# OIDC Configuration (v0.12)

## Bundled Dex (default)

`orca auth init-idp --rp-id <cluster-domain>` bootstraps a local Dex
on the lead, fronted by Traefik (step-ca cert). The WebAuthn connector
provides password-free passkey registration + login.

## BYO External IdP

Set `oidc.issuer` in config to repoint to Keycloak/Authentik/Google/etc.
The bundled Dex is bypassed; the external IdP's authenticators are used.

## Claim-to-Namespace Mapping

OIDC `sub` (subject) maps to an ACL entry. Groups (`groups` claim) map
to group-based grants. `orca acl grant <ns> --oidc-sub <sub> --perm read`
or `orca acl grant <ns> --oidc-group <group> --perm admin`.

## Offline / Air-Gapped

Run the bundled Dex on the lead (offline). For the single-operator
fully-offline case, skip OIDC and rely on mTLS-only machine identity
(no human authn needed; the operator holds the pre-staged SSH key +
mTLS cert; no password, no token).

## Credentials Storage

`~/.orca/credentials.json` (0600). Short-lived ID token (1h) + refresh.
The IdP issues tokens; Orca only stores them. No long-lived
Orca-issued tokens (R-021).