The provider, assembled from the operator's configuration.
issuer, clientId and scopes live in cfw_meta. The secret is an env binding and neither it
nor the issuer may join KV_OVERRIDABLE: a KV writer who could repoint the issuer would have
every login authenticate against a provider they control.
The provider, assembled from the operator's configuration.
issuer,clientIdandscopeslive incfw_meta. The secret is an env binding and neither it nor the issuer may joinKV_OVERRIDABLE: a KV writer who could repoint the issuer would have every login authenticate against a provider they control.