OIDC provisioner unavailable after transient startup failure

[AWildLeon]

Hi,

First of all Thank you for providing this awesome software.

I’m running step-ca on a raw Debian/systemd host in a larger homelab setup with an OIDC provisioner configured.

I noticed that if the OIDC provider is temporarily unavailable during machine startup, step-ca continues running, but the OIDC provisioner does not become usable once the provider is available again.

Relevant log excerpt:

...
failed to initialize OIDC provisioner "authentik": failed to connect to https://sso.example.com/application/o/step-ca/.well-known/openid-configuration: Get "https://sso.example.com/application/o/step-ca/.well-known/openid-configuration": dial tcp [IPv6 address]:443: connect: no route to host
Building new tls configuration using step-ca x509 Signer Interface
Starting Smallstep CA/0.30.2 (linux/amd64)
...

From the outside, the CA service looks healthy, but OIDC-based flows are broken until step-ca is restarted manually.

Would it be possible for step-ca to either retry/recover the OIDC provisioner once the provider becomes reachable, or provide an option to fail startup when any configured provisioner cannot be initialized?

A strict startup option would make this easier to handle with systemd, because the service would enter a failed state instead of continuing to run with a missing provisioner.

Thanks.