<p>Below is my kubeconfig file for accessing kubernetes clusters:</p>
<pre><code>kind: ClientConfig
apiVersion: authentication.gke.io/v2alpha1
spec:
  name: dev-corp
  server: https://10.x.x.x:443
  certificateAuthorityData: ccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc
  authentication:
  - name: oidc
    oidc:
      clientID: aaaaad3-9aa1-33c8-dd0-ddddd6b5bf5
      clientSecret: ccccccccccccccccc-
      issuerURI: https://login.microsoftonline.com/aaaa92-aab7-bbfa-cccf-ddaaaaaaaa/v2.0
      kubectlRedirectURI: http://localhost:12345/callback
      cloudConsoleRedirectURI: http://console.cloud.google.com/kubernetes/oidc
      scopes: offline_access,profile
      userClaim: upn
      userPrefix: '-'
      groupsClaim: groups
  preferredAuthentication: oidc
</code></pre>
<hr />
<p>There are different OAuth grant types.</p>
<p>My understanding is, above OAuth grant type is <em>client credential</em> grant type, that requires client_id, client_secret, token URL(<code>issuerURI</code>), scope</p>
<hr />
<ol>
<li><p>What is the significance of fields <code>kubectlRedirectURI</code>, <code>cloudConsoleRedirectURI</code>, <code>userClaim</code>, <code>userPrefix</code>?</p>
</li>
<li><p>How OIDC different from OAuth2?</p>
</li>
<li><p><code>oauth2.Config</code> does not store <code>userClaim</code> &amp; <code>userPrefix</code>, <code>groupsClaim</code> information
, as shown here.... <a href="https://github.com/golang/oauth2/blob/master/oauth2.go#L41" rel="nofollow noreferrer">https://github.com/golang/oauth2/blob/master/oauth2.go#L41</a></p>
<p>How to store <code>kind:ClientConfig</code> with oidc based authentication into cache? for example <code>api.Config</code> can be  stored with an API from <a href="https://github.com/kubernetes/client-go" rel="nofollow noreferrer">client-go</a> to write <code>api.Config</code> as shown <a href="https://github.com/kubernetes/client-go/issues/711#issuecomment-741650574" rel="nofollow noreferrer">here</a>.</p>
</li>
</ol>

overexchange
<p><strong>KUBECTL_REDIRECT_URL</strong>: the <em>redirect URL</em> that kubectl oidc login uses for authorization. This is typically of the format <code>http://localhost:PORT/callback</code>, where <code>PORT</code> is any port above <code>1024</code> that will be available on developer workstations, for example <code>http://localhost:10000/callback</code>. You must register the URL with your OIDC provider as an <strong>authorized redirect URL</strong> for the client application.</p>
<p><strong>USER_PREFIX</strong>: prefix prepended to user claims to <strong>prevent conflicts</strong> with existing names. By default, an issuer prefix is appended to the userID given to the Kubernetes API server <strong>(unless the user claim is email)</strong>. The resulting user identifier is ISSUER_URI#USER. We recommend using a prefix, but you can disable the prefix by setting <code>USER_PREFIX to -</code>.</p>
<p><strong>userClaim</strong>: the <code>user identifier</code> in the token under the claim name configured in <code>spec.authentication.oidc.userClaim</code> in the client configuration file.</p>
<p><strong>cloudConsoleRedirectURI</strong> the name tell the story, the cloud redirect URL for OIDC, for example in case of google <code>https://console.cloud.google.com/kubernetes/oidc</code></p>
<p>OIDC vs OAuth2</p>
<p><a href="https://stackoverflow.com/questions/1087031/whats-the-difference-between-openid-and-oauth">What&#39;s the difference between OpenID and OAuth?</a></p>
<p>The file in the question from OIDC and you are comparing the value with Oauth, both handling at different way, better to update the question again with Oauth config file.</p>
<p><a href="https://cloud.google.com/kubernetes-engine/docs/how-to/api-server-authentication" rel="nofollow noreferrer">api-server-authentication</a></p>
<p>you can check <a href="https://pkg.go.dev/k8s.io/kops/pkg/kubeconfig" rel="nofollow noreferrer">kubeconfig builder</a></p>
<p><a href="https://cloud.google.com/kubernetes-engine/docs/how-to/oidc" rel="nofollow noreferrer">kubernetes-engine-oidc</a></p>
<blockquote>
<p>How to store kind:ClientConfig with oidc based authentication into cache?</p>
</blockquote>
<p>you can write to a file and then read, or somewhere in the cloud storage as well</p>
