domain without a JMAP server still reports the WebFinger error.
bazel test //:lately_jmapkit_tests passes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>