code: func (a *AuthServer) ValidateOIDCAuthCallback(q url.Values) (*OIDCAuthResponse, error) {
  	re, err := a.validateOIDCAuthCallback(q)
  	if err != nil {
  		a.EmitAuditEvent(events.UserSSOLoginFailure, events.EventFields{
  			events.LoginMethod:        events.LoginMethodOIDC,
  			events.AuthAttemptSuccess: false,
  			// log the original internal error in audit log
  			events.AuthAttemptErr: trace.Unwrap(err).Error(),
  		})
  	} else {
  		a.EmitAuditEvent(events.UserSSOLogin, events.EventFields{
  			events.EventUser:          re.Username,
  			events.AuthAttemptSuccess: true,
  			events.LoginMethod:        events.LoginMethodOIDC,
  		})
  	}
  	return re, err
  }
docs: // ValidateOIDCAuthCallback is called by the proxy to check OIDC query parameters
  // returned by OIDC Provider, if everything checks out, auth server
  // will respond with OIDCAuthResponse, otherwise it will return error