@Path("/.well-known/openid-federation")
  @GET
  @Produces(MEDIA_TYPE_ENTITY_STATEMENT)
  public Response get() {

    var federationEntityJwks = federationConfig.entitySigningKeys().toPublicJWKSet();
    var relyingPartyJwks = federationConfig.relyingPartyKeys().toPublicJWKSet();

    var now = Instant.now();
    var exp = now.plus(federationConfig.ttl());

    var jws =
        EntityStatement.create()
            .iat(now)
            .nbf(now)
            .exp(exp)
            .iss(federationConfig.iss().toString())
            .sub(federationConfig.sub().toString())
            .authorityHints(List.of(federationConfig.federationMaster().toString()))
            .metadata(
                Metadata.create()
                    .openIdRelyingParty(
                        OpenIdRelyingParty.create()
                            .clientName(federationConfig.appName())
                            .jwks(relyingPartyJwks)
                            .responseTypes(List.of("code"))
                            .grantTypes(List.of("authorization_code"))
                            .requirePushedAuthorizationRequests(true)
                            .idTokenSignedResponseAlg("ES256")
                            .idTokenEncryptedResponseAlg("ECDH-ES")
                            .idTokenEncryptedResponseEnc("A256GCM")
                            .scope(String.join(" ", federationConfig.scopes()))
                            .redirectUris(federationConfig.redirectUris())
                            .clientRegistrationTypes(List.of("automatic"))
                            .tokenEndpointAuthMethodsSupported(
                                List.of("self_signed_tls_client_auth"))

                            // according to the federation spec this is not required here, some
                            // sectoral IdPs require it though
                            .defaultAcrValues(List.of("gematik-ehealth-loa-high"))

                            // warn: this is a non-standard field, but needed by some sectoral IdPs
                            .tokenEndpointAuthMethod("self_signed_tls_client_auth")
                            .build())
                    .federationEntity(
                        FederationEntity.create().name(federationConfig.appName()).build())
                    .build())
            .jwks(federationEntityJwks)
            .build()
            .sign(federationConfig.entitySigningKey());

    return Response.ok(jws.serialize())
        .header("x-kc-provider", "ovi")
        .cacheControl(cacheForTtl(now))
        .build();
  }
@Test
  void get_basic() {
    given()
        .baseUri(server.configuration().baseUri().toString())
        .get("/.well-known/openid-federation")
        .then()
        .statusCode(200)
        .body(jwsPayloadAt("/iss", is(ISSUER.toString())))
        .body(jwsPayloadAt("/sub", is(ISSUER.toString())));
  }