RMS uses STS that does not have /oauth2/ suffix in the endpoints. I would like to use the RMS code as an internal test client. In terms of different libraries, we deviate a bit between our implementations. Android and iOS allow flexibility, while .NET and native do not. .NET has some legacy endpoint suffix used for ACS too, while native is fixed to eSTS. Android allows customization of both authorization and token end-point suffixes. iOS allow customization of the suffix only. I personally like the Android implementation the most and we can follow it, if we all agree.