Federation docs for OIDC recommend implicit grant

[Kristi Nikolla]

The documentation for setting up OIDC says to use id_token in OIDCResponseType instead of code (or omitting the line entirely since code is the default).

https://docs.openstack.org/keystone/latest/admin/federation/configure_federation.html#configuring-apache-httpd-for-mod-auth-openidc

Using implicit grant is not recommended as https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-09

What is recommended is Authorization Code with PKCE.

[Sam Schmitt (samcat116)]

Hello
Does Keystone currently support OIDC auth via Authorization Code with PKCE? I cannot find any documentation for configuring it. I'd like to use the openstack cli without specifying a client secret as we cannot distribute that secret to all users