diff --git a/internal/auth/additional_verification_test.go b/internal/auth/additional_verification_test.go
index eae6f4c24..77b94b88b 100644
--- a/internal/auth/additional_verification_test.go
+++ b/internal/auth/additional_verification_test.go
@@ -9,12 +9,12 @@ import (
 
 	"github.com/hashicorp/boundary/api/authmethods"
 	"github.com/hashicorp/boundary/api/authtokens"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/auth/password"
 	"github.com/hashicorp/boundary/internal/authtoken"
 	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/hashicorp/boundary/internal/servers"
 	"github.com/hashicorp/boundary/internal/servers/controller"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	authmethodsservice "github.com/hashicorp/boundary/internal/servers/controller/handlers/authmethods"
 	"github.com/hashicorp/boundary/internal/types/action"
 	"github.com/hashicorp/boundary/internal/types/resource"
diff --git a/internal/auth/oidc/ids.go b/internal/auth/oidc/ids.go
index 5b30027b8..9e791fb13 100644
--- a/internal/auth/oidc/ids.go
+++ b/internal/auth/oidc/ids.go
@@ -1,16 +1,26 @@
 package oidc
 
 import (
+	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/db"
 	"github.com/hashicorp/boundary/internal/errors"
 	"github.com/hashicorp/boundary/internal/intglobals"
+	"github.com/hashicorp/boundary/internal/types/subtypes"
 )
 
+func init() {
+	if err := auth.Register(Subtype, AuthMethodPrefix, AccountPrefix, intglobals.OidcManagedGroupPrefix); err != nil {
+		panic(err)
+	}
+}
+
 const (
 	// AuthMethodPrefix defines the prefix for AuthMethod public ids.
 	AuthMethodPrefix = "amoidc"
 	// AccountPrefix defines the prefix for Account public ids.
 	AccountPrefix = "acctoidc"
+
+	Subtype = subtypes.Subtype("oidc")
 )
 
 func newAuthMethodId() (string, error) {
diff --git a/internal/auth/password/public_ids.go b/internal/auth/password/public_ids.go
index 2f919fa8d..286659b86 100644
--- a/internal/auth/password/public_ids.go
+++ b/internal/auth/password/public_ids.go
@@ -1,14 +1,25 @@
 package password
 
 import (
+	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/db"
 	"github.com/hashicorp/boundary/internal/errors"
 	"github.com/hashicorp/boundary/internal/intglobals"
+	"github.com/hashicorp/boundary/internal/types/subtypes"
 )
 
+
+func init() {
+	if err := auth.Register(Subtype, AuthMethodPrefix, intglobals.OldPasswordAccountPrefix, intglobals.NewPasswordAccountPrefix); err != nil {
+		panic(err)
+	}
+}
+
 // PublicId prefixes for the resources in the password package.
 const (
 	AuthMethodPrefix = "ampw"
+
+	Subtype = subtypes.Subtype("password")
 )
 
 func newAuthMethodId() (string, error) {
diff --git a/internal/auth/subtype.go b/internal/auth/subtype.go
index a0c054b24..a88584983 100644
--- a/internal/auth/subtype.go
+++ b/internal/auth/subtype.go
@@ -1,30 +1,29 @@
 package auth
 
 import (
-	"strings"
-
-	"github.com/hashicorp/boundary/internal/auth/oidc"
-	"github.com/hashicorp/boundary/internal/auth/password"
 	"github.com/hashicorp/boundary/internal/db/timestamp"
-	"github.com/hashicorp/boundary/internal/intglobals"
+	"github.com/hashicorp/boundary/internal/types/subtypes"
 )
 
-type Subtype int
+var registry = subtypes.NewRegistry()
 
-const (
-	UnknownSubtype Subtype = iota
-	PasswordSubtype
-	OidcSubtype
-)
+// SubtypeFromType returns the Subtype from the provided string or if
+// no Subtype was registered with that string Unknown is returned.
+func SubtypeFromType(t string) subtypes.Subtype {
+	return registry.SubtypeFromType(t)
+}
 
-func (t Subtype) String() string {
-	switch t {
-	case PasswordSubtype:
-		return "password"
-	case OidcSubtype:
-		return "oidc"
-	}
-	return "unknown"
+// SubtypeFromId returns the Subtype from the provided id if the id's prefix
+// was registered with a Subtype. Otherwise Unknown is returned.
+func SubtypeFromId(id string) subtypes.Subtype {
+	return registry.SubtypeFromId(id)
+}
+
+// Register registers all the prefixes for a provided Subtype. Register returns
+// an error if the subtype has already been registered or if any of the
+// prefixes are associated with another subtype.
+func Register(subtype subtypes.Subtype, prefixes ...string) error {
+	return registry.Register(subtype, prefixes...)
 }
 
 // AuthMethod contains the common methods across all the different types of auth methods.
@@ -39,11 +38,6 @@ type AuthMethod interface {
 	GetIsPrimaryAuthMethod() bool
 }
 
-var (
-	_ AuthMethod = (*oidc.AuthMethod)(nil)
-	_ AuthMethod = (*password.AuthMethod)(nil)
-)
-
 type Account interface {
 	GetPublicId() string
 	GetCreateTime() *timestamp.Timestamp
@@ -54,11 +48,6 @@ type Account interface {
 	GetVersion() uint32
 }
 
-var (
-	_ Account = (*oidc.Account)(nil)
-	_ Account = (*password.Account)(nil)
-)
-
 type ManagedGroup interface {
 	GetPublicId() string
 	GetCreateTime() *timestamp.Timestamp
@@ -69,33 +58,3 @@ type ManagedGroup interface {
 	GetVersion() uint32
 }
 
-var _ ManagedGroup = (*oidc.ManagedGroup)(nil)
-
-// SubtypeFromType converts a string to a Subtype.
-// returns UnknownSubtype if no Subtype with that name is found.
-func SubtypeFromType(t string) Subtype {
-	switch {
-	case strings.EqualFold(strings.TrimSpace(t), PasswordSubtype.String()):
-		return PasswordSubtype
-	case strings.EqualFold(strings.TrimSpace(t), OidcSubtype.String()):
-		return OidcSubtype
-	}
-	return UnknownSubtype
-}
-
-// SubtypeFromId takes any public id in the auth subsystem and uses the prefix to determine
-// what subtype the id is for.
-// Returns UnknownSubtype if no Subtype with this id's prefix is found.
-func SubtypeFromId(id string) Subtype {
-	switch {
-	case strings.HasPrefix(strings.TrimSpace(id), password.AuthMethodPrefix),
-		strings.HasPrefix(strings.TrimSpace(id), intglobals.OldPasswordAccountPrefix),
-		strings.HasPrefix(strings.TrimSpace(id), intglobals.NewPasswordAccountPrefix):
-		return PasswordSubtype
-	case strings.HasPrefix(strings.TrimSpace(id), oidc.AuthMethodPrefix),
-		strings.HasPrefix(strings.TrimSpace(id), oidc.AccountPrefix),
-		strings.HasPrefix(strings.TrimSpace(id), intglobals.OidcManagedGroupPrefix):
-		return OidcSubtype
-	}
-	return UnknownSubtype
-}
diff --git a/internal/auth/subtype_test.go b/internal/auth/subtype_test.go
deleted file mode 100644
index 63d58c3cb..000000000
--- a/internal/auth/subtype_test.go
+++ /dev/null
@@ -1,74 +0,0 @@
-package auth
-
-import (
-	"testing"
-
-	"github.com/hashicorp/boundary/internal/auth/oidc"
-	"github.com/hashicorp/boundary/internal/auth/password"
-	"github.com/hashicorp/boundary/internal/intglobals"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestSubtype(t *testing.T) {
-	tests := []struct {
-		subtype     Subtype
-		id          string
-		wantString  string
-		wantSubtype Subtype
-	}{
-		{
-			subtype:     UnknownSubtype,
-			id:          "unknownPrefix" + "1234567890",
-			wantString:  "unknown",
-			wantSubtype: UnknownSubtype,
-		},
-		{
-			subtype:     PasswordSubtype,
-			id:          password.AuthMethodPrefix + "1234567890",
-			wantString:  "password",
-			wantSubtype: PasswordSubtype,
-		},
-		{
-			subtype:     PasswordSubtype,
-			id:          intglobals.OldPasswordAccountPrefix + "1234567890",
-			wantString:  "password",
-			wantSubtype: PasswordSubtype,
-		},
-		{
-			subtype:     PasswordSubtype,
-			id:          intglobals.NewPasswordAccountPrefix + "1234567890",
-			wantString:  "password",
-			wantSubtype: PasswordSubtype,
-		},
-		{
-			subtype:     OidcSubtype,
-			id:          oidc.AuthMethodPrefix + "1234567890",
-			wantString:  "oidc",
-			wantSubtype: OidcSubtype,
-		},
-		{
-			subtype:     OidcSubtype,
-			id:          oidc.AccountPrefix + "1234567890",
-			wantString:  "oidc",
-			wantSubtype: OidcSubtype,
-		},
-		{
-			subtype:     Subtype(1000),
-			id:          "unknownPrefix" + "1234567890",
-			wantString:  "unknown",
-			wantSubtype: UnknownSubtype,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.wantString, func(t *testing.T) {
-			assert, _ := assert.New(t), require.New(t)
-			s := tt.subtype.String()
-			assert.Equal(tt.wantString, s)
-			assert.Equal(tt.wantSubtype, SubtypeFromType(s))
-
-			typ := SubtypeFromId(tt.id)
-			assert.Equal(tt.wantSubtype, typ)
-		})
-	}
-}
diff --git a/internal/cmd/base/initial_resources.go b/internal/cmd/base/initial_resources.go
index 65d98f15d..6c94f8bfb 100644
--- a/internal/cmd/base/initial_resources.go
+++ b/internal/cmd/base/initial_resources.go
@@ -5,12 +5,12 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/auth/password"
 	"github.com/hashicorp/boundary/internal/db"
 	"github.com/hashicorp/boundary/internal/host/static"
 	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/hashicorp/boundary/internal/kms"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/target"
 	"github.com/hashicorp/boundary/internal/types/scope"
 	"github.com/hashicorp/go-secure-stdlib/base62"
diff --git a/internal/credential/subtype.go b/internal/credential/subtype.go
index 2533f636b..ca1aedcf5 100644
--- a/internal/credential/subtype.go
+++ b/internal/credential/subtype.go
@@ -1,69 +1,26 @@
 package credential
 
 import (
-	"strings"
-	"sync"
+	"github.com/hashicorp/boundary/internal/types/subtypes"
 )
 
-type Subtype int
+var registry = subtypes.NewRegistry()
 
-const (
-	UnknownSubtype Subtype = iota
-	VaultSubtype
-)
-
-func (t Subtype) String() string {
-	switch t {
-	case VaultSubtype:
-		return "vault"
-	}
-	return "unknown"
+// SubtypeFromType returns the Subtype from the provided string or if
+// no Subtype was registered with that string Unknown is returned.
+func SubtypeFromType(t string) subtypes.Subtype {
+	return registry.SubtypeFromType(t)
 }
 
-// Subtype uses the provided subtype
-func SubtypeFromType(t string) Subtype {
-	switch {
-	case strings.EqualFold(strings.TrimSpace(t), VaultSubtype.String()):
-		return VaultSubtype
-	}
-	return UnknownSubtype
+// SubtypeFromId returns the Subtype from the provided id if the id's prefix
+// was registered with a Subtype. Otherwise Unknown is returned.
+func SubtypeFromId(id string) subtypes.Subtype {
+	return registry.SubtypeFromId(id)
 }
 
-func SubtypeFromId(id string) Subtype {
-	i := strings.Index(id, "_")
-	if i == -1 {
-		return UnknownSubtype
-	}
-	prefix := id[:i]
-
-	subtypeMu.RLock()
-	subtype, ok := subtypes[prefix]
-	subtypeMu.RUnlock()
-	if !ok {
-		return UnknownSubtype
-	}
-	return subtype
-}
-
-var (
-	subtypeMu sync.RWMutex
-	subtypes  = make(map[string]Subtype)
-)
-
-// Register registers the prefixes for a Subtype. Register panics if the
-// subtype is unknown.
-func Register(subtype Subtype, prefixes ...string) {
-	subtypeMu.Lock()
-	defer subtypeMu.Unlock()
-
-	switch subtype {
-	case VaultSubtype:
-	default:
-		panic("credential.Register: subtype is unknown ")
-	}
-
-	for _, prefix := range prefixes {
-		prefix = strings.TrimSpace(prefix)
-		subtypes[prefix] = subtype
-	}
+// Register registers all the prefixes for a provided Subtype. Register returns
+// an error if the subtype has already been registered or if any of the
+// prefixes are associated with another subtype.
+func Register(subtype subtypes.Subtype, prefixes ...string) error {
+	return registry.Register(subtype, prefixes...)
 }
diff --git a/internal/credential/subtype_test.go b/internal/credential/subtype_test.go
deleted file mode 100644
index 2d2fb23a8..000000000
--- a/internal/credential/subtype_test.go
+++ /dev/null
@@ -1,35 +0,0 @@
-package credential_test
-
-import (
-	"testing"
-
-	"github.com/hashicorp/boundary/internal/credential"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestSubtypeFromId(t *testing.T) {
-	credential.Register(credential.VaultSubtype, "csvlt")
-	tests := []struct {
-		name  string
-		given string
-		want  credential.Subtype
-	}{
-		{"empty-string", "", credential.UnknownSubtype},
-		{"no-prefix-delimiter", "csvlt1234", credential.UnknownSubtype},
-		{"prefix-first", "_csvlt_1234", credential.UnknownSubtype},
-		{"unknown-prefix", "kaz_1234", credential.UnknownSubtype},
-		{"prefix-no-id", "csvlt_", credential.VaultSubtype},
-		{"vault-prefix", "csvlt_1234", credential.VaultSubtype},
-		{"prefix-no-delimiter-no-id", "csvlt", credential.UnknownSubtype},
-	}
-	for _, tt := range tests {
-		tt := tt
-		t.Run(tt.name, func(t *testing.T) {
-			got := credential.SubtypeFromId(tt.given)
-			assert.Equalf(t, tt.want, got, "given: %s", tt.given)
-			if got != tt.want {
-				t.Errorf("(%s): expected %s, actual %s", tt.given, tt.want, got)
-			}
-		})
-	}
-}
diff --git a/internal/credential/vault/public_ids.go b/internal/credential/vault/public_ids.go
index 8d733cf6a..eda136b24 100644
--- a/internal/credential/vault/public_ids.go
+++ b/internal/credential/vault/public_ids.go
@@ -4,13 +4,22 @@ import (
 	"github.com/hashicorp/boundary/internal/credential"
 	"github.com/hashicorp/boundary/internal/db"
 	"github.com/hashicorp/boundary/internal/errors"
+	"github.com/hashicorp/boundary/internal/types/subtypes"
 )
 
+func init() {
+	if err := credential.Register(Subtype, CredentialStorePrefix, CredentialLibraryPrefix, DynamicCredentialPrefix); err != nil {
+		panic(err)
+	}
+}
+
 // PublicId prefixes for the resources in the vault package.
 const (
 	CredentialStorePrefix   = "csvlt"
 	CredentialLibraryPrefix = "clvlt"
 	DynamicCredentialPrefix = "cdvlt"
+
+	Subtype = subtypes.Subtype("vault")
 )
 
 func newCredentialStoreId() (string, error) {
@@ -36,7 +45,3 @@ func newCredentialLibraryId() (string, error) {
 	}
 	return id, nil
 }
-
-func init() {
-	credential.Register(credential.VaultSubtype, CredentialStorePrefix, CredentialLibraryPrefix, DynamicCredentialPrefix)
-}
diff --git a/internal/errors/code.go b/internal/errors/code.go
index 551f10ccb..bc4c254cf 100644
--- a/internal/errors/code.go
+++ b/internal/errors/code.go
@@ -39,6 +39,7 @@ const (
 	InvalidJobRunState       Code = 115 // InvalidJobRunState represents that a JobRun was in an invalid state
 	InvalidDynamicCredential Code = 116 // InvalidDynamicCredential represents that a dynamic credential for a session was in an invalid state
 	JobAlreadyRunning        Code = 117 // JobAlreadyRunning represents that a Job is already running when an attempt to run again was made
+	SubtypeAlreadyRegistered Code = 118 // SubtypeAlreadyRegistered represents that a value has already been registered in the subtype registry system.
 
