Module oidc 

The oidc.<alias> auth provider: verifies a presented bearer token against ONE configured issuer — offline (JWKS signature validation) or online (RFC 7662 introspection) — and emits the verified AuthenticatedIdentity for the shared principal resolver.

Contract boundaries (RFC 7141 Rev 8):

• The provider verifies credentials into identities. It never touches permission profiles or grants — claim-to-profile mapping belongs to the resolver.
• Only access tokens authenticate the bearer path. A token carrying the ID-token nonce marker is rejected even when its signature, issuer, and audience are valid; the bearer profile also requires an RFC 9068 typed access token.
• Offline (JWKS) validation cannot see revocation, so the identity’s expiry is capped at the earlier of the token exp and max_auth_lifetime_secs. Introspection identities carry a revalidate_by deadline instead; once it passes, the next privileged operation must re-verify or fail closed.
• JWKS refresh is bounded: an unknown kid may trigger at most one fetch per cooldown window, so a stream of bad tokens cannot hammer the IdP.
• Actor class (human vs. service) is declared, never inferred from the sub/client_id relationship: service_clients and interactive_clients classify by verified client_id, and actor_claim classifies a client that issues both kinds of token. A token with no declaration and no configured claim evidence, or with evidence contradicting its declaration, is denied.
• Every ambiguity — unreachable issuer, malformed token, missing claims, unmatched audience — is a denial, never a fallback.

Structs

OidcAuthProvider