ConfigureIdentityConfig replaces the whole configuration instead of patching it, so a setting left out of the request is reset rather than kept. That includes the client secret, which DescribeIdentityConfig never returns and which therefore has to be sent again on every write. The provider is a oneof: naming one provider discards the settings of the others, and naming none falls back to the Eolymp provider.