 	AuthAttemptExpired Code = 198 // AuthAttemptExpired represents an expired authentication attempt
 	AuthMethodInactive Code = 199 // AuthMethodInactive represents an error that means the auth method is not active.
diff --git a/internal/errors/code_test.go b/internal/errors/code_test.go
index 7c32d75cb..0b491f66c 100644
--- a/internal/errors/code_test.go
+++ b/internal/errors/code_test.go
@@ -112,6 +112,11 @@ func TestCode_Both_String_Info(t *testing.T) {
 			c:    JobAlreadyRunning,
 			want: JobAlreadyRunning,
 		},
+		{
+			name: "SubtypeAlreadyRegistered",
+			c:    SubtypeAlreadyRegistered,
+			want: SubtypeAlreadyRegistered,
+		},
 		{
 			name: "InvalidDynamicCredential",
 			c:    InvalidDynamicCredential,
diff --git a/internal/errors/info.go b/internal/errors/info.go
index f70867dfc..3d832623a 100644
--- a/internal/errors/info.go
+++ b/internal/errors/info.go
@@ -92,6 +92,10 @@ var errorCodeInfo = map[Code]Info{
 		Message: "job already running",
 		Kind:    State,
 	},
+	SubtypeAlreadyRegistered: {
+		Message: "subtype already registered",
+		Kind:    Parameter,
+	},
 	InvalidDynamicCredential: {
 		Message: "dynamic credential for session is in an invalid state",
 		Kind:    Integrity,
diff --git a/internal/host/static/public_ids.go b/internal/host/static/public_ids.go
index b77e38a97..37af4ba18 100644
--- a/internal/host/static/public_ids.go
+++ b/internal/host/static/public_ids.go
@@ -3,13 +3,23 @@ package static
 import (
 	"github.com/hashicorp/boundary/internal/db"
 	"github.com/hashicorp/boundary/internal/errors"
+	"github.com/hashicorp/boundary/internal/host"
+	"github.com/hashicorp/boundary/internal/types/subtypes"
 )
 
+func init() {
+	if err := host.Register(Subtype, HostCatalogPrefix, HostSetPrefix, HostPrefix); err != nil {
+		panic(err)
+	}
+}
+
 // PublicId prefixes for the resources in the static package.
 const (
 	HostCatalogPrefix = "hcst"
 	HostSetPrefix     = "hsst"
 	HostPrefix        = "hst"
+
+	Subtype = subtypes.Subtype("static")
 )
 
 func newHostCatalogId() (string, error) {
diff --git a/internal/host/subtype.go b/internal/host/subtype.go
index 4fb9cb7d8..1508eff93 100644
--- a/internal/host/subtype.go
+++ b/internal/host/subtype.go
@@ -1,41 +1,24 @@
 package host
 
-import (
-	"strings"
+import "github.com/hashicorp/boundary/internal/types/subtypes"
 
-	"github.com/hashicorp/boundary/internal/host/static"
-)
+var registry = subtypes.NewRegistry()
 
-type Subtype int
-
-const (
-	UnknownSubtype Subtype = iota
-	StaticSubtype
-)
-
-func (t Subtype) String() string {
-	switch t {
-	case StaticSubtype:
-		return "static"
-	}
-	return "unknown"
+// SubtypeFromType returns the Subtype from the provided string or if
+// no Subtype was registered with that string Unknown is returned.
+func SubtypeFromType(t string) subtypes.Subtype {
+	return registry.SubtypeFromType(t)
 }
 
-// Subtype uses the provided subtype
-func SubtypeFromType(t string) Subtype {
-	switch {
-	case strings.EqualFold(strings.TrimSpace(t), StaticSubtype.String()):
-		return StaticSubtype
-	}
-	return UnknownSubtype
+// SubtypeFromId returns the Subtype from the provided id if the id's prefix
+// was registered with a Subtype. Otherwise Unknown is returned.
+func SubtypeFromId(id string) subtypes.Subtype {
+	return registry.SubtypeFromId(id)
 }
 
-func SubtypeFromId(id string) Subtype {
-	switch {
-	case strings.HasPrefix(strings.TrimSpace(id), static.HostPrefix),
-		strings.HasPrefix(strings.TrimSpace(id), static.HostSetPrefix),
-		strings.HasPrefix(strings.TrimSpace(id), static.HostCatalogPrefix):
-		return StaticSubtype
-	}
-	return UnknownSubtype
+// Register registers all the prefixes for a provided Subtype. Register returns
+// an error if the subtype has already been registered or if any of the
+// prefixes are associated with another subtype.
+func Register(subtype subtypes.Subtype, prefixes ...string) error {
+	return registry.Register(subtype, prefixes...)
 }
diff --git a/internal/servers/common/handler.go b/internal/servers/common/handler.go
index f5975178f..eba78dd91 100644
--- a/internal/servers/common/handler.go
+++ b/internal/servers/common/handler.go
@@ -6,10 +6,10 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/errors"
 	"github.com/hashicorp/boundary/internal/kms"
 	"github.com/hashicorp/boundary/internal/observability/event"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-secure-stdlib/base62"
 )
diff --git a/internal/auth/auth.go b/internal/servers/controller/auth/auth.go
similarity index 100%
rename from internal/auth/auth.go
rename to internal/servers/controller/auth/auth.go
diff --git a/internal/auth/auth_test.go b/internal/servers/controller/auth/auth_test.go
similarity index 100%
rename from internal/auth/auth_test.go
rename to internal/servers/controller/auth/auth_test.go
diff --git a/internal/auth/authorized_actions.go b/internal/servers/controller/auth/authorized_actions.go
similarity index 100%
rename from internal/auth/authorized_actions.go
rename to internal/servers/controller/auth/authorized_actions.go
diff --git a/internal/auth/option.go b/internal/servers/controller/auth/option.go
similarity index 100%
rename from internal/auth/option.go
rename to internal/servers/controller/auth/option.go
diff --git a/internal/auth/options_test.go b/internal/servers/controller/auth/options_test.go
similarity index 100%
rename from internal/auth/options_test.go
rename to internal/servers/controller/auth/options_test.go
diff --git a/internal/auth/testing.go b/internal/servers/controller/auth/testing.go
similarity index 100%
rename from internal/auth/testing.go
rename to internal/servers/controller/auth/testing.go
diff --git a/internal/servers/controller/common/scopeids/scope_ids.go b/internal/servers/controller/common/scopeids/scope_ids.go
index 86e704afd..5bb285a29 100644
--- a/internal/servers/controller/common/scopeids/scope_ids.go
+++ b/internal/servers/controller/common/scopeids/scope_ids.go
@@ -3,11 +3,11 @@ package scopeids
 import (
 	"context"
 
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/errors"
 	"github.com/hashicorp/boundary/internal/gen/controller/api/resources/scopes"
 	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/hashicorp/boundary/internal/perms"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/types/action"
diff --git a/internal/servers/controller/common/scopeids/scope_ids_test.go b/internal/servers/controller/common/scopeids/scope_ids_test.go
index cc01904a9..49743cd39 100644
--- a/internal/servers/controller/common/scopeids/scope_ids_test.go
+++ b/internal/servers/controller/common/scopeids/scope_ids_test.go
@@ -4,13 +4,13 @@ import (
 	"context"
 	"testing"
 
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/authtoken"
 	"github.com/hashicorp/boundary/internal/db"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
 	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/hashicorp/boundary/internal/kms"
 	"github.com/hashicorp/boundary/internal/servers"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers/groups"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers/sessions"
diff --git a/internal/servers/controller/handler.go b/internal/servers/controller/handler.go
index 870089fc5..5ea4ce2cb 100644
--- a/internal/servers/controller/handler.go
+++ b/internal/servers/controller/handler.go
@@ -14,11 +14,11 @@ import (
 
 	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
 	"github.com/hashicorp/boundary/globals"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/auth/oidc"
 	"github.com/hashicorp/boundary/internal/gen/controller/api/services"
 	"github.com/hashicorp/boundary/internal/requests"
 	"github.com/hashicorp/boundary/internal/servers/common"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers/accounts"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers/authmethods"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers/credentiallibraries"
diff --git a/internal/servers/controller/handlers/accounts/account_service.go b/internal/servers/controller/handlers/accounts/account_service.go
index da91d6c3e..19e306832 100644
--- a/internal/servers/controller/handlers/accounts/account_service.go
+++ b/internal/servers/controller/handlers/accounts/account_service.go
@@ -19,10 +19,12 @@ import (
 	"github.com/hashicorp/boundary/internal/intglobals"
 	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/requests"
+	requestauth "github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/types/action"
 	"github.com/hashicorp/boundary/internal/types/resource"
+	"github.com/hashicorp/boundary/internal/types/subtypes"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/protobuf/types/known/structpb"
 	"google.golang.org/protobuf/types/known/wrapperspb"
@@ -55,8 +57,8 @@ var (
 
 	// IdActions contains the set of actions that can be performed on
 	// individual resources
-	IdActions = map[auth.Subtype]action.ActionSet{
-		auth.PasswordSubtype: {
+	IdActions = map[subtypes.Subtype]action.ActionSet{
+		password.Subtype: {
 			action.NoOp,
 			action.Read,
 			action.Update,
@@ -64,7 +66,7 @@ var (
 			action.SetPassword,
 			action.ChangePassword,
 		},
-		auth.OidcSubtype: {
+		oidc.Subtype: {
 			action.NoOp,
 			action.Read,
 			action.Update,
@@ -142,7 +144,7 @@ func (s Service) ListAccounts(ctx context.Context, req *pbs.ListAccountsRequest)
 	}
 	for _, acct := range ul {
 		res.Id = acct.GetPublicId()
-		authorizedActions := authResults.FetchActionSetForId(ctx, acct.GetPublicId(), IdActions[auth.SubtypeFromId(acct.GetPublicId())], auth.WithResource(&res)).Strings()
+		authorizedActions := authResults.FetchActionSetForId(ctx, acct.GetPublicId(), IdActions[auth.SubtypeFromId(acct.GetPublicId())], requestauth.WithResource(&res)).Strings()
 		if len(authorizedActions) == 0 {
 			continue
 		}
@@ -391,7 +393,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (auth.Account, []st
 	var acct auth.Account
 	var mgIds []string
 	switch auth.SubtypeFromId(id) {
-	case auth.PasswordSubtype:
+	case password.Subtype:
 		repo, err := s.pwRepoFn()
 		if err != nil {
 			return nil, nil, err
@@ -404,7 +406,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (auth.Account, []st
 			return nil, nil, err
 		}
 		acct = a
-	case auth.OidcSubtype:
+	case oidc.Subtype:
 		repo, err := s.oidcRepoFn()
 		if err != nil {
 			return nil, nil, err
@@ -520,7 +522,7 @@ func (s Service) createInRepo(ctx context.Context, am auth.AuthMethod, item *pb.
 	}
 	var out auth.Account
 	switch auth.SubtypeFromId(am.GetPublicId()) {
-	case auth.PasswordSubtype:
+	case password.Subtype:
 		am, err := s.createPwInRepo(ctx, am, item)
 		if err != nil {
 			return nil, errors.Wrap(err, op)
@@ -529,7 +531,7 @@ func (s Service) createInRepo(ctx context.Context, am auth.AuthMethod, item *pb.
 			return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to create account but no error returned from repository.")
 		}
 		out = am
-	case auth.OidcSubtype:
+	case oidc.Subtype:
 		am, err := s.createOidcInRepo(ctx, am, item)
 		if err != nil {
 			return nil, errors.Wrap(err, op)
@@ -613,7 +615,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, authMethodId string,
 	const op = "accounts.(Service).updateInRepo"
 	var out auth.Account
 	switch auth.SubtypeFromId(req.GetId()) {
-	case auth.PasswordSubtype:
+	case password.Subtype:
 		a, err := s.updatePwInRepo(ctx, scopeId, authMethodId, req.GetId(), req.GetUpdateMask().GetPaths(), req.GetItem())
 		if err != nil {
 			return nil, errors.Wrap(err, op)
@@ -622,7 +624,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, authMethodId string,
 			return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to update account but no error returned from repository.")
 		}
 		out = a
-	case auth.OidcSubtype:
+	case oidc.Subtype:
 		a, err := s.updateOidcInRepo(ctx, scopeId, authMethodId, req.GetId(), req.GetUpdateMask().GetPaths(), req.GetItem())
 		if err != nil {
 			return nil, errors.Wrap(err, op)
@@ -640,13 +642,13 @@ func (s Service) deleteFromRepo(ctx context.Context, scopeId, id string) (bool,
 	var rows int
 	var err error
 	switch auth.SubtypeFromId(id) {
-	case auth.PasswordSubtype:
+	case password.Subtype:
 		repo, iErr := s.pwRepoFn()
 		if iErr != nil {
 			return false, iErr
 		}
 		rows, err = repo.DeleteAccount(ctx, scopeId, id)
-	case auth.OidcSubtype:
+	case oidc.Subtype:
 		repo, iErr := s.oidcRepoFn()
 		if iErr != nil {
 			return false, iErr
@@ -667,7 +669,7 @@ func (s Service) listFromRepo(ctx context.Context, authMethodId string) ([]auth.
 
 	var outUl []auth.Account
 	switch auth.SubtypeFromId(authMethodId) {
-	case auth.PasswordSubtype:
+	case password.Subtype:
 		pwRepo, err := s.pwRepoFn()
 		if err != nil {
 			return nil, errors.Wrap(err, op)
@@ -679,7 +681,7 @@ func (s Service) listFromRepo(ctx context.Context, authMethodId string) ([]auth.
 		for _, a := range pwl {
 			outUl = append(outUl, a)
 		}
-	case auth.OidcSubtype:
+	case oidc.Subtype:
 		oidcRepo, err := s.oidcRepoFn()
 		if err != nil {
 			return nil, errors.Wrap(err, op)
@@ -742,8 +744,8 @@ func (s Service) setPasswordInRepo(ctx context.Context, scopeId, id string, vers
 	return out, nil
 }
 
-func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Type) (auth.AuthMethod, auth.VerifyResults) {
-	res := auth.VerifyResults{}
+func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Type) (auth.AuthMethod, requestauth.VerifyResults) {
+	res := requestauth.VerifyResults{}
 	pwRepo, err := s.pwRepoFn()
 	if err != nil {
 		res.Error = err
@@ -756,13 +758,13 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 	}
 
 	var parentId string
-	opts := []auth.Option{auth.WithType(resource.Account), auth.WithAction(a)}
+	opts := []requestauth.Option{requestauth.WithType(resource.Account), requestauth.WithAction(a)}
 	switch a {
 	case action.List, action.Create:
 		parentId = id
 	default:
 		switch auth.SubtypeFromId(id) {
-		case auth.PasswordSubtype:
+		case password.Subtype:
 			acct, err := pwRepo.LookupAccount(ctx, id)
 			if err != nil {
 				res.Error = err
@@ -773,7 +775,7 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 				return nil, res
 			}
 			parentId = acct.GetAuthMethodId()
-		case auth.OidcSubtype:
+		case oidc.Subtype:
 			acct, err := oidcRepo.LookupAccount(ctx, id)
 			if err != nil {
 				res.Error = err
@@ -785,12 +787,12 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 			}
 			parentId = acct.GetAuthMethodId()
 		}
-		opts = append(opts, auth.WithId(id))
+		opts = append(opts, requestauth.WithId(id))
 	}
 
 	var authMeth auth.AuthMethod
 	switch auth.SubtypeFromId(parentId) {
-	case auth.PasswordSubtype:
+	case password.Subtype:
 		am, err := pwRepo.LookupAuthMethod(ctx, parentId)
 		if err != nil {
 			res.Error = err
@@ -801,7 +803,7 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 			return nil, res
 		}
 		authMeth = am
-	case auth.OidcSubtype:
+	case oidc.Subtype:
 		am, err := oidcRepo.LookupAuthMethod(ctx, parentId)
 		if err != nil {
 			res.Error = err
@@ -813,8 +815,8 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 		}
 		authMeth = am
 	}
-	opts = append(opts, auth.WithScopeId(authMeth.GetScopeId()), auth.WithPin(parentId))
-	return authMeth, auth.Verify(ctx, opts...)
+	opts = append(opts, requestauth.WithScopeId(authMeth.GetScopeId()), requestauth.WithPin(parentId))
+	return authMeth, requestauth.Verify(ctx, opts...)
 }
 
 func toProto(ctx context.Context, in auth.Account, opt ...handlers.Option) (*pb.Account, error) {
@@ -860,7 +862,7 @@ func toProto(ctx context.Context, in auth.Account, opt ...handlers.Option) (*pb.
 	switch i := in.(type) {
 	case *password.Account:
 		if outputFields.Has(globals.TypeField) {
-			out.Type = auth.PasswordSubtype.String()
+			out.Type = password.Subtype.String()
 		}
 		if !outputFields.Has(globals.AttributesField) {
 			break
@@ -872,7 +874,7 @@ func toProto(ctx context.Context, in auth.Account, opt ...handlers.Option) (*pb.
 		out.Attributes = st
 	case *oidc.Account:
 		if outputFields.Has(globals.TypeField) {
-			out.Type = auth.OidcSubtype.String()
+			out.Type = oidc.Subtype.String()
 		}
 		if !outputFields.Has(globals.AttributesField) {
 			break
@@ -965,8 +967,8 @@ func validateCreateRequest(req *pbs.CreateAccountRequest) error {
 			badFields[authMethodIdField] = "This field is required."
 		}
 		switch auth.SubtypeFromId(req.GetItem().GetAuthMethodId()) {
-		case auth.PasswordSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != auth.PasswordSubtype.String() {
+		case password.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != password.Subtype.String() {
 				badFields[typeField] = "Doesn't match the parent resource's type."
 			}
 			attrs := &pb.PasswordAccountAttributes{}
@@ -976,8 +978,8 @@ func validateCreateRequest(req *pbs.CreateAccountRequest) error {
 			if attrs.GetLoginName() == "" {
 				badFields[loginNameKey] = "This is a required field for this type."
 			}
-		case auth.OidcSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != auth.OidcSubtype.String() {
+		case oidc.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != oidc.Subtype.String() {
 				badFields[typeField] = "Doesn't match the parent resource's type."
 			}
 			attrs := &pb.OidcAccountAttributes{}
@@ -1017,16 +1019,16 @@ func validateUpdateRequest(req *pbs.UpdateAccountRequest) error {
 	return handlers.ValidateUpdateRequest(req, req.GetItem(), func() map[string]string {
 		badFields := map[string]string{}
 		switch auth.SubtypeFromId(req.GetId()) {
-		case auth.PasswordSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != auth.PasswordSubtype.String() {
+		case password.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != password.Subtype.String() {
 				badFields[typeField] = "Cannot modify the resource type."
 			}
 			attrs := &pb.PasswordAccountAttributes{}
 			if err := handlers.StructToProto(req.GetItem().GetAttributes(), attrs); err != nil {
 				badFields[attributesField] = "Attribute fields do not match the expected format."
 			}
-		case auth.OidcSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != auth.OidcSubtype.String() {
+		case oidc.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != oidc.Subtype.String() {
 				badFields[typeField] = "Cannot modify the resource type."
 			}
 			attrs := &pb.OidcAccountAttributes{}
diff --git a/internal/servers/controller/handlers/accounts/account_service_test.go b/internal/servers/controller/handlers/accounts/account_service_test.go
index 0556e3108..3290e9c9c 100644
--- a/internal/servers/controller/handlers/accounts/account_service_test.go
+++ b/internal/servers/controller/handlers/accounts/account_service_test.go
@@ -21,6 +21,7 @@ import (
 	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/hashicorp/boundary/internal/intglobals"
 	"github.com/hashicorp/boundary/internal/kms"
+	requestauth "github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers/accounts"
@@ -134,7 +135,7 @@ func TestGet(t *testing.T) {
 		UpdatedTime:       pwA.GetUpdateTime().GetTimestamp(),
 		Scope:             &scopepb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 		Version:           1,
-		Type:              "password",
+		Type:              password.Subtype.String(),
 		Attributes:        &structpb.Struct{Fields: map[string]*structpb.Value{"login_name": structpb.NewStringValue(pwA.GetLoginName())}},
 		AuthorizedActions: pwAuthorizedActions,
 	}
@@ -159,7 +160,7 @@ func TestGet(t *testing.T) {
 		UpdatedTime:  oidcA.GetUpdateTime().GetTimestamp(),
 		Scope:        &scopepb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 		Version:      1,
-		Type:         auth.OidcSubtype.String(),
+		Type:         oidc.Subtype.String(),
 		Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 			"issuer":  structpb.NewStringValue(oidcAm.GetIssuer()),
 			"subject": structpb.NewStringValue("test-subject"),
@@ -219,7 +220,7 @@ func TestGet(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
 
-			if auth.SubtypeFromId(tc.req.Id) == auth.OidcSubtype {
+			if auth.SubtypeFromId(tc.req.Id) == oidc.Subtype {
 				// Set up managed groups before getting. First get the current
 				// managed group to make sure we have the right version.
 				oidcRepo, err := oidcRepoFn()
@@ -230,7 +231,7 @@ func TestGet(t *testing.T) {
 				require.NoError(err)
 			}
 
-			got, gErr := s.GetAccount(auth.DisabledAuthTestContext(iamRepoFn, org.GetPublicId()), tc.req)
+			got, gErr := s.GetAccount(requestauth.DisabledAuthTestContext(iamRepoFn, org.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "GetAccount(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -348,7 +349,7 @@ func TestListPassword(t *testing.T) {
 			require.NoError(err, "Couldn't create new user service.")
 
