NewAuthenticatorService constructs a service for logging users onto the system.

NewOIDCIssuer creates an oidc issuer server and returns its url.

"openid" is a required scope for OpenID Connect flows, and profile gives OTF access to the user's username.