[Provider] Add ThunderID as a built-in Auth.js provider

[brionmario]

Goals

1. Enable developers using ThunderID for identity and access management to authenticate users without writing a custom OIDC provider from scratch.
2. Provide a consistent, first-class Auth.js integration experience for self-hosted IAM deployments.
3. Reduce friction for teams adopting open-source, self-hosted identity solutions alongside Auth.js.

Non-Goals

1. Managing or configuring ThunderID server setup — this is strictly a client-side Auth.js integration.
2. Supporting non-OIDC authentication flows specific to ThunderID.
3. Replacing or modifying the existing generic OIDC provider.

Background

Auth.js supports a wide range of identity providers out of the box, covering both commercial and open-source options. However, developers using self-hosted IAM platforms currently have to wire up a custom OIDC provider manually, which is repetitive and error-prone.

ThunderID is a brand new, fully open-source identity and access management platform initiated by WSO2 — the team behind WSO2 Identity Server and Asgardeo. Asgardeo, WSO2's managed identity platform, already has a first-class Auth.js provider, and ThunderID is the next evolution of that vision — a self-hostable, community-driven alternative built on the same IAM expertise.

As the ecosystem of open-source IAM tools grows, having first-class support for platforms like ThunderID lowers the barrier for developers who prefer self-hosted identity infrastructure over third-party SaaS providers. There is no existing alternative short of configuring a generic OIDC provider by hand.

Proposal

Add ThunderID as a named, built-in provider in @auth/core, following the same pattern as other OIDC providers already in the library. The provider should accept the issuer URL alongside standard client credentials, with documentation covering setup and configuration. I am interested in contributing this.

[brionmario]

PR Sent: #13460