 			// Test non-anon first
-			got, gErr := s.ListAccounts(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), tc.req)
+			got, gErr := s.ListAccounts(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "ListAccounts() with auth method %q got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -362,7 +363,7 @@ func TestListPassword(t *testing.T) {
 			if tc.skipAnon {
 				return
 			}
-			got, gErr = s.ListAccounts(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId(), auth.WithUserId(auth.AnonymousUserId)), tc.req)
+			got, gErr = s.ListAccounts(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId(), requestauth.WithUserId(requestauth.AnonymousUserId)), tc.req)
 			require.NoError(gErr)
 			assert.Len(got.Items, len(tc.res.Items))
 			for _, g := range got.GetItems() {
@@ -412,7 +413,7 @@ func TestListOidc(t *testing.T) {
 			UpdatedTime:  aa.GetUpdateTime().GetTimestamp(),
 			Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 			Version:      1,
-			Type:         auth.OidcSubtype.String(),
+			Type:         oidc.Subtype.String(),
 			Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 				"issuer":  structpb.NewStringValue(amSomeAccounts.GetIssuer()),
 				"subject": structpb.NewStringValue(subId),
@@ -432,7 +433,7 @@ func TestListOidc(t *testing.T) {
 			UpdatedTime:  aa.GetUpdateTime().GetTimestamp(),
 			Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 			Version:      1,
-			Type:         auth.OidcSubtype.String(),
+			Type:         oidc.Subtype.String(),
 			Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 				"issuer":  structpb.NewStringValue(amOtherAccounts.GetIssuer()),
 				"subject": structpb.NewStringValue(subId),
@@ -497,7 +498,7 @@ func TestListOidc(t *testing.T) {
 			s, err := accounts.NewService(pwRepoFn, oidcRepoFn)
 			require.NoError(err, "Couldn't create new user service.")
 
-			got, gErr := s.ListAccounts(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), tc.req)
+			got, gErr := s.ListAccounts(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "ListAccounts() with auth method %q got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -515,7 +516,7 @@ func TestListOidc(t *testing.T) {
 			if tc.skipAnon {
 				return
 			}
-			got, gErr = s.ListAccounts(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId(), auth.WithUserId(auth.AnonymousUserId)), tc.req)
+			got, gErr = s.ListAccounts(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId(), requestauth.WithUserId(requestauth.AnonymousUserId)), tc.req)
 			require.NoError(gErr)
 			assert.Len(got.Items, len(tc.res.Items))
 			for _, g := range got.GetItems() {
@@ -613,7 +614,7 @@ func TestDelete(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			got, gErr := s.DeleteAccount(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), tc.req)
+			got, gErr := s.DeleteAccount(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "DeleteAccount(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -648,9 +649,9 @@ func TestDelete_twice(t *testing.T) {
 	req := &pbs.DeleteAccountRequest{
 		Id: ac.GetPublicId(),
 	}
-	_, gErr := s.DeleteAccount(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), req)
+	_, gErr := s.DeleteAccount(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), req)
 	assert.NoError(gErr, "First attempt")
-	_, gErr = s.DeleteAccount(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), req)
+	_, gErr = s.DeleteAccount(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), req)
 	assert.Error(gErr, "Second attempt")
 	assert.True(errors.Is(gErr, handlers.ApiErrorWithCode(codes.NotFound)), "Expected not found for the second delete.")
 }
@@ -830,7 +831,7 @@ func TestCreatePassword(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			got, gErr := s.CreateAccount(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), tc.req)
+			got, gErr := s.CreateAccount(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "CreateAccount(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -906,7 +907,7 @@ func TestCreateOidc(t *testing.T) {
 					AuthMethodId: am.GetPublicId(),
 					Name:         &wrapperspb.StringValue{Value: "name"},
 					Description:  &wrapperspb.StringValue{Value: "desc"},
-					Type:         auth.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attributes:   createAttr("valid-account"),
 				},
 			},
@@ -918,7 +919,7 @@ func TestCreateOidc(t *testing.T) {
 					Description:  &wrapperspb.StringValue{Value: "desc"},
 					Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Version:      1,
-					Type:         auth.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attributes: func() *structpb.Struct {
 						a := createAttr("valid-account")
 						a.Fields["issuer"] = structpb.NewStringValue(am.GetIssuer())
@@ -942,7 +943,7 @@ func TestCreateOidc(t *testing.T) {
 					AuthMethodId: am.GetPublicId(),
 					Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Version:      1,
-					Type:         auth.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attributes: func() *structpb.Struct {
 						a := createAttr("no type defined")
 						a.Fields["issuer"] = structpb.NewStringValue(am.GetIssuer())
@@ -958,7 +959,7 @@ func TestCreateOidc(t *testing.T) {
 				Item: &pb.Account{
 					AuthMethodId: am.GetPublicId(),
 					Name:         &wrapperspb.StringValue{Value: "overwritten issuer"},
-					Type:         auth.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attributes: func() *structpb.Struct {
 						a := createAttr("overwritten-issuer")
 						a.Fields["issuer"] = structpb.NewStringValue("https://overwrite.com")
@@ -973,7 +974,7 @@ func TestCreateOidc(t *testing.T) {
 					Name:         &wrapperspb.StringValue{Value: "overwritten issuer"},
 					Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Version:      1,
-					Type:         auth.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attributes: func() *structpb.Struct {
 						a := createAttr("overwritten-issuer")
 						a.Fields["issuer"] = structpb.NewStringValue("https://overwrite.com")
@@ -988,7 +989,7 @@ func TestCreateOidc(t *testing.T) {
 			req: &pbs.CreateAccountRequest{
 				Item: &pb.Account{
 					AuthMethodId: am.GetPublicId(),
-					Type:         auth.PasswordSubtype.String(),
+					Type:         password.Subtype.String(),
 					Attributes:   createAttr("cant-specify-mismatching-type"),
 				},
 			},
@@ -1001,7 +1002,7 @@ func TestCreateOidc(t *testing.T) {
 				Item: &pb.Account{
 					AuthMethodId: am.GetPublicId(),
 					Id:           oidc.AccountPrefix + "_notallowed",
-					Type:         auth.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attributes:   createAttr("cant-specify-id"),
 				},
 			},
@@ -1014,7 +1015,7 @@ func TestCreateOidc(t *testing.T) {
 				Item: &pb.Account{
 					AuthMethodId: am.GetPublicId(),
 					CreatedTime:  timestamppb.Now(),
-					Type:         auth.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attributes:   createAttr("cant-specify-created-time"),
 				},
 			},
@@ -1027,7 +1028,7 @@ func TestCreateOidc(t *testing.T) {
 				Item: &pb.Account{
 					AuthMethodId: am.GetPublicId(),
 					UpdatedTime:  timestamppb.Now(),
-					Type:         auth.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attributes:   createAttr("cant-specify-update-time"),
 				},
 			},
@@ -1039,7 +1040,7 @@ func TestCreateOidc(t *testing.T) {
 			req: &pbs.CreateAccountRequest{
 				Item: &pb.Account{
 					AuthMethodId: am.GetPublicId(),
-					Type:         auth.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 				},
 			},
 			res: nil,
@@ -1049,7 +1050,7 @@ func TestCreateOidc(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			got, gErr := s.CreateAccount(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), tc.req)
+			got, gErr := s.CreateAccount(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "CreateAccount(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -1099,7 +1100,7 @@ func TestUpdatePassword(t *testing.T) {
 
 	freshAccount := func(t *testing.T) (*pb.Account, func()) {
 		t.Helper()
-		acc, err := tested.CreateAccount(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()),
+		acc, err := tested.CreateAccount(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()),
 			&pbs.CreateAccountRequest{
 				Item: &pb.Account{
 					AuthMethodId: am.GetPublicId(),
@@ -1113,7 +1114,7 @@ func TestUpdatePassword(t *testing.T) {
 		require.NoError(t, err)
 
 		clean := func() {
-			_, err := tested.DeleteAccount(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()),
+			_, err := tested.DeleteAccount(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()),
 				&pbs.DeleteAccountRequest{Id: acc.GetItem().GetId()})
 			require.NoError(t, err)
 		}
@@ -1417,7 +1418,7 @@ func TestUpdatePassword(t *testing.T) {
 				tc.res.Item.CreatedTime = acc.GetCreatedTime()
 			}
 
-			got, gErr := tested.UpdateAccount(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), tc.req)
+			got, gErr := tested.UpdateAccount(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "UpdateAccount(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -1494,7 +1495,7 @@ func TestUpdateOidc(t *testing.T) {
 		acc := oidc.TestAccount(t, conn, am, "test-subject", oidc.WithName("default"), oidc.WithDescription("default"))
 
 		clean := func() {
-			_, err := tested.DeleteAccount(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()),
+			_, err := tested.DeleteAccount(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()),
 				&pbs.DeleteAccountRequest{Id: acc.GetPublicId()})
 			require.NoError(t, err)
 		}
@@ -1517,7 +1518,7 @@ func TestUpdateOidc(t *testing.T) {
 				Item: &pb.Account{
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
-					Type:        auth.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 				},
 			},
 			res: &pbs.UpdateAccountResponse{
@@ -1525,7 +1526,7 @@ func TestUpdateOidc(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "new"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
-					Type:              auth.OidcSubtype.String(),
+					Type:              oidc.Subtype.String(),
 					Attributes:        defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: oidcAuthorizedActions,
@@ -1541,7 +1542,7 @@ func TestUpdateOidc(t *testing.T) {
 				Item: &pb.Account{
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
-					Type:        auth.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 				},
 			},
 			res: &pbs.UpdateAccountResponse{
@@ -1549,7 +1550,7 @@ func TestUpdateOidc(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "new"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
-					Type:              auth.OidcSubtype.String(),
+					Type:              oidc.Subtype.String(),
 					Attributes:        defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: oidcAuthorizedActions,
@@ -1619,7 +1620,7 @@ func TestUpdateOidc(t *testing.T) {
 				Item: &pb.Account{
 					AuthMethodId:      am.GetPublicId(),
 					Description:       &wrapperspb.StringValue{Value: "default"},
-					Type:              auth.OidcSubtype.String(),
+					Type:              oidc.Subtype.String(),
 					Attributes:        defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: oidcAuthorizedActions,
@@ -1643,7 +1644,7 @@ func TestUpdateOidc(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "updated"},
 					Description:       &wrapperspb.StringValue{Value: "default"},
-					Type:              auth.OidcSubtype.String(),
+					Type:              oidc.Subtype.String(),
 					Attributes:        defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: oidcAuthorizedActions,
@@ -1667,7 +1668,7 @@ func TestUpdateOidc(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "default"},
 					Description:       &wrapperspb.StringValue{Value: "notignored"},
-					Type:              auth.OidcSubtype.String(),
+					Type:              oidc.Subtype.String(),
 					Attributes:        defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: oidcAuthorizedActions,
@@ -1800,7 +1801,7 @@ func TestUpdateOidc(t *testing.T) {
 				tc.res.Item.CreatedTime = acc.GetCreateTime().GetTimestamp()
 			}
 
-			got, gErr := tested.UpdateAccount(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), tc.req)
+			got, gErr := tested.UpdateAccount(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "UpdateAccount(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -1861,7 +1862,7 @@ func TestSetPassword(t *testing.T) {
 		}
 		attrs, err := handlers.ProtoToStruct(pwAttrs)
 		require.NoError(t, err)
-		createResp, err := tested.CreateAccount(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), &pbs.CreateAccountRequest{
+		createResp, err := tested.CreateAccount(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), &pbs.CreateAccountRequest{
 			Item: &pb.Account{
 				AuthMethodId: am.GetPublicId(),
 				Type:         "password",
@@ -1901,7 +1902,7 @@ func TestSetPassword(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
 			acct := createAccount(t, tt.oldPw)
 
-			setResp, err := tested.SetPassword(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), &pbs.SetPasswordRequest{
+			setResp, err := tested.SetPassword(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), &pbs.SetPasswordRequest{
 				Id:       acct.GetId(),
 				Version:  acct.GetVersion(),
 				Password: tt.newPw,
@@ -1959,7 +1960,7 @@ func TestSetPassword(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			assert := assert.New(t)
 
-			setResp, err := tested.SetPassword(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), &pbs.SetPasswordRequest{
+			setResp, err := tested.SetPassword(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), &pbs.SetPasswordRequest{
 				Id:       tt.accountId,
 				Version:  tt.version,
 				Password: tt.password,
@@ -1999,7 +2000,7 @@ func TestChangePassword(t *testing.T) {
 		}
 		attrs, err := handlers.ProtoToStruct(pwAttrs)
 		require.NoError(t, err)
-		createResp, err := tested.CreateAccount(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), &pbs.CreateAccountRequest{
+		createResp, err := tested.CreateAccount(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), &pbs.CreateAccountRequest{
 			Item: &pb.Account{
 				AuthMethodId: am.GetPublicId(),
 				Type:         "password",
@@ -2016,7 +2017,7 @@ func TestChangePassword(t *testing.T) {
 		assert, require := assert.New(t), require.New(t)
 		acct := createAccount(t, "originalpassword")
 
-		changeResp, err := tested.ChangePassword(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), &pbs.ChangePasswordRequest{
+		changeResp, err := tested.ChangePassword(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), &pbs.ChangePasswordRequest{
 			Id:              acct.GetId(),
 			Version:         acct.GetVersion(),
 			CurrentPassword: "originalpassword",
@@ -2035,7 +2036,7 @@ func TestChangePassword(t *testing.T) {
 		assert := assert.New(t)
 		acct := createAccount(t, "originalpassword")
 
-		changeResp, err := tested.ChangePassword(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), &pbs.ChangePasswordRequest{
+		changeResp, err := tested.ChangePassword(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), &pbs.ChangePasswordRequest{
 			Id:              acct.GetId(),
 			Version:         acct.GetVersion(),
 			CurrentPassword: "thewrongpassword",
@@ -2132,7 +2133,7 @@ func TestChangePassword(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			assert := assert.New(t)
 
