How to use AuthProviderPluginClass in managed package?

Question

I am trying to create custom Auth. Provider for my managed package. Class extending Auth.AuthProviderPluginClass works well in namespaced scratch org, but when packaged and installed in sandbox I am unable to save custom Auth. Provider record with following error message:

Review all error messages below to correct your data.
Custom Metadata Type is either invalid or null . Check the returned type for getCustomMetadataType() method

Any of the fields from custom metadata type provided inside package are not visible on Auth. Provider page. This may be related to fact I am querying Protected metadata record present in my managed package, because I want to hide some secrets from Salesforce admin installing package. So basically I have two metadata types: Public_Auth_Provider_Config__mdt which is public and Auth_Provider_Config__mdt which is protected and hides my secrets.

In the method global String getCustomMetadataType() in custom auth provider I have tried multiple options.

global String getCustomMetadataType() {
        return 'Public_Auth_Provider_Config__mdt';  
} 

I have tried using metadata type with or without namespace: Public_Auth_Provider_Config__mdt or xxx__Public_Auth_Provider_Config__mdt

I have came across product which uses managed package is somehow albe to use/view/save custom metadata record Auth.Provider https://docs.incountry.com/salesforce/managing-oauth2-authentication-and-authorization/

Question:

How do I expose Custom metadata record fields onto Auth. Provider layout and save custom Auth. Provider inside managed package?

Answer 1

I have resovled my issue but I am not sure why exactly this happened. Inside my class extending AuthProvider plugin. I was using private class property of type Auth_Provider_Config__mdt which is my protected metadata type, with getter method returning queried metadata record, for further use in authentication flow.

private AuthProviderCredential__mdt config {
    get {
        if(config == null){
            config = [SELECT  Id, Secret_field__c FROM AuthProviderCredential__mdt LIMIT 1];
        }
        return config;
    }
    set;
}

This was fine in scratch org, but caused silent fail in managed package.

To make it work I removed private config property and just queried this record separately in every class method : handleCallback, getUserInfo, refresh , initiate. This removed fail after packing metadata and allowed me to save Auth. Provider with client provided keys to Public_Auth_Provider_Config__mdt record while still hide some secrets in protected type Auth_Provider_Config__mdt