the openid user story kind of sucks

[m]

having to make terraform PRs to the core infra repo is scary and users might not have the prerequisite knowledge to do so comfortably or feel enabled to.

elliot thinks having a two-idp federated solution (maybe once kanidm is good?) where the main IDP is easy to create tokens and whatever to and has clickops or sshops or kanidm cli with an easy way to do it. and then the infra idp which works all the time but is scary is somewhere else.