-			changeResp, err := tested.ChangePassword(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), &pbs.ChangePasswordRequest{
+			changeResp, err := tested.ChangePassword(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), &pbs.ChangePasswordRequest{
 				Id:              tt.accountId,
 				Version:         tt.version,
 				CurrentPassword: tt.oldPW,
diff --git a/internal/servers/controller/handlers/accounts/validate_test.go b/internal/servers/controller/handlers/accounts/validate_test.go
index b771d58fd..9fd26d77d 100644
--- a/internal/servers/controller/handlers/accounts/validate_test.go
+++ b/internal/servers/controller/handlers/accounts/validate_test.go
@@ -5,7 +5,6 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/auth/oidc"
 	"github.com/hashicorp/boundary/internal/auth/password"
 	pb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/accounts"
@@ -38,7 +37,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "mismatched pw authmethod oidc type",
 			item: &pb.Account{
-				Type:         auth.OidcSubtype.String(),
+				Type:         oidc.Subtype.String(),
 				AuthMethodId: password.AuthMethodPrefix + "_1234567890",
 			},
 			errContains: fieldError(typeField, "Doesn't match the parent resource's type."),
@@ -46,7 +45,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "mismatched oidc authmethod pw type",
 			item: &pb.Account{
-				Type:         auth.PasswordSubtype.String(),
+				Type:         password.Subtype.String(),
 				AuthMethodId: oidc.AuthMethodPrefix + "_1234567890",
 			},
 			errContains: fieldError(typeField, "Doesn't match the parent resource's type."),
@@ -54,7 +53,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "missing oidc subject",
 			item: &pb.Account{
-				Type:         auth.OidcSubtype.String(),
+				Type:         oidc.Subtype.String(),
 				AuthMethodId: oidc.AuthMethodPrefix + "_1234567890",
 			},
 			errContains: fieldError(subjectField, "This is a required field for this type."),
@@ -62,7 +61,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "read only name claim field",
 			item: &pb.Account{
-				Type:         auth.OidcSubtype.String(),
+				Type:         oidc.Subtype.String(),
 				AuthMethodId: oidc.AuthMethodPrefix + "_1234567890",
 				Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 					"full_name": structpb.NewStringValue("something"),
@@ -73,7 +72,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "read only email claim field",
 			item: &pb.Account{
-				Type:         auth.OidcSubtype.String(),
+				Type:         oidc.Subtype.String(),
 				AuthMethodId: oidc.AuthMethodPrefix + "_1234567890",
 				Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 					"email": structpb.NewStringValue("something"),
@@ -84,7 +83,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "missing login name for password type",
 			item: &pb.Account{
-				Type:         auth.PasswordSubtype.String(),
+				Type:         password.Subtype.String(),
 				AuthMethodId: password.AuthMethodPrefix + "_1234567890",
 			},
 			errContains: fieldError(loginNameKey, "This is a required field for this type."),
@@ -92,7 +91,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "bad pw attributes",
 			item: &pb.Account{
-				Type:         auth.PasswordSubtype.String(),
+				Type:         password.Subtype.String(),
 				AuthMethodId: password.AuthMethodPrefix + "_1234567890",
 				Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 					"test": structpb.NewStringValue("something"),
@@ -103,7 +102,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "bad oidc attributes",
 			item: &pb.Account{
-				Type:         auth.OidcSubtype.String(),
+				Type:         oidc.Subtype.String(),
 				AuthMethodId: oidc.AuthMethodPrefix + "_1234567890",
 				Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 					"test": structpb.NewStringValue("something"),
@@ -114,7 +113,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "no error",
 			item: &pb.Account{
-				Type:         auth.PasswordSubtype.String(),
+				Type:         password.Subtype.String(),
 				AuthMethodId: password.AuthMethodPrefix + "_1234567890",
 				Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 					loginNameKey: structpb.NewStringValue("something"),
@@ -124,7 +123,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "no oidc errors",
 			item: &pb.Account{
-				Type:         auth.OidcSubtype.String(),
+				Type:         oidc.Subtype.String(),
 				AuthMethodId: oidc.AuthMethodPrefix + "_1234567890",
 				Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 					"subject": structpb.NewStringValue("no oidc errors"),
@@ -159,7 +158,7 @@ func TestValidateUpdateRequest(t *testing.T) {
 			req: &pbs.UpdateAccountRequest{
 				Id: intglobals.OldPasswordAccountPrefix + "_1234567890",
 				Item: &pb.Account{
-					Type: auth.OidcSubtype.String(),
+					Type: oidc.Subtype.String(),
 				},
 			},
 			errContains: fieldError(typeField, "Cannot modify the resource type."),
@@ -169,7 +168,7 @@ func TestValidateUpdateRequest(t *testing.T) {
 			req: &pbs.UpdateAccountRequest{
 				Id: intglobals.NewPasswordAccountPrefix + "_1234567890",
 				Item: &pb.Account{
-					Type: auth.OidcSubtype.String(),
+					Type: oidc.Subtype.String(),
 				},
 			},
 			errContains: fieldError(typeField, "Cannot modify the resource type."),
@@ -179,7 +178,7 @@ func TestValidateUpdateRequest(t *testing.T) {
 			req: &pbs.UpdateAccountRequest{
 				Id: oidc.AccountPrefix + "_1234567890",
 				Item: &pb.Account{
-					Type: auth.PasswordSubtype.String(),
+					Type: password.Subtype.String(),
 				},
 			},
 			errContains: fieldError(typeField, "Cannot modify the resource type."),
@@ -251,7 +250,7 @@ func TestValidateUpdateRequest(t *testing.T) {
 			nameClaimField,
 		}
 		err := validateUpdateRequest(&pbs.UpdateAccountRequest{
-			Id:         oidc.AccountPrefix + "1234567890",
+			Id:         oidc.AccountPrefix + "_1234567890",
 			UpdateMask: &fieldmaskpb.FieldMask{Paths: readOnlyFields},
 		})
 
@@ -269,7 +268,7 @@ func TestValidateUpdateRequest(t *testing.T) {
 			subjectField,
 		}
 		err := validateUpdateRequest(&pbs.UpdateAccountRequest{
-			Id:         oidc.AccountPrefix + "1234567890",
+			Id:         oidc.AccountPrefix + "_1234567890",
 			UpdateMask: &fieldmaskpb.FieldMask{Paths: readOnlyFields},
 		})
 
diff --git a/internal/servers/controller/handlers/authmethods/authmethod_service.go b/internal/servers/controller/handlers/authmethods/authmethod_service.go
index 855bd01d1..00ce454a0 100644
--- a/internal/servers/controller/handlers/authmethods/authmethod_service.go
+++ b/internal/servers/controller/handlers/authmethods/authmethod_service.go
@@ -19,6 +19,7 @@ import (
 	"github.com/hashicorp/boundary/internal/kms"
 	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/requests"
+	requestauth "github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/common/scopeids"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
@@ -27,6 +28,7 @@ import (
 	"github.com/hashicorp/boundary/internal/types/action"
 	"github.com/hashicorp/boundary/internal/types/resource"
 	"github.com/hashicorp/boundary/internal/types/scope"
+	"github.com/hashicorp/boundary/internal/types/subtypes"
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"google.golang.org/grpc/codes"
@@ -49,7 +51,7 @@ const (
 var (
 	// IdActions contains the set of actions that can be performed on
 	// individual resources
-	IdActions = make(map[auth.Subtype]action.ActionSet)
+	IdActions = make(map[subtypes.Subtype]action.ActionSet)
 
 	// CollectionActions contains the set of actions that can be performed on
 	// this collection
@@ -151,7 +153,7 @@ func (s Service) ListAuthMethods(ctx context.Context, req *pbs.ListAuthMethodsRe
 	for _, am := range ul {
 		res.Id = am.GetPublicId()
 		res.ScopeId = am.GetScopeId()
-		authorizedActions := authResults.FetchActionSetForId(ctx, am.GetPublicId(), IdActions[auth.SubtypeFromId(am.GetPublicId())], auth.WithResource(&res)).Strings()
+		authorizedActions := authResults.FetchActionSetForId(ctx, am.GetPublicId(), IdActions[auth.SubtypeFromId(am.GetPublicId())], requestauth.WithResource(&res)).Strings()
 		if len(authorizedActions) == 0 {
 			continue
 		}
@@ -166,7 +168,7 @@ func (s Service) ListAuthMethods(ctx context.Context, req *pbs.ListAuthMethodsRe
 			outputOpts = append(outputOpts, handlers.WithAuthorizedActions(authorizedActions))
 		}
 		if outputFields.Has(globals.AuthorizedCollectionActionsField) {
-			collectionActions, err := auth.CalculateAuthorizedCollectionActions(ctx, authResults, collectionTypeMap, authResults.Scope.Id, am.GetPublicId())
+			collectionActions, err := requestauth.CalculateAuthorizedCollectionActions(ctx, authResults, collectionTypeMap, authResults.Scope.Id, am.GetPublicId())
 			if err != nil {
 				return nil, err
 			}
@@ -215,7 +217,7 @@ func (s Service) GetAuthMethod(ctx context.Context, req *pbs.GetAuthMethodReques
 		outputOpts = append(outputOpts, handlers.WithAuthorizedActions(authResults.FetchActionSetForId(ctx, am.GetPublicId(), IdActions[auth.SubtypeFromId(am.GetPublicId())]).Strings()))
 	}
 	if outputFields.Has(globals.AuthorizedCollectionActionsField) {
-		collectionActions, err := auth.CalculateAuthorizedCollectionActions(ctx, authResults, collectionTypeMap, authResults.Scope.Id, am.GetPublicId())
+		collectionActions, err := requestauth.CalculateAuthorizedCollectionActions(ctx, authResults, collectionTypeMap, authResults.Scope.Id, am.GetPublicId())
 		if err != nil {
 			return nil, err
 		}
@@ -260,7 +262,7 @@ func (s Service) CreateAuthMethod(ctx context.Context, req *pbs.CreateAuthMethod
 		outputOpts = append(outputOpts, handlers.WithAuthorizedActions(authResults.FetchActionSetForId(ctx, am.GetPublicId(), IdActions[auth.SubtypeFromId(am.GetPublicId())]).Strings()))
 	}
 	if outputFields.Has(globals.AuthorizedCollectionActionsField) {
-		collectionActions, err := auth.CalculateAuthorizedCollectionActions(ctx, authResults, collectionTypeMap, authResults.Scope.Id, am.GetPublicId())
+		collectionActions, err := requestauth.CalculateAuthorizedCollectionActions(ctx, authResults, collectionTypeMap, authResults.Scope.Id, am.GetPublicId())
 		if err != nil {
 			return nil, err
 		}
@@ -310,7 +312,7 @@ func (s Service) UpdateAuthMethod(ctx context.Context, req *pbs.UpdateAuthMethod
 		outputOpts = append(outputOpts, handlers.WithAuthorizedActions(authResults.FetchActionSetForId(ctx, am.GetPublicId(), IdActions[auth.SubtypeFromId(am.GetPublicId())]).Strings()))
 	}
 	if outputFields.Has(globals.AuthorizedCollectionActionsField) {
-		collectionActions, err := auth.CalculateAuthorizedCollectionActions(ctx, authResults, collectionTypeMap, authResults.Scope.Id, am.GetPublicId())
+		collectionActions, err := requestauth.CalculateAuthorizedCollectionActions(ctx, authResults, collectionTypeMap, authResults.Scope.Id, am.GetPublicId())
 		if err != nil {
 			return nil, err
 		}
@@ -364,7 +366,7 @@ func (s Service) ChangeState(ctx context.Context, req *pbs.ChangeStateRequest) (
 		outputOpts = append(outputOpts, handlers.WithAuthorizedActions(authResults.FetchActionSetForId(ctx, am.GetPublicId(), IdActions[auth.SubtypeFromId(am.GetPublicId())]).Strings()))
 	}
 	if outputFields.Has(globals.AuthorizedCollectionActionsField) {
-		collectionActions, err := auth.CalculateAuthorizedCollectionActions(ctx, authResults, collectionTypeMap, authResults.Scope.Id, am.GetPublicId())
+		collectionActions, err := requestauth.CalculateAuthorizedCollectionActions(ctx, authResults, collectionTypeMap, authResults.Scope.Id, am.GetPublicId())
 		if err != nil {
 			return nil, err
 		}
@@ -403,11 +405,11 @@ func (s Service) Authenticate(ctx context.Context, req *pbs.AuthenticateRequest)
 	}
 
 	switch auth.SubtypeFromId(req.GetAuthMethodId()) {
-	case auth.PasswordSubtype:
+	case password.Subtype:
 		if err := validateAuthenticatePasswordRequest(req); err != nil {
 			return nil, err
 		}
-	case auth.OidcSubtype:
+	case oidc.Subtype:
 		if err := validateAuthenticateOidcRequest(req); err != nil {
 			return nil, err
 		}
@@ -419,10 +421,10 @@ func (s Service) Authenticate(ctx context.Context, req *pbs.AuthenticateRequest)
 	}
 
 	switch auth.SubtypeFromId(req.GetAuthMethodId()) {
-	case auth.PasswordSubtype:
+	case password.Subtype:
 		return s.authenticatePassword(ctx, req, &authResults)
 
-	case auth.OidcSubtype:
+	case oidc.Subtype:
 		return s.authenticateOidc(ctx, req, &authResults)
 	}
 	return nil, errors.New(errors.Internal, op, "Invalid auth method subtype not caught in validation function.")
@@ -446,7 +448,7 @@ func (s Service) AuthenticateLogin(ctx context.Context, req *pbs.AuthenticateLog
 		ScopeId: authResults.Scope.Id,
 		Type:    resource.AuthToken,
 	}
-	tok.AuthorizedActions = authResults.FetchActionSetForId(ctx, tok.Id, authtokens.IdActions, auth.WithResource(res)).Strings()
+	tok.AuthorizedActions = authResults.FetchActionSetForId(ctx, tok.Id, authtokens.IdActions, requestauth.WithResource(res)).Strings()
 	return &pbs.AuthenticateLoginResponse{Item: tok, TokenType: req.GetTokenType()}, nil
 }
 
@@ -454,14 +456,14 @@ func (s Service) getFromRepo(ctx context.Context, id string) (auth.AuthMethod, e
 	var lookupErr error
 	var am auth.AuthMethod
 	switch auth.SubtypeFromId(id) {
-	case auth.PasswordSubtype:
+	case password.Subtype:
 		repo, err := s.pwRepoFn()
 		if err != nil {
 			return nil, err
 		}
 		am, lookupErr = repo.LookupAuthMethod(ctx, id)
 
-	case auth.OidcSubtype:
+	case oidc.Subtype:
 		repo, err := s.oidcRepoFn()
 		if err != nil {
 			return nil, err
@@ -485,7 +487,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (auth.AuthMethod, e
 	return am, nil
 }
 
-func (s Service) listFromRepo(ctx context.Context, scopeIds []string, authResults auth.VerifyResults) ([]auth.AuthMethod, error) {
+func (s Service) listFromRepo(ctx context.Context, scopeIds []string, authResults requestauth.VerifyResults) ([]auth.AuthMethod, error) {
 	const op = "authmethods.(Service).listFromRepo"
 	reqCtx, ok := requests.RequestContextFromCtx(ctx)
 	if !ok {
@@ -498,7 +500,7 @@ func (s Service) listFromRepo(ctx context.Context, scopeIds []string, authResult
 	if err != nil {
 		return nil, errors.Wrap(err, op)
 	}
-	ol, err := oidcRepo.ListAuthMethods(ctx, scopeIds, oidc.WithUnauthenticatedUser(reqCtx.UserId == auth.AnonymousUserId))
+	ol, err := oidcRepo.ListAuthMethods(ctx, scopeIds, oidc.WithUnauthenticatedUser(reqCtx.UserId == requestauth.AnonymousUserId))
 	if err != nil {
 		return nil, errors.Wrap(err, op)
 	}
@@ -524,7 +526,7 @@ func (s Service) createInRepo(ctx context.Context, scopeId string, item *pb.Auth
 	const op = "authmethods.(Service).createInRepo"
 	var out auth.AuthMethod
 	switch auth.SubtypeFromType(item.GetType()) {
-	case auth.PasswordSubtype:
+	case password.Subtype:
 		am, err := s.createPwInRepo(ctx, scopeId, item)
 		if err != nil {
 			return nil, errors.Wrap(err, op)
@@ -533,7 +535,7 @@ func (s Service) createInRepo(ctx context.Context, scopeId string, item *pb.Auth
 			return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to create auth method but no error returned from repository.")
 		}
 		out = am
-	case auth.OidcSubtype:
+	case oidc.Subtype:
 		am, err := s.createOidcInRepo(ctx, scopeId, item)
 		if err != nil {
 			return nil, errors.Wrap(err, op)
@@ -553,7 +555,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId string, req *pbs.Upda
 	var dryRun bool
 
 	switch auth.SubtypeFromId(req.GetId()) {
-	case auth.PasswordSubtype:
+	case password.Subtype:
 		pam, err := s.updatePwInRepo(ctx, scopeId, req.GetId(), req.GetUpdateMask().GetPaths(), req.GetItem())
 		if err != nil {
 			return nil, false, errors.Wrap(err, op)
@@ -563,7 +565,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId string, req *pbs.Upda
 		}
 		am = pam
 
-	case auth.OidcSubtype:
+	case oidc.Subtype:
 		oam, dr, err := s.updateOidcInRepo(ctx, scopeId, req)
 		if err != nil {
 			return nil, false, errors.Wrap(err, op)
@@ -583,14 +585,14 @@ func (s Service) deleteFromRepo(ctx context.Context, scopeId, id string) (bool,
 	var rows int
 	var dErr error
 	switch auth.SubtypeFromId(id) {
-	case auth.PasswordSubtype:
+	case password.Subtype:
 		repo, err := s.pwRepoFn()
 		if err != nil {
 			return false, errors.Wrap(err, op)
 		}
 		rows, dErr = repo.DeleteAuthMethod(ctx, scopeId, id)
 
-	case auth.OidcSubtype:
+	case oidc.Subtype:
 		repo, err := s.oidcRepoFn()
 		if err != nil {
 			return false, errors.Wrap(err, op)
@@ -612,7 +614,7 @@ func (s Service) changeStateInRepo(ctx context.Context, req *pbs.ChangeStateRequ
 	const op = "authmethod_service.(Service).changeStateInRepo"
 
 	switch auth.SubtypeFromId(req.GetId()) {
-	case auth.OidcSubtype:
+	case oidc.Subtype:
 		repo, err := s.oidcRepoFn()
 		if err != nil {
 			return nil, err
@@ -649,12 +651,12 @@ func (s Service) changeStateInRepo(ctx context.Context, req *pbs.ChangeStateRequ
 	return nil, errors.New(errors.InvalidParameter, op, "Given auth method type does not support changing state")
 }
 
