Support dynamic IdP discovery for CLI introspection with OIDCMetadataDir?

[Deydra71]

Hello!
I’m running mod_auth_openidc 2.4.16 on Apache and using a metadata directory for WebSSO against multiple providers:

OIDCMetadataDir "/var/lib/httpd/metadata"
OIDCRedirectURI "https://keystone.example/v3/redirect_uri"

<LocationMatch "^/v3/auth/OS-FEDERATION/identity_providers/[^/]+/protocols/openid/websso$">
  AuthType openid-connect
  Require  valid-user
</LocationMatch>

That works perfectly for WebSSO, but I aim to use multiple providers for CLI auth that doesn't adopt browser flow, which AuthType openid-connect doesn't support as far as I understand.

Instead, CLI introspection with AuthType oauth20 must be statically configured per‑provider and only supports a single introspection endpoint per vhost:

OIDCOAuthIntrospectionEndpoint https://idp.example.com/realm1/.../introspect
…
<LocationMatch "^/v3/OS-FEDERATION/identity_providers/realm1/.../auth$">
  AuthType oauth20
  Require  valid-user
</LocationMatch>

Is there any way in 2.4.x to have CLI introspection automatically discover the correct IdP from OIDCMetadataDir, or am I forced to use multiple vhosts to support multiple IdPs?

Thanks!

[zandbelt]

discovery and dynamic client registration is an OpenID Connect feature, not something that transates to OAuth 2.0; one can specify multiple OIDCOAuthIntrospectionEndpoint primitives, but only statically