Skip to main content

Version 19 to 20

TL;DR: Breaking Changes​

  • Requires Angular v20 or higher
  • Strict issuer validation when loading the discovery document (PR)

Strict issuer validation​

From version 20.0.0 on, the issuer returned by the .well-known/openid-configuration document must match the configured well-known URL without the /.well-known/openid-configuration suffix. A trailing / is allowed. If they do not match, loading the configuration fails with the error

Issuer mismatch. Well known issuer ... does not match configured well known url ...

If your identity provider returns a different issuer, you can turn this check off from version 20.0.2 on:

provideAuth({
  config: {
    // ...
    strictIssuerValidationOnWellKnownRetrievalOff: true,
  },
}),