OIDC-based OAuth