(Feeling slightly silly to keep replying to my own post)
I found out that the req.oidc
object only looks empty, but actually does have properties that can be used. I was not familiar with this possibility, and I did not see it mentioned in documentation. But someone else did have the same issue.
So the whole thing is unrelated to Node-RED, and my issue seems solved.