Test for trialing slashes in value for 'issuer' from '/.well-known/openid-configuration' responses

まず、OpenID 構成レスポンスから返される issuer を基に /.well-known/openid-configuration URL を構築するコードを見つけます。末尾のスラッシュがある issuer 値とない issuer 値のカバレッジを追加し、どちらの場合も無効な JSON レスポンスではなく、スラッシュが 1 つだけの有効な URL が生成されることを確認します。

Basically our ESS Brokers are advertising themselves (in their /.well-known/openid-configuration responses) as issuers with a trailing slash, e.g. for https://broker.pod.inrupt.com/.well-known/openid-configuration:

{
    "introspection_endpoint": "https://broker.pod.inrupt.com/introspect",
    "scopes_supported": [
        "openid",
        "offline_access",
        "webid"
    ],
    "issuer": "https://broker.pod.inrupt.com/",
    :

Note the trailing slash on the issuer URL (which is technically (slightly!) more correct than having the URL without the trailing slash).
So it seems NSS might be blindly taking that issuer value, and appending the string literal /.well-known/openid-configuration to it, without first checking if the issuer value has a trailing slash or not. If the URL constructed has two slashes, then the server responds with it’s standard HTML ‘Page Not Found’ response, which results in the ‘invalid json response…’ error.

If this is correct, then the fix in NSS should be simply checking for a trailing slash before appending /.well-known/openid-configuration.