Construct the metadata request location

Derive a metadata location without changing the issuer you expect.

• OAuth 2.0 is an authorization framework. An authorization server issues credentials that a client app uses to access protected resources. Metadata is configuration data describing that server’s endpoints and capabilities. RFC 8414 does not choose which authorization server a client should trust; the issuer identifier may already be configured or discovered by other means (§1).
• The REQUIRED issuer is an HTTPS URL with no query or fragment (§2). A metadata-supporting server MUST publish a JSON document at a location formed by inserting a well-known URI string between the issuer’s host and path. The default string is /.well-known/oauth-authorization-server; the application MUST specify which registered well-known suffix it uses (§3).
• Metadata MUST be requested with HTTP GET. For issuer https://as.example, the default location is https://as.example/.well-known/oauth-authorization-server. For https://as.example/team, it is https://as.example/.well-known/oauth-authorization-server/team. This enables multiple issuers on a host; it is not generic information about that host (§3.1).
• If the issuer has a path, a terminating slash MUST be removed before constructing the request path. The retrieval-location operation does not erase the original expected issuer: https://as.example/team/ and https://as.example/team remain different strings for the later exact issuer check (§§3.1,3.3,4).
• For path-bearing issuers the OpenID Connect Discovery transformation appends its well-known string, while RFC 8414 inserts it before the path. The fourth scene compares both with the same openid-configuration suffix. For the example origin, the two locations are https://as.example/.well-known/openid-configuration/team and https://as.example/team/.well-known/openid-configuration. Transitional fallback is described only for legacy deployments using that suffix, first trying this RFC’s location and only falling back if retrieval fails. It is not permission to accept an issuer mismatch (§5).
• The drawing splits origin, well-known path and issuer path into explicitly joined components for readability. Full HTTPS example URLs are given in these notes. No network discovery, redirects, arbitrary host probing or real authorization service is used.