-func (s Service) authResult(ctx context.Context, id string, a action.Type) auth.VerifyResults {
+func (s Service) authResult(ctx context.Context, id string, a action.Type) requestauth.VerifyResults {
 	const op = "authmethods.(Service).authResult"
-	res := auth.VerifyResults{}
+	res := requestauth.VerifyResults{}
 
 	var parentId string
-	opts := []auth.Option{auth.WithType(resource.AuthMethod), auth.WithAction(a)}
+	opts := []requestauth.Option{requestauth.WithType(resource.AuthMethod), requestauth.WithAction(a)}
 	switch a {
 	case action.List, action.Create:
 		parentId = id
@@ -675,7 +677,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) auth.
 	default:
 		var authMeth auth.AuthMethod
 		switch auth.SubtypeFromId(id) {
-		case auth.PasswordSubtype:
+		case password.Subtype:
 			repo, err := s.pwRepoFn()
 			if err != nil {
 				res.Error = err
@@ -691,7 +693,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) auth.
 				return res
 			}
 			authMeth = am
-		case auth.OidcSubtype:
+		case oidc.Subtype:
 			repo, err := s.oidcRepoFn()
 			if err != nil {
 				res.Error = err
@@ -712,10 +714,10 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) auth.
 			return res
 		}
 		parentId = authMeth.GetScopeId()
-		opts = append(opts, auth.WithId(id))
+		opts = append(opts, requestauth.WithId(id))
 	}
-	opts = append(opts, auth.WithScopeId(parentId))
-	return auth.Verify(ctx, opts...)
+	opts = append(opts, requestauth.WithScopeId(parentId))
+	return requestauth.Verify(ctx, opts...)
 }
 
 func toAuthMethodProto(ctx context.Context, in auth.AuthMethod, opt ...handlers.Option) (*pb.AuthMethod, error) {
@@ -762,7 +764,7 @@ func toAuthMethodProto(ctx context.Context, in auth.AuthMethod, opt ...handlers.
 	switch i := in.(type) {
 	case *password.AuthMethod:
 		if outputFields.Has(globals.TypeField) {
-			out.Type = auth.PasswordSubtype.String()
+			out.Type = password.Subtype.String()
 		}
 		if !outputFields.Has(globals.AttributesField) {
 			break
@@ -777,7 +779,7 @@ func toAuthMethodProto(ctx context.Context, in auth.AuthMethod, opt ...handlers.
 		out.Attributes = st
 	case *oidc.AuthMethod:
 		if outputFields.Has(globals.TypeField) {
-			out.Type = auth.OidcSubtype.String()
+			out.Type = oidc.Subtype.String()
 		}
 		if !outputFields.Has(globals.AttributesField) {
 			break
@@ -861,12 +863,12 @@ func validateCreateRequest(req *pbs.CreateAuthMethodRequest) error {
 			badFields[isPrimaryField] = "This field is read only."
 		}
 		switch auth.SubtypeFromType(req.GetItem().GetType()) {
-		case auth.PasswordSubtype:
+		case password.Subtype:
 			attrs := &pb.PasswordAuthMethodAttributes{}
 			if err := handlers.StructToProto(req.GetItem().GetAttributes(), attrs); err != nil {
 				badFields[attributesField] = "Attribute fields do not match the expected format."
 			}
-		case auth.OidcSubtype:
+		case oidc.Subtype:
 			attrs := &pb.OidcAuthMethodAttributes{}
 			if err := handlers.StructToProto(req.GetItem().GetAttributes(), attrs); err != nil {
 				badFields[attributesField] = "Attribute fields do not match the expected format."
@@ -942,7 +944,7 @@ func validateCreateRequest(req *pbs.CreateAuthMethodRequest) error {
 				}
 			}
 		default:
-			badFields[typeField] = fmt.Sprintf("This is a required field and must be %q.", auth.PasswordSubtype.String())
+			badFields[typeField] = fmt.Sprintf("This is a required field and must be %q.", password.Subtype.String())
 		}
 		return badFields
 	})
@@ -959,16 +961,16 @@ func validateUpdateRequest(req *pbs.UpdateAuthMethodRequest) error {
 			badFields[isPrimaryField] = "This field is read only."
 		}
 		switch auth.SubtypeFromId(req.GetId()) {
-		case auth.PasswordSubtype:
-			if req.GetItem().GetType() != "" && auth.SubtypeFromType(req.GetItem().GetType()) != auth.PasswordSubtype {
+		case password.Subtype:
+			if req.GetItem().GetType() != "" && auth.SubtypeFromType(req.GetItem().GetType()) != password.Subtype {
 				badFields[typeField] = "Cannot modify the resource type."
 			}
 			attrs := &pb.PasswordAuthMethodAttributes{}
 			if err := handlers.StructToProto(req.GetItem().GetAttributes(), attrs); err != nil {
 				badFields[attributesField] = "Attribute fields do not match the expected format."
 			}
-		case auth.OidcSubtype:
-			if req.GetItem().GetType() != "" && auth.SubtypeFromType(req.GetItem().GetType()) != auth.OidcSubtype {
+		case oidc.Subtype:
+			if req.GetItem().GetType() != "" && auth.SubtypeFromType(req.GetItem().GetType()) != oidc.Subtype {
 				badFields[typeField] = "Cannot modify the resource type."
 			}
 			attrs := &pb.OidcAuthMethodAttributes{}
@@ -1111,8 +1113,8 @@ func validateChangeStateRequest(req *pbs.ChangeStateRequest) error {
 	if req == nil {
 		return errors.New(errors.InvalidParameter, op, "Missing request")
 	}
-	if st := auth.SubtypeFromId(req.GetId()); st != auth.OidcSubtype {
-		return handlers.NotFoundErrorf("This endpoint is only available for the %q Auth Method type.", auth.OidcSubtype.String())
+	if st := auth.SubtypeFromId(req.GetId()); st != oidc.Subtype {
+		return handlers.NotFoundErrorf("This endpoint is only available for the %q Auth Method type.", oidc.Subtype.String())
 	}
 	badFields := make(map[string]string)
 	if req.GetVersion() == 0 {
@@ -1147,7 +1149,7 @@ func validateAuthenticateRequest(req *pbs.AuthenticateRequest) error {
 	} else {
 		st := auth.SubtypeFromId(req.GetAuthMethodId())
 		switch st {
-		case auth.PasswordSubtype, auth.OidcSubtype:
+		case password.Subtype, oidc.Subtype:
 		default:
 			badFields[authMethodIdField] = "Unknown auth method type."
 		}
@@ -1234,7 +1236,7 @@ func (s Service) ConvertInternalAuthTokenToApiAuthToken(ctx context.Context, tok
 	return prot, nil
 }
 
-func (s Service) convertToAuthenticateResponse(ctx context.Context, req *pbs.AuthenticateRequest, authResults *auth.VerifyResults, tok *pba.AuthToken) (*pbs.AuthenticateResponse, error) {
+func (s Service) convertToAuthenticateResponse(ctx context.Context, req *pbs.AuthenticateRequest, authResults *requestauth.VerifyResults, tok *pba.AuthToken) (*pbs.AuthenticateResponse, error) {
 	const op = "authmethod.convertToAuthenticateResponse"
 	if req == nil {
 		return nil, errors.New(errors.InvalidParameter, op, "Missing request.")
@@ -1255,7 +1257,7 @@ func (s Service) convertToAuthenticateResponse(ctx context.Context, req *pbs.Aut
 		ScopeId: authResults.Scope.Id,
 		Type:    resource.AuthToken,
 	}
-	tok.AuthorizedActions = authResults.FetchActionSetForId(ctx, tok.Id, authtokens.IdActions, auth.WithResource(res)).Strings()
+	tok.AuthorizedActions = authResults.FetchActionSetForId(ctx, tok.Id, authtokens.IdActions, requestauth.WithResource(res)).Strings()
 	retAttrs, err := handlers.ProtoToStruct(tok)
 	if err != nil {
 		return nil, err
diff --git a/internal/servers/controller/handlers/authmethods/authmethod_service_test.go b/internal/servers/controller/handlers/authmethods/authmethod_service_test.go
index c94066bd2..71ef19e3d 100644
--- a/internal/servers/controller/handlers/authmethods/authmethod_service_test.go
+++ b/internal/servers/controller/handlers/authmethods/authmethod_service_test.go
@@ -9,7 +9,6 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/auth/oidc"
 	"github.com/hashicorp/boundary/internal/auth/password"
 	"github.com/hashicorp/boundary/internal/authtoken"
@@ -20,6 +19,7 @@ import (
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
 	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/hashicorp/boundary/internal/kms"
+	requestauth "github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers/authmethods"
 	"github.com/hashicorp/boundary/internal/types/action"
@@ -120,7 +120,7 @@ func TestGet(t *testing.T) {
 		ScopeId:     oidcam.GetScopeId(),
 		CreatedTime: oidcam.CreateTime.GetTimestamp(),
 		UpdatedTime: oidcam.UpdateTime.GetTimestamp(),
-		Type:        auth.OidcSubtype.String(),
+		Type:        oidc.Subtype.String(),
 		Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 			"issuer":             structpb.NewStringValue("https://alice.com"),
 			"client_id":          structpb.NewStringValue("alice_rp"),
@@ -187,7 +187,7 @@ func TestGet(t *testing.T) {
 			s, err := authmethods.NewService(kmsCache, pwRepoFn, oidcRepoFn, iamRepoFn, atRepoFn)
 			require.NoError(err, "Couldn't create new auth_method service.")
 
-			got, gErr := s.GetAuthMethod(auth.DisabledAuthTestContext(iamRepoFn, tc.scopeId), tc.req)
+			got, gErr := s.GetAuthMethod(requestauth.DisabledAuthTestContext(iamRepoFn, tc.scopeId), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "GetAuthMethod(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -240,7 +240,7 @@ func TestList(t *testing.T) {
 		UpdatedTime: oidcam.GetUpdateTime().GetTimestamp(),
 		Scope:       &scopepb.ScopeInfo{Id: oWithAuthMethods.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 		Version:     2,
-		Type:        auth.OidcSubtype.String(),
+		Type:        oidc.Subtype.String(),
 		Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 			"issuer":             structpb.NewStringValue("https://alice.com"),
 			"client_id":          structpb.NewStringValue("alice_rp"),
@@ -354,7 +354,7 @@ func TestList(t *testing.T) {
 			require.NoError(err, "Couldn't create new auth_method service.")
 
 			// First check with non-anonymous user
-			got, gErr := s.ListAuthMethods(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId()), tc.req)
+			got, gErr := s.ListAuthMethods(requestauth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "ListAuthMethods() for scope %q got error %v, wanted %v", tc.req.GetScopeId(), gErr, tc.err)
@@ -371,7 +371,7 @@ func TestList(t *testing.T) {
 			assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "ListAuthMethods() for scope %q got response %q, wanted %q", tc.req.GetScopeId(), got, tc.res)
 
 			// Now check with anonymous user
-			got, gErr = s.ListAuthMethods(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), auth.WithUserId(auth.AnonymousUserId)), tc.req)
+			got, gErr = s.ListAuthMethods(requestauth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), requestauth.WithUserId(requestauth.AnonymousUserId)), tc.req)
 			require.NoError(gErr)
 			assert.Len(got.Items, len(tc.res.Items))
 			for _, g := range got.GetItems() {
@@ -450,7 +450,7 @@ func TestDelete(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			got, gErr := s.DeleteAuthMethod(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), tc.req)
+			got, gErr := s.DeleteAuthMethod(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "DeleteAuthMethod(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -489,9 +489,9 @@ func TestDelete_twice(t *testing.T) {
 	req := &pbs.DeleteAuthMethodRequest{
 		Id: am.GetPublicId(),
 	}
-	_, gErr := s.DeleteAuthMethod(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), req)
+	_, gErr := s.DeleteAuthMethod(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), req)
 	assert.NoError(gErr, "First attempt")
-	_, gErr = s.DeleteAuthMethod(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), req)
+	_, gErr = s.DeleteAuthMethod(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), req)
 	assert.Error(gErr, "Second attempt")
 	assert.True(errors.Is(gErr, handlers.ApiErrorWithCode(codes.NotFound)), "Expected permission denied for the second delete.")
 }
@@ -560,7 +560,7 @@ func TestCreate(t *testing.T) {
 			name: "Create a valid OIDC AuthMethod",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    auth.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 					"issuer":         structpb.NewStringValue("https://example.discovery.url:4821/.well-known/openid-configuration/"),
 					"client_id":      structpb.NewStringValue("someclientid"),
@@ -590,7 +590,7 @@ func TestCreate(t *testing.T) {
 					UpdatedTime: defaultAm.GetUpdateTime().GetTimestamp(),
 					Scope:       &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: o.GetType(), ParentScopeId: scope.Global.String()},
 					Version:     1,
-					Type:        auth.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 						"issuer":             structpb.NewStringValue("https://example.discovery.url:4821/"),
 						"client_id":          structpb.NewStringValue("someclientid"),
@@ -650,7 +650,7 @@ func TestCreate(t *testing.T) {
 			name: "Create a global OIDC AuthMethod",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: scope.Global.String(),
-				Type:    auth.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 					"issuer":         structpb.NewStringValue("https://example.discovery.url"),
 					"api_url_prefix": structpb.NewStringValue("https://api.com"),
@@ -668,7 +668,7 @@ func TestCreate(t *testing.T) {
 					UpdatedTime: defaultAm.GetUpdateTime().GetTimestamp(),
 					Scope:       &scopepb.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String(), Name: scope.Global.String(), Description: "Global Scope"},
 					Version:     1,
-					Type:        auth.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 						"api_url_prefix":     structpb.NewStringValue("https://api.com"),
 						"issuer":             structpb.NewStringValue("https://example.discovery.url"),
@@ -696,7 +696,7 @@ func TestCreate(t *testing.T) {
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId:     o.GetPublicId(),
 				CreatedTime: timestamppb.Now(),
-				Type:        auth.PasswordSubtype.String(),
+				Type:        password.Subtype.String(),
 			}},
 			res: nil,
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
@@ -706,7 +706,7 @@ func TestCreate(t *testing.T) {
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId:     o.GetPublicId(),
 				UpdatedTime: timestamppb.Now(),
-				Type:        auth.PasswordSubtype.String(),
+				Type:        password.Subtype.String(),
 			}},
 			res: nil,
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
@@ -715,7 +715,7 @@ func TestCreate(t *testing.T) {
 			name: "Can't specify IsPrimary",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId:   o.GetPublicId(),
-				Type:      auth.PasswordSubtype.String(),
+				Type:      password.Subtype.String(),
 				IsPrimary: true,
 			}},
 			res: nil,
@@ -726,7 +726,7 @@ func TestCreate(t *testing.T) {
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId:     o.GetPublicId(),
 				UpdatedTime: timestamppb.Now(),
-				Type:        auth.PasswordSubtype.String(),
+				Type:        password.Subtype.String(),
 			}},
 			res: nil,
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
@@ -747,7 +747,7 @@ func TestCreate(t *testing.T) {
 				ScopeId:     o.GetPublicId(),
 				Name:        &wrapperspb.StringValue{Value: "Attributes must be valid for type"},
 				Description: &wrapperspb.StringValue{Value: "Attributes must be valid for type"},
-				Type:        auth.PasswordSubtype.String(),
+				Type:        password.Subtype.String(),
 				Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 					"invalid_field":         structpb.NewStringValue("invalid_value"),
 					"min_login_name_length": structpb.NewNumberValue(3),
@@ -762,7 +762,7 @@ func TestCreate(t *testing.T) {
 				ScopeId:     o.GetPublicId(),
 				Name:        &wrapperspb.StringValue{Value: "Attributes must be valid for type"},
 				Description: &wrapperspb.StringValue{Value: "Attributes must be valid for type"},
-				Type:        auth.OidcSubtype.String(),
+				Type:        oidc.Subtype.String(),
 				Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 					"login-name": structpb.NewStringValue("invalid_value"),
 					"password":   structpb.NewNumberValue(3),
@@ -775,7 +775,7 @@ func TestCreate(t *testing.T) {
 			name: "OIDC AuthMethod Doesn't Require Issuer",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    auth.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 					"api_url_prefix": structpb.NewStringValue("https://api.com"),
 					"client_id":      structpb.NewStringValue("someclientid"),
@@ -791,7 +791,7 @@ func TestCreate(t *testing.T) {
 					UpdatedTime: defaultAm.GetUpdateTime().GetTimestamp(),
 					Scope:       &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: o.GetType(), ParentScopeId: scope.Global.String()},
 					Version:     1,
-					Type:        auth.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 						"api_url_prefix":     structpb.NewStringValue("https://api.com"),
 						"client_id":          structpb.NewStringValue("someclientid"),
@@ -807,7 +807,7 @@ func TestCreate(t *testing.T) {
 			name: "OIDC AuthMethod Requires ApiUrl",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    auth.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 					"client_id":     structpb.NewStringValue("someclientid"),
 					"client_secret": structpb.NewStringValue("secret"),
@@ -819,7 +819,7 @@ func TestCreate(t *testing.T) {
 			name: "OIDC AuthMethod Requires Client Id",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    auth.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 					"api_url_prefix": structpb.NewStringValue("https://api.com"),
 					"issuer":         structpb.NewStringValue("https://example.discovery.url:4821/.well-known/openid-configuration/"),
@@ -832,7 +832,7 @@ func TestCreate(t *testing.T) {
 			name: "OIDC AuthMethod Requires Client Secret",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    auth.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 					"api_url_prefix": structpb.NewStringValue("https://api.com"),
 					"issuer":         structpb.NewStringValue("https://example.discovery.url:4821/.well-known/openid-configuration/"),
@@ -845,7 +845,7 @@ func TestCreate(t *testing.T) {
 			name: "OIDC AuthMethod cant specify client secret hmac",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    auth.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 					"api_url_prefix":     structpb.NewStringValue("https://api.com"),
 					"issuer":             structpb.NewStringValue("https://example.discovery.url:4821/.well-known/openid-configuration/"),
@@ -860,7 +860,7 @@ func TestCreate(t *testing.T) {
 			name: "OIDC AuthMethod cant specify state",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    auth.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 					"api_url_prefix": structpb.NewStringValue("https://api.com"),
 					"issuer":         structpb.NewStringValue("https://example.discovery.url:4821/.well-known/openid-configuration/"),
@@ -875,7 +875,7 @@ func TestCreate(t *testing.T) {
 			name: "OIDC AuthMethod Must Match Standard Alg Names",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    auth.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 					"api_url_prefix": structpb.NewStringValue("https://api.com"),
 					"issuer":         structpb.NewStringValue("https://example2.discovery.url:4821"),
@@ -893,7 +893,7 @@ func TestCreate(t *testing.T) {
 			name: "OIDC AuthMethod API Urls Prefix Format",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    auth.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 					"issuer":         structpb.NewStringValue("https://example2.discovery.url:4821"),
 					"client_id":      structpb.NewStringValue("someclientid"),
@@ -907,7 +907,7 @@ func TestCreate(t *testing.T) {
 			name: "OIDC AuthMethod Callback Url Read Only",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    auth.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 					"issuer":        structpb.NewStringValue("https://example2.discovery.url:4821"),
 					"client_id":     structpb.NewStringValue("someclientid"),
@@ -921,7 +921,7 @@ func TestCreate(t *testing.T) {
 			name: "OIDC AuthMethod unparseable certificates",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    auth.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 					"api_url_prefix": structpb.NewStringValue("https://api.com"),
 					"issuer":         structpb.NewStringValue("https://example2.discovery.url:4821"),
@@ -939,7 +939,7 @@ func TestCreate(t *testing.T) {
 			name: "OIDC AuthMethod cant specify default claims scopes of openid",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    auth.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 					"api_url_prefix": structpb.NewStringValue("https://api.com"),
 					"issuer":         structpb.NewStringValue("https://example.discovery.url:4821/.well-known/openid-configuration/"),
@@ -961,7 +961,7 @@ func TestCreate(t *testing.T) {
 			s, err := authmethods.NewService(kms, pwRepoFn, oidcRepoFn, iamRepoFn, atRepoFn)
 			require.NoError(err, "Error when getting new auth_method service.")
 
