1.3 OIDC identity provider

Provide an external HTTPS OpenID Connect issuer for the development Compose profile. Keycloak is the reference provider. Set up a browser client and an MCP client with the supported flows and distinct access-token audiences.

• Record the issuer and its JWKS URL from the provider metadata.
• Record the browser and MCP audiences you configured. The sample values are openepm-web and openepm-mcp.
• Identify the first operator by the exact issuer and immutable sub claim in a verified access token.

The bootstrap command grants an Open EPM platform role to that identity. The identity provider owns the account and password. Bundled native Keycloak is configured separately by the packaged release workflow.