Configure an OIDC federation issuer.

The byte-exact iss, https:// only. Discovery and JWKS are fetched from this URL, so an http issuer would rest the instance's whole federation trust on whoever holds the network path.

The federation issuer's platform. It is DECLARED rather than inferred from the issuer URL, because the per-platform binding rules differ — a Forgejo or GitHub Actions binding MUST pin event_name, a Kubernetes one has no such claim — and inferring the type from a URL would let renaming a deployment change the security rules that apply to it.

Where the issuer's signing keys come from. discovery is the default: keys are fetched and cached with a bounded staleness window. static is the configured alternative for air-gapped installations and for deployments whose issuer discovery endpoint this instance cannot reach — deliberately not the default, because a static-only installation breaks silently on the day someone rotates the issuer's keys.

PEM CA certificates for discovery and JWKS HTTPS requests, including redirects. Replaces system roots for this issuer only. Nonempty values are refused in static mode. On update, omission preserves the current bundle in discovery mode; an empty string clears it. Static mode clears the bundle. This field is write-only; reads report ca_bundle_configured.

The JWKS document, required under static mode and refused under discovery. The pairing is total: a document stored but unused is a key set nobody rotates.

A prefixed UUIDv7, e.g. org_0198….

The byte-exact iss. Nothing folds case, resolves the URL or strips a trailing slash: OpenID Connect defines iss as case-sensitive, so any normalization could merge two distinct external issuers into one configuration.

The federation issuer's platform. It is DECLARED rather than inferred from the issuer URL, because the per-platform binding rules differ — a Forgejo or GitHub Actions binding MUST pin event_name, a Kubernetes one has no such claim — and inferring the type from a URL would let renaming a deployment change the security rules that apply to it.

Where the issuer's signing keys come from. discovery is the default: keys are fetched and cached with a bounded staleness window. static is the configured alternative for air-gapped installations and for deployments whose issuer discovery endpoint this instance cannot reach — deliberately not the default, because a static-only installation breaks silently on the day someone rotates the issuer's keys.

RFC 3339 UTC, microsecond precision.

A prefixed UUIDv7, e.g. org_0198….

RFC 3339 UTC, microsecond precision.

A prefixed UUIDv7, e.g. org_0198….

Whether discovery uses an issuer-specific CA bundle instead of system roots.

How many bindings name this issuer, LIVE OR HISTORICAL, so an operator sees the blast radius before attempting a delete — which is refused while any remain. Revoked bindings count: erasing the issuer a past binding trusted erases what it trusted, and the foreign key would refuse the delete anyway with a driver message instead of a reason.