1 files changed, 45 insertions, 6 deletions

diff --git a/cmd/client/oauth2.go b/cmd/client/oauth2.go
index 6667c5a..1ccdaaa 100644
--- a/cmd/client/oauth2.go
+++ b/cmd/client/oauth2.go
@@ -5,6 +5,7 @@ import (
         "encoding/json"
         "fmt"
         "net/http"
+        "net/url"
         "strings"
         "time"
 
@@ -23,6 +24,36 @@ type Oauth2PKCEDeviceClient struct {
         interval time.Duration
 }
 
+func (c *Oauth2PKCEDeviceClient) discoverHost(ctx context.Context) (*models.OauthDiscoveryMetadata, error) {
+        u := &url.URL{
+                Scheme: "https",
+                Host:   c.Host,
+                Path:   models.Oauth2MetadataPath,
+        }
+
+        req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
+        if err != nil {
+                return nil, err
+        }
+
+        res, err := http.DefaultClient.Do(req)
+        if err != nil {
+                return nil, err
+        }
+        defer res.Body.Close()
+
+        if res.StatusCode != http.StatusOK {
+                return nil, fmt.Errorf("Oauth2 discovery request failed with code %d", res.StatusCode)
+        }
+
+        var resp models.OauthDiscoveryMetadata
+        if err := json.NewDecoder(res.Body).Decode(&resp); err != nil {
+                return nil, err
+        }
+
+        return &resp, nil
+}
+
 func (c *Oauth2PKCEDeviceClient) Authorize(ctx context.Context) (*models.DeviceAuthorizationResponse, error) {
         challenge, err := models.NewPKCEChallenge()
         if err != nil {
@@ -40,8 +71,12 @@ func (c *Oauth2PKCEDeviceClient) Authorize(ctx context.Context) (*models.DeviceA
                 return nil, err
         }
 
-        url := fmt.Sprintf("https://%s/auth/device", c.Host)
-        req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, strings.NewReader(values.Encode()))
+        md, err := c.discoverHost(ctx)
+        if err != nil {
+                return nil, err
+        }
+
+        req, err := http.NewRequestWithContext(ctx, http.MethodPost, md.DeviceAuthorizationEndpoint, strings.NewReader(values.Encode()))
         if err != nil {
                 return nil, err
         }
@@ -53,7 +88,7 @@ func (c *Oauth2PKCEDeviceClient) Authorize(ctx context.Context) (*models.DeviceA
         }
         defer res.Body.Close()
 
-        if res.StatusCode != 200 {
+        if res.StatusCode != http.StatusOK {
                 var resError models.Oauth2Error
                 if err := json.NewDecoder(res.Body).Decode(&resError); err != nil {
                         return nil, err
@@ -85,8 +120,12 @@ func (c *Oauth2PKCEDeviceClient) fetchToken(ctx context.Context, deviceCode stri
                 return nil, err
         }
 
-        url := fmt.Sprintf("https://%s/auth/token", c.Host)
-        req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, strings.NewReader(values.Encode()))
+        md, err := c.discoverHost(ctx)
+        if err != nil {
+                return nil, err
+        }
+
+        req, err := http.NewRequestWithContext(ctx, http.MethodPost, md.TokenEndpoint, strings.NewReader(values.Encode()))
         if err != nil {
                 return nil, err
         }
@@ -98,7 +137,7 @@ func (c *Oauth2PKCEDeviceClient) fetchToken(ctx context.Context, deviceCode stri
         }
         defer res.Body.Close()
 
-        if res.StatusCode != 200 {
+        if res.StatusCode != http.StatusOK {
                 var resError models.Oauth2Error
                 if err := json.NewDecoder(res.Body).Decode(&resError); err != nil {
                         return nil, err