diff --git a/OIDC-Integration.md b/OIDC-Integration.md
index 39f3d07..c1158d5 100644
--- a/OIDC-Integration.md
+++ b/OIDC-Integration.md
@@ -99,10 +99,21 @@ The IAM configuration file has these main sections:
 }
 ```
 
-| Field | Description |
-|-------|-------------|
-| `tlsCaCert` | Optional path to a CA certificate file for verifying the provider's TLS certificate. |
-| `tlsInsecureSkipVerify` | Optional boolean to skip TLS verification (default: false). Use only for testing. |
+#### Configuration Fields
+
+| Field | Required | Type | Description |
+|-------|----------|------|-------------|
+| `issuer` | Yes | string | OIDC issuer URL (e.g., `https://idp.example.com`) |
+| `clientId` | Yes | string | OAuth2 client ID registered with the provider |
+| `clientSecret` | No | string | OAuth2 client secret (required for confidential clients) |
+| `jwksUri` | No | string | JSON Web Key Set URI. If not specified, defaults to `{issuer}/.well-known/jwks.json` |
+| `userInfoUri` | No | string | UserInfo endpoint URI. If not specified, defaults to `{issuer}/userinfo` |
+| `scopes` | No | string[] | OAuth2 scopes to request (default: `["openid"]`) |
+| `tlsCaCert` | No | string | Path to CA certificate file for verifying the provider's TLS certificate |
+| `tlsInsecureSkipVerify` | No | boolean | Skip TLS certificate verification (default: `false`). **Use only for testing** |
+| `jwksCacheTTLSeconds` | No | integer | How long to cache JWKS before refresh in seconds (default: `3600`) |
+| `roleMapping` | No | object | Configuration for mapping OIDC claims to SeaweedFS roles (see below) |
+| `claimsMapping` | No | object | Map OIDC claims to identity attributes |
 
 
 ### Policies