-			got, gErr := s.CreateAuthMethod(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetItem().GetScopeId()), tc.req)
+			got, gErr := s.CreateAuthMethod(requestauth.DisabledAuthTestContext(iamRepoFn, tc.req.GetItem().GetScopeId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "CreateAuthMethod(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
diff --git a/internal/servers/controller/handlers/authmethods/oidc.go b/internal/servers/controller/handlers/authmethods/oidc.go
index e934cc93f..3f9f93ce9 100644
--- a/internal/servers/controller/handlers/authmethods/oidc.go
+++ b/internal/servers/controller/handlers/authmethods/oidc.go
@@ -7,12 +7,12 @@ import (
 	"net/url"
 	"strings"
 
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/auth/oidc"
 	oidcstore "github.com/hashicorp/boundary/internal/auth/oidc/store"
 	"github.com/hashicorp/boundary/internal/errors"
 	pb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/authmethods"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/types/action"
 	"google.golang.org/grpc/codes"
@@ -53,7 +53,7 @@ func init() {
 		panic(err)
 	}
 
-	IdActions[auth.OidcSubtype] = action.ActionSet{
+	IdActions[oidc.Subtype] = action.ActionSet{
 		action.NoOp,
 		action.Read,
 		action.Update,
diff --git a/internal/servers/controller/handlers/authmethods/oidc_test.go b/internal/servers/controller/handlers/authmethods/oidc_test.go
index 88c79a8d3..e9c98c5fb 100644
--- a/internal/servers/controller/handlers/authmethods/oidc_test.go
+++ b/internal/servers/controller/handlers/authmethods/oidc_test.go
@@ -13,7 +13,6 @@ import (
 	"time"
 
 	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/auth/oidc"
 	"github.com/hashicorp/boundary/internal/auth/password"
 	"github.com/hashicorp/boundary/internal/authtoken"
@@ -26,6 +25,7 @@ import (
 	"github.com/hashicorp/boundary/internal/kms"
 	"github.com/hashicorp/boundary/internal/requests"
 	"github.com/hashicorp/boundary/internal/servers"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers/authmethods"
@@ -305,7 +305,7 @@ func TestUpdate_OIDC(t *testing.T) {
 			ScopeId:     o.GetPublicId(),
 			Name:        wrapperspb.String("default"),
 			Description: wrapperspb.String("default"),
-			Type:        auth.OidcSubtype.String(),
+			Type:        oidc.Subtype.String(),
 			Attributes: &structpb.Struct{
 				Fields: defaultAttributeFields(),
 			},
@@ -345,7 +345,7 @@ func TestUpdate_OIDC(t *testing.T) {
 				Item: &pb.AuthMethod{
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
-					Type:        auth.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 				},
 			},
 			res: &pbs.UpdateAuthMethodResponse{
@@ -353,7 +353,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:     o.GetPublicId(),
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
-					Type:        auth.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attributes: &structpb.Struct{
 						Fields: defaultReadAttributeFields(),
 					},
@@ -372,7 +372,7 @@ func TestUpdate_OIDC(t *testing.T) {
 				Item: &pb.AuthMethod{
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
-					Type:        auth.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 				},
 			},
 			res: &pbs.UpdateAuthMethodResponse{
@@ -380,7 +380,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:     o.GetPublicId(),
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
-					Type:        auth.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attributes: &structpb.Struct{
 						Fields: defaultReadAttributeFields(),
 					},
@@ -412,7 +412,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:     o.GetPublicId(),
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        auth.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attributes: &structpb.Struct{
 						Fields: func() map[string]*structpb.Value {
 							f := defaultReadAttributeFields()
@@ -484,7 +484,7 @@ func TestUpdate_OIDC(t *testing.T) {
 				UpdateMask: &field_mask.FieldMask{Paths: []string{"name", "type"}},
 				Item: &pb.AuthMethod{
 					Name: &wrapperspb.StringValue{Value: "updated name"},
-					Type: auth.PasswordSubtype.String(),
+					Type: password.Subtype.String(),
 				},
 			},
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
@@ -513,7 +513,7 @@ func TestUpdate_OIDC(t *testing.T) {
 				Item: &pb.AuthMethod{
 					ScopeId:     o.GetPublicId(),
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        auth.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attributes: &structpb.Struct{
 						Fields: defaultReadAttributeFields(),
 					},
@@ -537,7 +537,7 @@ func TestUpdate_OIDC(t *testing.T) {
 				Item: &pb.AuthMethod{
 					ScopeId: o.GetPublicId(),
 					Name:    &wrapperspb.StringValue{Value: "default"},
-					Type:    auth.OidcSubtype.String(),
+					Type:    oidc.Subtype.String(),
 					Attributes: &structpb.Struct{
 						Fields: defaultReadAttributeFields(),
 					},
@@ -563,7 +563,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:     o.GetPublicId(),
 					Name:        &wrapperspb.StringValue{Value: "updated"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        auth.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attributes: &structpb.Struct{
 						Fields: defaultReadAttributeFields(),
 					},
@@ -589,7 +589,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:     o.GetPublicId(),
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "notignored"},
-					Type:        auth.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attributes: &structpb.Struct{
 						Fields: defaultReadAttributeFields(),
 					},
@@ -661,7 +661,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					Paths: []string{"type"},
 				},
 				Item: &pb.AuthMethod{
-					Type: auth.OidcSubtype.String(),
+					Type: oidc.Subtype.String(),
 				},
 			},
 			res: nil,
@@ -716,7 +716,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:     o.GetPublicId(),
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        auth.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attributes: &structpb.Struct{
 						Fields: func() map[string]*structpb.Value {
 							f := defaultReadAttributeFields()
@@ -749,7 +749,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:     o.GetPublicId(),
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        auth.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attributes: &structpb.Struct{
 						Fields: func() map[string]*structpb.Value {
 							f := defaultReadAttributeFields()
@@ -782,7 +782,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:     o.GetPublicId(),
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        auth.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attributes: &structpb.Struct{
 						Fields: func() map[string]*structpb.Value {
 							f := defaultReadAttributeFields()
@@ -830,7 +830,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:     o.GetPublicId(),
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        auth.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attributes: &structpb.Struct{
 						Fields: func() map[string]*structpb.Value {
 							f := defaultReadAttributeFields()
@@ -867,7 +867,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:     o.GetPublicId(),
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        auth.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attributes: &structpb.Struct{
 						Fields: func() map[string]*structpb.Value {
 							f := defaultReadAttributeFields()
@@ -906,7 +906,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:     o.GetPublicId(),
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        auth.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attributes: &structpb.Struct{
 						Fields: func() map[string]*structpb.Value {
 							f := defaultReadAttributeFields()
@@ -945,7 +945,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:     o.GetPublicId(),
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        auth.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attributes: &structpb.Struct{
 						Fields: func() map[string]*structpb.Value {
 							f := defaultReadAttributeFields()
@@ -1037,7 +1037,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:     o.GetPublicId(),
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        auth.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attributes: &structpb.Struct{
 						Fields: func() map[string]*structpb.Value {
 							f := defaultReadAttributeFields()
@@ -1172,7 +1172,7 @@ func TestUpdate_OIDCDryRun(t *testing.T) {
 		CreatedTime:                 am.GetCreateTime().GetTimestamp(),
 		UpdatedTime:                 am.GetUpdateTime().GetTimestamp(),
 		Version:                     am.GetVersion(),
-		Type:                        auth.OidcSubtype.String(),
+		Type:                        oidc.Subtype.String(),
 		AuthorizedActions:           oidcAuthorizedActions,
 		AuthorizedCollectionActions: authorizedCollectionActions,
 		Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
@@ -1353,7 +1353,7 @@ func TestChangeState_OIDC(t *testing.T) {
 		ScopeId:     oidcam.GetScopeId(),
 		CreatedTime: oidcam.CreateTime.GetTimestamp(),
 		UpdatedTime: oidcam.UpdateTime.GetTimestamp(),
-		Type:        auth.OidcSubtype.String(),
+		Type:        oidc.Subtype.String(),
 		Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 			"issuer":             structpb.NewStringValue(oidcam.GetIssuer()),
 			"client_id":          structpb.NewStringValue(tpClientId),
diff --git a/internal/servers/controller/handlers/authmethods/password.go b/internal/servers/controller/handlers/authmethods/password.go
index 5b41f0f51..00f8fa4d1 100644
--- a/internal/servers/controller/handlers/authmethods/password.go
+++ b/internal/servers/controller/handlers/authmethods/password.go
@@ -5,13 +5,13 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/auth/password"
 	pwstore "github.com/hashicorp/boundary/internal/auth/password/store"
 	"github.com/hashicorp/boundary/internal/errors"
 	pb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/authmethods"
 	pba "github.com/hashicorp/boundary/internal/gen/controller/api/resources/authtokens"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/types/action"
 	"google.golang.org/grpc/codes"
@@ -32,7 +32,7 @@ func init() {
 		panic(err)
 	}
 
-	IdActions[auth.PasswordSubtype] = action.ActionSet{
+	IdActions[password.Subtype] = action.ActionSet{
 		action.NoOp,
 		action.Read,
 		action.Update,
diff --git a/internal/servers/controller/handlers/authmethods/password_test.go b/internal/servers/controller/handlers/authmethods/password_test.go
index 62fbfb6f3..553070e40 100644
--- a/internal/servers/controller/handlers/authmethods/password_test.go
+++ b/internal/servers/controller/handlers/authmethods/password_test.go
@@ -6,7 +6,6 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/auth/oidc"
 	"github.com/hashicorp/boundary/internal/auth/password"
 	"github.com/hashicorp/boundary/internal/authtoken"
@@ -18,6 +17,7 @@ import (
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
 	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/hashicorp/boundary/internal/kms"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers/authmethods"
 	"github.com/hashicorp/boundary/internal/types/scope"
diff --git a/internal/servers/controller/handlers/authtokens/authtoken_service.go b/internal/servers/controller/handlers/authtokens/authtoken_service.go
index 8a620675b..d1ff75a41 100644
--- a/internal/servers/controller/handlers/authtokens/authtoken_service.go
+++ b/internal/servers/controller/handlers/authtokens/authtoken_service.go
@@ -5,13 +5,13 @@ import (
 	"fmt"
 
 	"github.com/hashicorp/boundary/globals"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/authtoken"
 	"github.com/hashicorp/boundary/internal/errors"
 	pb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/authtokens"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
 	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/requests"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/common/scopeids"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
diff --git a/internal/servers/controller/handlers/authtokens/authtoken_service_test.go b/internal/servers/controller/handlers/authtokens/authtoken_service_test.go
index e1a6c8948..2d73d6a9f 100644
--- a/internal/servers/controller/handlers/authtokens/authtoken_service_test.go
+++ b/internal/servers/controller/handlers/authtokens/authtoken_service_test.go
@@ -8,7 +8,6 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/authtoken"
 	"github.com/hashicorp/boundary/internal/db"
 	pb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/authtokens"
@@ -18,6 +17,7 @@ import (
 	"github.com/hashicorp/boundary/internal/kms"
 	"github.com/hashicorp/boundary/internal/requests"
 	"github.com/hashicorp/boundary/internal/servers"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers/authtokens"
 	"github.com/hashicorp/boundary/internal/types/scope"
diff --git a/internal/servers/controller/handlers/credentiallibraries/credentiallibrary_service.go b/internal/servers/controller/handlers/credentiallibraries/credentiallibrary_service.go
index 54e4defbc..a208d194a 100644
--- a/internal/servers/controller/handlers/credentiallibraries/credentiallibrary_service.go
+++ b/internal/servers/controller/handlers/credentiallibraries/credentiallibrary_service.go
@@ -6,7 +6,6 @@ import (
 	"strings"
 
 	"github.com/hashicorp/boundary/globals"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/credential"
 	"github.com/hashicorp/boundary/internal/credential/vault"
 	"github.com/hashicorp/boundary/internal/credential/vault/store"
@@ -15,6 +14,7 @@ import (
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
 	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/requests"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/types/action"
@@ -379,7 +379,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) auth.
 		opts = append(opts, auth.WithId(id))
 
 		switch credential.SubtypeFromId(id) {
-		case credential.VaultSubtype:
+		case vault.Subtype:
 			cl, err := repo.LookupCredentialLibrary(ctx, id)
 			if err != nil {
 				res.Error = err
@@ -404,7 +404,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) auth.
 	opts = append(opts, auth.WithPin(parentId))
 
 	switch credential.SubtypeFromId(parentId) {
-	case credential.VaultSubtype:
+	case vault.Subtype:
 		cs, err := repo.LookupCredentialStore(ctx, parentId)
 		if err != nil {
 			res.Error = err
@@ -465,7 +465,7 @@ func toProto(in credential.Library, opt ...handlers.Option) (*pb.CredentialLibra
 	}
 	if outputFields.Has(globals.AttributesField) {
 		switch credential.SubtypeFromId(in.GetPublicId()) {
-		case credential.VaultSubtype:
+		case vault.Subtype:
 			vaultIn, ok := in.(*vault.CredentialLibrary)
 			if !ok {
 				return nil, errors.New(errors.Internal, op, "unable to cast to vault credential library")
@@ -531,8 +531,8 @@ func validateCreateRequest(req *pbs.CreateCredentialLibraryRequest) error {
 	return handlers.ValidateCreateRequest(req.GetItem(), func() map[string]string {
 		badFields := map[string]string{}
 		switch credential.SubtypeFromId(req.GetItem().GetCredentialStoreId()) {
-		case credential.VaultSubtype:
-			if t := req.GetItem().GetType(); t != "" && credential.SubtypeFromType(t) != credential.VaultSubtype {
+		case vault.Subtype:
+			if t := req.GetItem().GetType(); t != "" && credential.SubtypeFromType(t) != vault.Subtype {
 				badFields[globals.CredentialStoreIdField] = "If included, type must match that of the credential store."
 			}
 			attrs := &pb.VaultCredentialLibraryAttributes{}
@@ -560,8 +560,8 @@ func validateUpdateRequest(req *pbs.UpdateCredentialLibraryRequest) error {
 	return handlers.ValidateUpdateRequest(req, req.GetItem(), func() map[string]string {
 		badFields := map[string]string{}
 		switch credential.SubtypeFromId(req.GetId()) {
-		case credential.VaultSubtype:
-			if req.GetItem().GetType() != "" && credential.SubtypeFromType(req.GetItem().GetType()) != credential.VaultSubtype {
+		case vault.Subtype:
+			if req.GetItem().GetType() != "" && credential.SubtypeFromType(req.GetItem().GetType()) != vault.Subtype {
 				badFields[globals.TypeField] = "Cannot modify resource type."
 			}
 			attrs := &pb.VaultCredentialLibraryAttributes{}
diff --git a/internal/servers/controller/handlers/credentiallibraries/credentiallibrary_service_test.go b/internal/servers/controller/handlers/credentiallibraries/credentiallibrary_service_test.go
index 57e2d4a8b..f4a7ff2e9 100644
--- a/internal/servers/controller/handlers/credentiallibraries/credentiallibrary_service_test.go
+++ b/internal/servers/controller/handlers/credentiallibraries/credentiallibrary_service_test.go
@@ -7,8 +7,6 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/boundary/internal/auth"
-	"github.com/hashicorp/boundary/internal/credential"
 	"github.com/hashicorp/boundary/internal/credential/vault"
 	"github.com/hashicorp/boundary/internal/db"
 	"github.com/hashicorp/boundary/internal/errors"
@@ -19,6 +17,7 @@ import (
 	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/hashicorp/boundary/internal/kms"
 	"github.com/hashicorp/boundary/internal/scheduler"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/types/scope"
 	"github.com/stretchr/testify/assert"
@@ -63,7 +62,7 @@ func TestList(t *testing.T) {
 			CreatedTime:       l.GetCreateTime().GetTimestamp(),
 			UpdatedTime:       l.GetUpdateTime().GetTimestamp(),
 			Version:           l.GetVersion(),
-			Type:              credential.VaultSubtype.String(),
+			Type:              vault.Subtype.String(),
 			AuthorizedActions: testAuthorizedActions,
 			Attributes: func() *structpb.Struct {
 				attrs, err := handlers.ProtoToStruct(&pb.VaultCredentialLibraryAttributes{
@@ -251,7 +250,7 @@ func TestCreate(t *testing.T) {
 		{
 			name: "parent id must be included",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
-				Type: credential.VaultSubtype.String(),
+				Type: vault.Subtype.String(),
 				Attributes: func() *structpb.Struct {
 					attrs, err := handlers.ProtoToStruct(&pb.VaultCredentialLibraryAttributes{
 						Path: wrapperspb.String("something"),
@@ -351,7 +350,7 @@ func TestCreate(t *testing.T) {
 					UpdatedTime:       store.GetUpdateTime().GetTimestamp(),
 					Scope:             &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()},
 					Version:           1,
-					Type:              credential.VaultSubtype.String(),
+					Type:              vault.Subtype.String(),
 					Attributes: func() *structpb.Struct {
 						attrs, err := handlers.ProtoToStruct(&pb.VaultCredentialLibraryAttributes{
 							Path:            wrapperspb.String("something"),
@@ -391,7 +390,7 @@ func TestCreate(t *testing.T) {
 					Description:       &wrapperspb.StringValue{Value: "desc"},
 					Scope:             &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()},
 					Version:           1,
-					Type:              credential.VaultSubtype.String(),
+					Type:              vault.Subtype.String(),
 					Attributes: func() *structpb.Struct {
 						attrs, err := handlers.ProtoToStruct(&pb.VaultCredentialLibraryAttributes{
 							Path:       wrapperspb.String("something"),
@@ -480,7 +479,7 @@ func TestGet(t *testing.T) {
 					Id:                vl.GetPublicId(),
 					CredentialStoreId: vl.GetStoreId(),
 					Scope:             &scopepb.ScopeInfo{Id: store.GetScopeId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
-					Type:              credential.VaultSubtype.String(),
+					Type:              vault.Subtype.String(),
 					AuthorizedActions: testAuthorizedActions,
 					CreatedTime:       vl.CreateTime.GetTimestamp(),
 					UpdatedTime:       vl.UpdateTime.GetTimestamp(),
diff --git a/internal/servers/controller/handlers/credentialstores/credentialstore_service.go b/internal/servers/controller/handlers/credentialstores/credentialstore_service.go
index b58f3765b..167ce764e 100644
--- a/internal/servers/controller/handlers/credentialstores/credentialstore_service.go
+++ b/internal/servers/controller/handlers/credentialstores/credentialstore_service.go
@@ -7,7 +7,6 @@ import (
 	"fmt"
 
