OidcBearerConfig
Access-token verification policy for resource-server Bearer authentication.
Configuring OidcProviderConfig.bearer enables JWT Bearer authentication and requires non-empty audience. Nested introspection additionally enables introspection Bearer authentication for opaque or JWT-formatted tokens.
Bearer audiences are resource identifiers for this server. They are independent of OAuth OidcOAuthConfig.clientId, which is used as the ID-token audience for login callbacks. If a Bearer audience equals the OAuth client ID, the plugin logs a warning: a valid ID token can satisfy signature, issuer, and audience checks. JWT Bearer still rejects tokens whose token_use or typ identifies an ID token.