Get Provider

WorkloadFederationProvider represents a tenant-level workload identity issuer registration. Two issuer schemes are supported:

• https://... classic OIDC issuer; settings.oidc MUST be set.
• spiffe://... SPIFFE trust-domain URI; settings.spiffe MUST be set.

The (well_known_provider, issuer_url scheme, settings oneof) tuple is a tri-invariant: SPIFFE wkp ⟺ spiffe:// issuer ⟺ settings.spiffe set; any other wkp ⟺ https:// issuer ⟺ settings.oidc set. Issuer URLs are unique within tenant.

This message contains a oneof named settings. Only a single field of the following list may be set at a time:

• oidc
• spiffe