 	"github.com/hashicorp/boundary/globals"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/credential"
 	"github.com/hashicorp/boundary/internal/credential/vault"
 	"github.com/hashicorp/boundary/internal/credential/vault/store"
@@ -16,6 +15,7 @@ import (
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
 	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/requests"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/common/scopeids"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
@@ -502,7 +502,7 @@ func toProto(in credential.Store, opt ...handlers.Option) (*pb.CredentialStore,
 	}
 	if outputFields.Has(globals.AttributesField) {
 		switch credential.SubtypeFromId(in.GetPublicId()) {
-		case credential.VaultSubtype:
+		case vault.Subtype:
 			vaultIn, ok := in.(*vault.CredentialStore)
 			if !ok {
 				return nil, errors.New(errors.Internal, op, "unable to cast to vault credential store")
@@ -613,7 +613,7 @@ func validateCreateRequest(req *pbs.CreateCredentialStoreRequest) error {
 			badFields["scope_id"] = "This field must be a valid project scope id."
 		}
 		switch credential.SubtypeFromType(req.GetItem().GetType()) {
-		case credential.VaultSubtype:
+		case vault.Subtype:
 			attrs := &pb.VaultCredentialStoreAttributes{}
 			if err := handlers.StructToProto(req.GetItem().GetAttributes(), attrs); err != nil {
 				badFields[globals.AttributesField] = fmt.Sprintf("Attribute fields do not match the expected format. Got %#v", req.GetItem().GetAttributes().AsMap())
@@ -656,8 +656,8 @@ func validateUpdateRequest(req *pbs.UpdateCredentialStoreRequest) error {
 	return handlers.ValidateUpdateRequest(req, req.GetItem(), func() map[string]string {
 		badFields := map[string]string{}
 		switch credential.SubtypeFromId(req.GetId()) {
-		case credential.VaultSubtype:
-			if req.GetItem().GetType() != "" && credential.SubtypeFromType(req.GetItem().GetType()) != credential.VaultSubtype {
+		case vault.Subtype:
+			if req.GetItem().GetType() != "" && credential.SubtypeFromType(req.GetItem().GetType()) != vault.Subtype {
 				badFields["type"] = "Cannot modify resource type."
 			}
 			attrs := &pb.VaultCredentialStoreAttributes{}
diff --git a/internal/servers/controller/handlers/credentialstores/credentialstore_service_test.go b/internal/servers/controller/handlers/credentialstores/credentialstore_service_test.go
index ae4634767..9b4dd48e5 100644
--- a/internal/servers/controller/handlers/credentialstores/credentialstore_service_test.go
+++ b/internal/servers/controller/handlers/credentialstores/credentialstore_service_test.go
@@ -10,8 +10,6 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/boundary/internal/auth"
-	"github.com/hashicorp/boundary/internal/credential"
 	"github.com/hashicorp/boundary/internal/credential/vault"
 	"github.com/hashicorp/boundary/internal/db"
 	"github.com/hashicorp/boundary/internal/errors"
@@ -22,6 +20,7 @@ import (
 	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/hashicorp/boundary/internal/kms"
 	"github.com/hashicorp/boundary/internal/scheduler"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/types/scope"
 	"github.com/stretchr/testify/assert"
@@ -64,7 +63,7 @@ func TestList(t *testing.T) {
 			CreatedTime:       s.GetCreateTime().GetTimestamp(),
 			UpdatedTime:       s.GetUpdateTime().GetTimestamp(),
 			Version:           s.GetVersion(),
-			Type:              credential.VaultSubtype.String(),
+			Type:              vault.Subtype.String(),
 			AuthorizedActions: testAuthorizedActions,
 			Attributes: func() *structpb.Struct {
 				attrs, err := handlers.ProtoToStruct(&pb.VaultCredentialStoreAttributes{
@@ -186,7 +185,7 @@ func TestCreate(t *testing.T) {
 			name: "missing ca certificate",
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId: prj.GetPublicId(),
-				Type:    credential.VaultSubtype.String(),
+				Type:    vault.Subtype.String(),
 				Attributes: func() *structpb.Struct {
 					attrs, err := handlers.ProtoToStruct(&pb.VaultCredentialStoreAttributes{
 						Address:              wrapperspb.String(v.Addr),
@@ -205,7 +204,7 @@ func TestCreate(t *testing.T) {
 			name: "Bad token",
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId: prj.GetPublicId(),
-				Type:    credential.VaultSubtype.String(),
+				Type:    vault.Subtype.String(),
 				Attributes: func() *structpb.Struct {
 					attrs, err := handlers.ProtoToStruct(&pb.VaultCredentialStoreAttributes{
 						Address:              wrapperspb.String(v.Addr),
@@ -225,7 +224,7 @@ func TestCreate(t *testing.T) {
 			name: "Define only client cert",
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId: prj.GetPublicId(),
-				Type:    credential.VaultSubtype.String(),
+				Type:    vault.Subtype.String(),
 				Attributes: func() *structpb.Struct {
 					attrs, err := handlers.ProtoToStruct(&pb.VaultCredentialStoreAttributes{
 						Address:           wrapperspb.String(v.Addr),
@@ -244,7 +243,7 @@ func TestCreate(t *testing.T) {
 			name: "Define only client cert key",
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId: prj.GetPublicId(),
-				Type:    credential.VaultSubtype.String(),
+				Type:    vault.Subtype.String(),
 				Attributes: func() *structpb.Struct {
 					attrs, err := handlers.ProtoToStruct(&pb.VaultCredentialStoreAttributes{
 						Address:              wrapperspb.String(v.Addr),
@@ -263,7 +262,7 @@ func TestCreate(t *testing.T) {
 			name: "Define key in both client cert payload and key field",
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId: prj.GetPublicId(),
-				Type:    credential.VaultSubtype.String(),
+				Type:    vault.Subtype.String(),
 				Attributes: func() *structpb.Struct {
 					attrs, err := handlers.ProtoToStruct(&pb.VaultCredentialStoreAttributes{
 						Address:              wrapperspb.String(v.Addr),
@@ -284,7 +283,7 @@ func TestCreate(t *testing.T) {
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId: prj.GetPublicId(),
 				Id:      vault.CredentialStorePrefix + "_notallowed",
-				Type:    credential.VaultSubtype.String(),
+				Type:    vault.Subtype.String(),
 				Attributes: func() *structpb.Struct {
 					attrs, err := handlers.ProtoToStruct(&pb.VaultCredentialStoreAttributes{
 						Address: wrapperspb.String(v.Addr),
@@ -302,7 +301,7 @@ func TestCreate(t *testing.T) {
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId:     prj.GetPublicId(),
 				CreatedTime: timestamppb.Now(),
-				Type:        credential.VaultSubtype.String(),
+				Type:        vault.Subtype.String(),
 				Attributes: func() *structpb.Struct {
 					attrs, err := handlers.ProtoToStruct(&pb.VaultCredentialStoreAttributes{
 						Address: wrapperspb.String(v.Addr),
@@ -320,7 +319,7 @@ func TestCreate(t *testing.T) {
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId:     prj.GetPublicId(),
 				UpdatedTime: timestamppb.Now(),
-				Type:        credential.VaultSubtype.String(),
+				Type:        vault.Subtype.String(),
 				Attributes: func() *structpb.Struct {
 					attrs, err := handlers.ProtoToStruct(&pb.VaultCredentialStoreAttributes{
 						Address: wrapperspb.String(v.Addr),
@@ -338,7 +337,7 @@ func TestCreate(t *testing.T) {
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId:     prj.GetPublicId(),
 				UpdatedTime: timestamppb.Now(),
-				Type:        credential.VaultSubtype.String(),
+				Type:        vault.Subtype.String(),
 				Attributes: func() *structpb.Struct {
 					attrs, err := handlers.ProtoToStruct(&pb.VaultCredentialStoreAttributes{
 						Address: wrapperspb.String(v.Addr),
@@ -371,7 +370,7 @@ func TestCreate(t *testing.T) {
 			name: "Must specify vault VaultAddress",
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId: prj.GetPublicId(),
-				Type:    credential.VaultSubtype.String(),
+				Type:    vault.Subtype.String(),
 				Attributes: func() *structpb.Struct {
 					attrs, err := handlers.ProtoToStruct(&pb.VaultCredentialStoreAttributes{
 						Token: wrapperspb.String(newToken()),
@@ -387,7 +386,7 @@ func TestCreate(t *testing.T) {
 			name: "Must specify vault token",
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId: prj.GetPublicId(),
-				Type:    credential.VaultSubtype.String(),
+				Type:    vault.Subtype.String(),
 				Attributes: func() *structpb.Struct {
 					attrs, err := handlers.ProtoToStruct(&pb.VaultCredentialStoreAttributes{
 						Address: wrapperspb.String(v.Addr),
@@ -403,7 +402,7 @@ func TestCreate(t *testing.T) {
 			name: "Attributes must be valid for vault type",
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId: prj.GetPublicId(),
-				Type:    credential.VaultSubtype.String(),
+				Type:    vault.Subtype.String(),
 				Attributes: func() *structpb.Struct {
 					attrs, err := handlers.ProtoToStruct(&pb.VaultCredentialStoreAttributes{
 						Address: wrapperspb.String(v.Addr),
@@ -421,7 +420,7 @@ func TestCreate(t *testing.T) {
 			name: "Create a valid vault CredentialStore with client cert and key in same field",
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId: prj.GetPublicId(),
-				Type:    credential.VaultSubtype.String(),
+				Type:    vault.Subtype.String(),
 				Attributes: func() *structpb.Struct {
 					attrs, err := handlers.ProtoToStruct(&pb.VaultCredentialStoreAttributes{
 						Address:           wrapperspb.String(v.Addr),
@@ -440,7 +439,7 @@ func TestCreate(t *testing.T) {
 					ScopeId: prj.GetPublicId(),
 					Scope:   &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()},
 					Version: 1,
-					Type:    credential.VaultSubtype.String(),
+					Type:    vault.Subtype.String(),
 					Attributes: func() *structpb.Struct {
 						attrs, err := handlers.ProtoToStruct(&pb.VaultCredentialStoreAttributes{
 							CaCert:                   wrapperspb.String(string(v.CaCert)),
@@ -462,7 +461,7 @@ func TestCreate(t *testing.T) {
 				ScopeId:     prj.GetPublicId(),
 				Name:        &wrapperspb.StringValue{Value: "name"},
 				Description: &wrapperspb.StringValue{Value: "desc"},
-				Type:        credential.VaultSubtype.String(),
+				Type:        vault.Subtype.String(),
 				Attributes: func() *structpb.Struct {
 					attrs, err := handlers.ProtoToStruct(&pb.VaultCredentialStoreAttributes{
 						Address:              wrapperspb.String(v.Addr),
@@ -484,7 +483,7 @@ func TestCreate(t *testing.T) {
 					Description: &wrapperspb.StringValue{Value: "desc"},
 					Scope:       &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()},
 					Version:     1,
-					Type:        credential.VaultSubtype.String(),
+					Type:        vault.Subtype.String(),
 					Attributes: func() *structpb.Struct {
 						attrs, err := handlers.ProtoToStruct(&pb.VaultCredentialStoreAttributes{
 							CaCert:                   wrapperspb.String(string(v.CaCert)),
@@ -584,7 +583,7 @@ func TestGet(t *testing.T) {
 					Id:                store.GetPublicId(),
 					ScopeId:           store.GetScopeId(),
 					Scope:             &scopepb.ScopeInfo{Id: store.GetScopeId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
-					Type:              credential.VaultSubtype.String(),
+					Type:              vault.Subtype.String(),
 					AuthorizedActions: testAuthorizedActions,
 					CreatedTime:       store.CreateTime.GetTimestamp(),
 					UpdatedTime:       store.UpdateTime.GetTimestamp(),
diff --git a/internal/servers/controller/handlers/groups/group_service.go b/internal/servers/controller/handlers/groups/group_service.go
index 7971ac2e3..b6ebf8b49 100644
--- a/internal/servers/controller/handlers/groups/group_service.go
+++ b/internal/servers/controller/handlers/groups/group_service.go
@@ -5,7 +5,6 @@ import (
 	"fmt"
 
 	"github.com/hashicorp/boundary/globals"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/errors"
 	pb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/groups"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
@@ -13,6 +12,7 @@ import (
 	"github.com/hashicorp/boundary/internal/iam/store"
 	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/requests"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/common/scopeids"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
diff --git a/internal/servers/controller/handlers/groups/group_service_test.go b/internal/servers/controller/handlers/groups/group_service_test.go
index b22e1f530..faecdc04c 100644
--- a/internal/servers/controller/handlers/groups/group_service_test.go
+++ b/internal/servers/controller/handlers/groups/group_service_test.go
@@ -8,12 +8,12 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/db"
 	pb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/groups"
 	"github.com/hashicorp/boundary/internal/gen/controller/api/resources/scopes"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
 	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers/groups"
 	"github.com/hashicorp/boundary/internal/types/scope"
diff --git a/internal/servers/controller/handlers/host_catalogs/host_catalog_service.go b/internal/servers/controller/handlers/host_catalogs/host_catalog_service.go
index 986b63bbd..671242c0d 100644
--- a/internal/servers/controller/handlers/host_catalogs/host_catalog_service.go
+++ b/internal/servers/controller/handlers/host_catalogs/host_catalog_service.go
@@ -5,7 +5,6 @@ import (
 	"fmt"
 
 	"github.com/hashicorp/boundary/globals"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/errors"
 	pb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/hostcatalogs"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
@@ -14,6 +13,7 @@ import (
 	"github.com/hashicorp/boundary/internal/host/static/store"
 	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/requests"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/common/scopeids"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
@@ -473,7 +473,7 @@ func toProto(ctx context.Context, in *static.HostCatalog, opt ...handlers.Option
 		out.ScopeId = in.GetScopeId()
 	}
 	if outputFields.Has(globals.TypeField) {
-		out.Type = host.StaticSubtype.String()
+		out.Type = static.Subtype.String()
 	}
 	if outputFields.Has(globals.DescriptionField) && in.GetDescription() != "" {
 		out.Description = wrapperspb.String(in.GetDescription())
@@ -520,9 +520,9 @@ func validateCreateRequest(req *pbs.CreateHostCatalogRequest) error {
 			badFields["scope_id"] = "This field must be a valid project scope id."
 		}
 		switch host.SubtypeFromType(req.GetItem().GetType()) {
-		case host.StaticSubtype:
+		case static.Subtype:
 		default:
-			badFields["type"] = fmt.Sprintf("This is a required field and must be %q.", host.StaticSubtype.String())
+			badFields["type"] = fmt.Sprintf("This is a required field and must be %q.", static.Subtype.String())
 		}
 		return badFields
 	})
@@ -532,8 +532,8 @@ func validateUpdateRequest(req *pbs.UpdateHostCatalogRequest) error {
 	return handlers.ValidateUpdateRequest(req, req.GetItem(), func() map[string]string {
 		badFields := map[string]string{}
 		switch host.SubtypeFromId(req.GetId()) {
-		case host.StaticSubtype:
-			if req.GetItem().GetType() != "" && host.SubtypeFromType(req.GetItem().GetType()) != host.StaticSubtype {
+		case static.Subtype:
+			if req.GetItem().GetType() != "" && host.SubtypeFromType(req.GetItem().GetType()) != static.Subtype {
 				badFields["type"] = "Cannot modify resource type."
 			}
 		}
diff --git a/internal/servers/controller/handlers/host_catalogs/host_catalog_service_test.go b/internal/servers/controller/handlers/host_catalogs/host_catalog_service_test.go
index 7cba7f117..3274ee775 100644
--- a/internal/servers/controller/handlers/host_catalogs/host_catalog_service_test.go
+++ b/internal/servers/controller/handlers/host_catalogs/host_catalog_service_test.go
@@ -9,7 +9,6 @@ import (
 
