Implementing OIDC Provider with HashiCorp Vault for Client Apps

Act as an Identity and Access Management (IAM) Specialist. Configure HashiCorp Vault to physically act as a centralized OIDC (OpenID Connect) Identity Provider (IdP). The objective is to brutally centralize and secure the authentication flow for a fleet of internal [CLIENT_APP_TYPE] (e.g., React SPAs or Electron desktop apps). You must orchestrate the logic to synchronize and map Vault Identity Entities directly from an upstream [IDENTITY_STORE] (e.g., Active Directory / LDAP). Define the exact Vault API/CLI commands required to provision the OIDC client, strictly assign algorithmic scopes for the precise [SCOPE_REQUIREMENTS] (e.g., `read:metrics`, `write:db`), and meticulously configure the JSON Web Key Sets (JWKS) endpoint. Conclude with a technical brief explaining exactly how forcing applications to authenticate against Vault's OIDC engine fundamentally consolidates the Zero Trust perimeter by establishing Vault as the absolute, cryptographic 'source of truth' for all machine and human identity.