docs: document six openid-connect config keys the app supports [10.16]

[oc-tmueller]

The admin manual's OIDC parameter reference is generated from this file by owncloud/config-to-docs, so a key that is missing here is missing from the documentation — and a key documented only in the docs repo is deleted by the next regeneration. Six keys the openidconnect app reads were missing:

key	read at	note
audience	lib/Client.php	new; app 2.3.5 on this line, see owncloud/openidconnect#368
exchange-token-mode-before-introspection	lib/Client.php	RFC 8693 exchange before introspection
use-access-token-introspection-for-user-info	lib/Client.php	user info from the introspection response
ocis-routing-policy-claim	lib/Controller/LoginFlowController.php	default ocis.routing.policy
ocis-routing-policy-cookie	same	default owncloud-selector
ocis-routing-policy-cookie-directives	same	default path=/;

Every auto-provision subkey is already covered by the code samples further down (enabled, email-claim, display-name-claim, picture-claim, groups, provisioning-claim, provisioning-attribute, update), and the provider-params discovery endpoints likewise — so this adds top-level keys only, in the existing alphabetical order and comment style.

Why the audience entry is long

It is the one key here whose misconfiguration locks every user out. On this server line the audience check and the override arrive together, in app version 2.3.5 — every released version up to and including 2.3.4 does not check the audience at all — so the upgrade needs no configuration change for a provider whose tokens name ownCloud in aud or in a client claim. The one shape it can lock out is an introspection response carrying neither aud nor client_id, which RFC 7662 permits and which no audience value can rescue; the entry says so. (On ownCloud 11 the two halves shipped one release apart, 2.4.1 and 2.4.2, which is why that manual's guidance differs.)

Details checked against the app code rather than assumed

• 'audience' => null behaves as if the key were absent (isset()), while any other unusable value is dropped and fails closed. The entry distinguishes them; they are not equivalent.
• The token exchange takes its subject from the OIDC login session while a session is verified, and from the client's current token when user information is read; with no session it fails on an empty subject rather than being skipped.
• Setting audience also keeps ID tokens out, but only where the value differs from the client-id, since an ID token's aud is the client-id.
• use-access-token-payload-for-user-info gains one clause: its "if false, the userinfo endpoint is used" is no longer the whole story once the introspection variant is documented, and it wins only for a JWT — an opaque token has no payload to read.

Two things a reviewer might flag

• The + lines inside the audience entry are AsciiDoc paragraph continuations. They are required because this file's comments are published verbatim; no other entry needs them because no other entry runs to several paragraphs.
• The doc link is version-explicit (/server/10.16/…) rather than this file's usual /server/latest/. latest cannot carry a deep link into a version-scoped section: it resolves to a 673-byte stub that redirects to the newest line without the fragment, and for the 10.16 counterpart it would send the reader into the wrong manual entirely. The trade-off is that this URL will point at the 11.0 manual if this line ever moves past 10.16.

Testing

No syntax errors detected in config/config.apps.sample.php     # php 7.4

Comment-only change, no code paths touched. Verified end to end that the generator reproduces the manual page from this file: before the change, running config-to-docs against origin/10.16 produced the committed page byte-identically (zero drift), and after it the diff is exactly these entries. owncloud/docs.owncloud.com#137 carries that regenerated output for the 10.16 tree. No changelog entry, following the other docs: commits to this file.

🤖 Generated with Claude Code

Text is identical to the counterpart against master (#41846) except the audience version paragraph, the doc link's version, and this file's own pre-existing wording in the entry that gained a clause.