Hi,

I've been using FileSender 3.5 with SimpleSAMLphp + the authoauth2 module for OpenID Connect authentication against a Keycloak IdP. However, I've been running into dependency issues with firebase/php-jwt (security advisories PKSA-y2cr-5h3j-g3ys and PKSA-2kqm-ps5x-s4f5), which Composer 2.9+ now blocks by default.

While investigating alternatives, I noticed that the FileSender 3.5 source code seems to include built-in OIDC support:

• www/oidc.php — OIDC login/logout entry point
• classes/auth/AuthSPOidc.class.php — OIDC authentication delegation class
• optional-dependencies/oidc/ — jumbojett/openid-connect-php library
• classes/utils/ConfigPrivate.class.php — reads client_id/client_secret from config_private.php
• AuthSP.class.php dynamically loads AuthSPOidc when auth_sp_type = 'oidc'

My questions:

1. Is this native OIDC client officially supported and production-ready?
2. Is there any documentation on how to configure it? The installation guide only covers SimpleSAMLphp.
3. What is the recommended setup? Specifically:
   • Which config parameters go in config.php vs config_private.php?
   • What redirect URI should be registered in the OIDC provider? (I'm assuming https://<domain>/oidc.php)
   • Are there any additional auth_sp_oidc_* parameters beyond issuer, client_id, client_secret, uid_attribute, email_attribute, and name_attribute?

I had previously assumed that SimpleSAMLphp was the only supported authentication method. If native OIDC is indeed supported, it would be great to have it documented, as it eliminates the need for the authoauth2 module and its problematic firebase/php-jwt dependency.

Thanks!