Start the mediated OAuth Authorization Server flow for a cluster
Redirects the caller's browser to the cluster's upstream OIDC provider. If the cluster is not found, disabled, or discovery is not enabled, return 404.
ns*stringNamespace containing the cluster.
cluster*stringCluster name that should exist in the namespace.
response_type*stringMust be code; this server only implements the authorization code grant.
client_id*stringUnvalidated: the proxy mediates the whole flow, so external clients never need to register with the upstream provider.
redirect_uri*stringMust be a loopback URI (http://localhost or http://127.0.0.1), any port/path.
state?|Opaque value echoed back verbatim on redirect.
scope?|Space-separated scopes asked of the upstream provider.
code_challenge*stringRFC 7636 PKCE code challenge (43-128 chars, unreserved charset).
code_challenge_method?|Must be S256 when present; only S256 is supported.
Redirect to the upstream identity provider.
curl -X GET 'https://example.com/clusters/string/string/oauth/authorize?response_type=string&client_id=string&redirect_uri=string&code_challenge=string'