 	"github.com/golang/protobuf/ptypes/wrappers"
 	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/db"
 	pb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/hostcatalogs"
 	scopepb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/scopes"
@@ -17,6 +16,7 @@ import (
 	"github.com/hashicorp/boundary/internal/host/static"
 	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/hashicorp/boundary/internal/kms"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers/host_catalogs"
diff --git a/internal/servers/controller/handlers/host_sets/host_set_service.go b/internal/servers/controller/handlers/host_sets/host_set_service.go
index ab2a43066..5d45d79ca 100644
--- a/internal/servers/controller/handlers/host_sets/host_set_service.go
+++ b/internal/servers/controller/handlers/host_sets/host_set_service.go
@@ -5,7 +5,6 @@ import (
 	"fmt"
 
 	"github.com/hashicorp/boundary/globals"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/errors"
 	pb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/hostsets"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
@@ -14,6 +13,7 @@ import (
 	"github.com/hashicorp/boundary/internal/host/static/store"
 	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/requests"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/types/action"
@@ -588,7 +588,7 @@ func toProto(ctx context.Context, in *static.HostSet, hosts []*static.Host, opt
 		out.HostCatalogId = in.GetCatalogId()
 	}
 	if outputFields.Has(globals.TypeField) {
-		out.Type = host.StaticSubtype.String()
+		out.Type = static.Subtype.String()
 	}
 	if outputFields.Has(globals.DescriptionField) && in.GetDescription() != "" {
 		out.Description = &wrapperspb.StringValue{Value: in.GetDescription()}
@@ -637,8 +637,8 @@ func validateCreateRequest(req *pbs.CreateHostSetRequest) error {
 			badFields["host_catalog_id"] = "The field is incorrectly formatted."
 		}
 		switch host.SubtypeFromId(req.GetItem().GetHostCatalogId()) {
-		case host.StaticSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != host.StaticSubtype.String() {
+		case static.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != static.Subtype.String() {
 				badFields["type"] = "Doesn't match the parent resource's type."
 			}
 		}
@@ -650,8 +650,8 @@ func validateUpdateRequest(req *pbs.UpdateHostSetRequest) error {
 	return handlers.ValidateUpdateRequest(req, req.GetItem(), func() map[string]string {
 		badFields := map[string]string{}
 		switch host.SubtypeFromId(req.GetId()) {
-		case host.StaticSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != host.StaticSubtype.String() {
+		case static.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != static.Subtype.String() {
 				badFields["type"] = "Cannot modify the resource type."
 			}
 		}
diff --git a/internal/servers/controller/handlers/host_sets/host_set_service_test.go b/internal/servers/controller/handlers/host_sets/host_set_service_test.go
index 36cb5bbda..d8df7ee8d 100644
--- a/internal/servers/controller/handlers/host_sets/host_set_service_test.go
+++ b/internal/servers/controller/handlers/host_sets/host_set_service_test.go
@@ -9,15 +9,14 @@ import (
 
 	"github.com/golang/protobuf/ptypes/wrappers"
 	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/db"
 	pb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/hostsets"
 	"github.com/hashicorp/boundary/internal/gen/controller/api/resources/scopes"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
-	"github.com/hashicorp/boundary/internal/host"
 	"github.com/hashicorp/boundary/internal/host/static"
 	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/hashicorp/boundary/internal/kms"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers/host_sets"
 	"github.com/hashicorp/boundary/internal/types/scope"
@@ -151,7 +150,7 @@ func TestList(t *testing.T) {
 			CreatedTime:       h.GetCreateTime().GetTimestamp(),
 			UpdatedTime:       h.GetUpdateTime().GetTimestamp(),
 			Version:           h.GetVersion(),
-			Type:              host.StaticSubtype.String(),
+			Type:              static.Subtype.String(),
 			AuthorizedActions: testAuthorizedActions,
 		})
 	}
diff --git a/internal/servers/controller/handlers/hosts/host_service.go b/internal/servers/controller/handlers/hosts/host_service.go
index a9d77ca3a..f8acd2e52 100644
--- a/internal/servers/controller/handlers/hosts/host_service.go
+++ b/internal/servers/controller/handlers/hosts/host_service.go
@@ -7,7 +7,6 @@ import (
 	"strings"
 
 	"github.com/hashicorp/boundary/globals"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/errors"
 	pb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/hosts"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
@@ -16,10 +15,12 @@ import (
 	"github.com/hashicorp/boundary/internal/host/static/store"
 	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/requests"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/types/action"
 	"github.com/hashicorp/boundary/internal/types/resource"
+	"github.com/hashicorp/boundary/internal/types/subtypes"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/protobuf/types/known/wrapperspb"
 )
@@ -427,7 +428,7 @@ func toProto(ctx context.Context, in *static.Host, hostSets []*static.HostSet, o
 		out.HostCatalogId = in.GetCatalogId()
 	}
 	if outputFields.Has(globals.TypeField) {
-		out.Type = host.StaticSubtype.String()
+		out.Type = static.Subtype.String()
 	}
 	if outputFields.Has(globals.DescriptionField) && in.GetDescription() != "" {
 		out.Description = &wrapperspb.StringValue{Value: in.GetDescription()}
@@ -476,7 +477,7 @@ func validateGetRequest(req *pbs.GetHostRequest) error {
 	return handlers.ValidateGetRequest(func() map[string]string {
 		badFields := map[string]string{}
 		ct := host.SubtypeFromId(req.GetId())
-		if ct == host.UnknownSubtype {
+		if ct == subtypes.UnknownSubtype {
 			badFields["id"] = "Improperly formatted identifier used."
 		}
 		return badFields
@@ -490,8 +491,8 @@ func validateCreateRequest(req *pbs.CreateHostRequest) error {
 			badFields["host_catalog_id"] = "The field is incorrectly formatted."
 		}
 		switch host.SubtypeFromId(req.GetItem().GetHostCatalogId()) {
-		case host.StaticSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != host.StaticSubtype.String() {
+		case static.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != static.Subtype.String() {
 				badFields["type"] = "Doesn't match the parent resource's type."
 			}
 			attrs := &pb.StaticHostAttributes{}
@@ -521,8 +522,8 @@ func validateUpdateRequest(req *pbs.UpdateHostRequest) error {
 	return handlers.ValidateUpdateRequest(req, req.GetItem(), func() map[string]string {
 		badFields := map[string]string{}
 		switch host.SubtypeFromId(req.GetId()) {
-		case host.StaticSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != host.StaticSubtype.String() {
+		case static.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != static.Subtype.String() {
 				badFields["type"] = "Cannot modify the resource type."
 
 				attrs := &pb.StaticHostAttributes{}
diff --git a/internal/servers/controller/handlers/hosts/host_service_test.go b/internal/servers/controller/handlers/hosts/host_service_test.go
index 71bf1ec8a..bbf771e56 100644
--- a/internal/servers/controller/handlers/hosts/host_service_test.go
+++ b/internal/servers/controller/handlers/hosts/host_service_test.go
@@ -9,15 +9,14 @@ import (
 
 	"github.com/golang/protobuf/ptypes/wrappers"
 	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/db"
 	pb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/hosts"
 	"github.com/hashicorp/boundary/internal/gen/controller/api/resources/scopes"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
-	"github.com/hashicorp/boundary/internal/host"
 	"github.com/hashicorp/boundary/internal/host/static"
 	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/hashicorp/boundary/internal/kms"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers/hosts"
 	"github.com/hashicorp/boundary/internal/types/scope"
@@ -144,7 +143,7 @@ func TestList(t *testing.T) {
 			CreatedTime:   h.GetCreateTime().GetTimestamp(),
 			UpdatedTime:   h.GetUpdateTime().GetTimestamp(),
 			Version:       h.GetVersion(),
-			Type:          host.StaticSubtype.String(), Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
+			Type:          static.Subtype.String(), Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 				"address": structpb.NewStringValue(h.GetAddress()),
 			}},
 			AuthorizedActions: testAuthorizedActions,
diff --git a/internal/servers/controller/handlers/managed_groups/managed_group_service.go b/internal/servers/controller/handlers/managed_groups/managed_group_service.go
index 75c613e63..aa321b20c 100644
--- a/internal/servers/controller/handlers/managed_groups/managed_group_service.go
+++ b/internal/servers/controller/handlers/managed_groups/managed_group_service.go
@@ -14,10 +14,12 @@ import (
 	"github.com/hashicorp/boundary/internal/intglobals"
 	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/requests"
+	requestauth "github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/types/action"
 	"github.com/hashicorp/boundary/internal/types/resource"
+	"github.com/hashicorp/boundary/internal/types/subtypes"
 	"github.com/hashicorp/go-bexpr"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/protobuf/types/known/wrapperspb"
@@ -33,8 +35,8 @@ var (
 
 	// IdActions contains the set of actions that can be performed on
 	// individual resources
-	IdActions = map[auth.Subtype]action.ActionSet{
-		auth.OidcSubtype: {
+	IdActions = map[subtypes.Subtype]action.ActionSet{
+		oidc.Subtype: {
 			action.NoOp,
 			action.Read,
 			action.Update,
@@ -105,7 +107,7 @@ func (s Service) ListManagedGroups(ctx context.Context, req *pbs.ListManagedGrou
 	}
 	for _, mg := range ul {
 		res.Id = mg.GetPublicId()
-		authorizedActions := authResults.FetchActionSetForId(ctx, mg.GetPublicId(), IdActions[auth.SubtypeFromId(mg.GetPublicId())], auth.WithResource(&res)).Strings()
+		authorizedActions := authResults.FetchActionSetForId(ctx, mg.GetPublicId(), IdActions[auth.SubtypeFromId(mg.GetPublicId())], requestauth.WithResource(&res)).Strings()
 		if len(authorizedActions) == 0 {
 			continue
 		}
@@ -274,7 +276,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (auth.ManagedGroup,
 	var out auth.ManagedGroup
 	var memberIds []string
 	switch auth.SubtypeFromId(id) {
-	case auth.OidcSubtype:
+	case oidc.Subtype:
 		repo, err := s.oidcRepoFn()
 		if err != nil {
 			return nil, nil, err
@@ -346,7 +348,7 @@ func (s Service) createInRepo(ctx context.Context, am auth.AuthMethod, item *pb.
 	}
 	var out auth.ManagedGroup
 	switch auth.SubtypeFromId(am.GetPublicId()) {
-	case auth.OidcSubtype:
+	case oidc.Subtype:
 		am, err := s.createOidcInRepo(ctx, am, item)
 		if err != nil {
 			return nil, errors.Wrap(err, op)
@@ -406,7 +408,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, authMethodId string,
 	const op = "managed_groups.(Service).updateInRepo"
 	var out auth.ManagedGroup
 	switch auth.SubtypeFromId(req.GetId()) {
-	case auth.OidcSubtype:
+	case oidc.Subtype:
 		mg, err := s.updateOidcInRepo(ctx, scopeId, authMethodId, req.GetId(), req.GetUpdateMask().GetPaths(), req.GetItem())
 		if err != nil {
 			return nil, errors.Wrap(err, op)
@@ -424,7 +426,7 @@ func (s Service) deleteFromRepo(ctx context.Context, scopeId, id string) (bool,
 	var rows int
 	var err error
 	switch auth.SubtypeFromId(id) {
-	case auth.OidcSubtype:
+	case oidc.Subtype:
 		repo, iErr := s.oidcRepoFn()
 		if iErr != nil {
 			return false, iErr
@@ -445,7 +447,7 @@ func (s Service) listFromRepo(ctx context.Context, authMethodId string) ([]auth.
 
 	var outUl []auth.ManagedGroup
 	switch auth.SubtypeFromId(authMethodId) {
-	case auth.OidcSubtype:
+	case oidc.Subtype:
 		oidcRepo, err := s.oidcRepoFn()
 		if err != nil {
 			return nil, errors.Wrap(err, op)
@@ -461,8 +463,9 @@ func (s Service) listFromRepo(ctx context.Context, authMethodId string) ([]auth.
 	return outUl, nil
 }
 
-func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Type) (auth.AuthMethod, auth.VerifyResults) {
-	res := auth.VerifyResults{}
+func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Type) (auth.AuthMethod, requestauth.VerifyResults) {
+	const op = "managed_groups.(Service)."
+	res := requestauth.VerifyResults{}
 	oidcRepo, err := s.oidcRepoFn()
 	if err != nil {
 		res.Error = err
@@ -470,13 +473,13 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 	}
 
 	var parentId string
-	opts := []auth.Option{auth.WithType(resource.ManagedGroup), auth.WithAction(a)}
+	opts := []requestauth.Option{requestauth.WithType(resource.ManagedGroup), requestauth.WithAction(a)}
 	switch a {
 	case action.List, action.Create:
 		parentId = id
 	default:
 		switch auth.SubtypeFromId(id) {
-		case auth.OidcSubtype:
+		case oidc.Subtype:
 			acct, err := oidcRepo.LookupManagedGroup(ctx, id)
 			if err != nil {
 				res.Error = err
@@ -487,13 +490,16 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 				return nil, res
 			}
 			parentId = acct.GetAuthMethodId()
+		default:
+			res.Error = errors.New(errors.InvalidPublicId, op, "unrecognized managed group subtype")
+			return nil, res
 		}
-		opts = append(opts, auth.WithId(id))
+		opts = append(opts, requestauth.WithId(id))
 	}
 
 	var authMeth auth.AuthMethod
 	switch auth.SubtypeFromId(parentId) {
-	case auth.OidcSubtype:
+	case oidc.Subtype:
 		am, err := oidcRepo.LookupAuthMethod(ctx, parentId)
 		if err != nil {
 			res.Error = err
@@ -504,9 +510,13 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 			return nil, res
 		}
 		authMeth = am
+		opts = append(opts, requestauth.WithScopeId(am.GetScopeId()))
+	default:
+		res.Error = errors.New(errors.InvalidPublicId, op, "unrecognized auth method subtype")
+		return nil, res
 	}
-	opts = append(opts, auth.WithScopeId(authMeth.GetScopeId()), auth.WithPin(parentId))
-	return authMeth, auth.Verify(ctx, opts...)
+	opts = append(opts, requestauth.WithPin(parentId))
+	return authMeth, requestauth.Verify(ctx, opts...)
 }
 
 func toProto(ctx context.Context, in auth.ManagedGroup, opt ...handlers.Option) (*pb.ManagedGroup, error) {
@@ -550,7 +560,7 @@ func toProto(ctx context.Context, in auth.ManagedGroup, opt ...handlers.Option)
 	switch i := in.(type) {
 	case *oidc.ManagedGroup:
 		if outputFields.Has(globals.TypeField) {
-			out.Type = auth.OidcSubtype.String()
+			out.Type = oidc.Subtype.String()
 		}
 		if !outputFields.Has(globals.AttributesField) {
 			break
@@ -591,8 +601,8 @@ func validateCreateRequest(req *pbs.CreateManagedGroupRequest) error {
 			badFields[globals.AuthMethodIdField] = "This field is required."
 		}
 		switch auth.SubtypeFromId(req.GetItem().GetAuthMethodId()) {
-		case auth.OidcSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != auth.OidcSubtype.String() {
+		case oidc.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != oidc.Subtype.String() {
 				badFields[globals.TypeField] = "Doesn't match the parent resource's type."
 			}
 			attrs := &pb.OidcManagedGroupAttributes{}
@@ -621,8 +631,8 @@ func validateUpdateRequest(req *pbs.UpdateManagedGroupRequest) error {
 	return handlers.ValidateUpdateRequest(req, req.GetItem(), func() map[string]string {
 		badFields := map[string]string{}
 		switch auth.SubtypeFromId(req.GetId()) {
-		case auth.OidcSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != auth.OidcSubtype.String() {
+		case oidc.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != oidc.Subtype.String() {
 				badFields[globals.TypeField] = "Cannot modify the resource type."
 			}
 			attrs := &pb.OidcManagedGroupAttributes{}
@@ -638,6 +648,8 @@ func validateUpdateRequest(req *pbs.UpdateManagedGroupRequest) error {
 					}
 				}
 			}
+		default:
+			badFields[globals.IdField] = "Unrecognized resource type."
 		}
 		return badFields
 	}, intglobals.OidcManagedGroupPrefix)
diff --git a/internal/servers/controller/handlers/managed_groups/managed_group_service_test.go b/internal/servers/controller/handlers/managed_groups/managed_group_service_test.go
index a875e3455..121b25fb3 100644
--- a/internal/servers/controller/handlers/managed_groups/managed_group_service_test.go
+++ b/internal/servers/controller/handlers/managed_groups/managed_group_service_test.go
@@ -11,8 +11,8 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/hashicorp/boundary/globals"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/auth/oidc"
+	"github.com/hashicorp/boundary/internal/auth/password"
 	"github.com/hashicorp/boundary/internal/authtoken"
 	"github.com/hashicorp/boundary/internal/db"
 	pb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/managedgroups"
@@ -21,6 +21,7 @@ import (
 	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/hashicorp/boundary/internal/intglobals"
 	"github.com/hashicorp/boundary/internal/kms"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers/managed_groups"
@@ -213,7 +214,7 @@ func TestListOidc(t *testing.T) {
 			UpdatedTime:  mg.GetUpdateTime().GetTimestamp(),
 			Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 			Version:      1,
-			Type:         auth.OidcSubtype.String(),
+			Type:         oidc.Subtype.String(),
 			Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 				"filter": structpb.NewStringValue(oidc.TestFakeManagedGroupFilter),
 			}},
@@ -232,7 +233,7 @@ func TestListOidc(t *testing.T) {
 			UpdatedTime:  mg.GetUpdateTime().GetTimestamp(),
 			Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 			Version:      1,
-			Type:         auth.OidcSubtype.String(),
+			Type:         oidc.Subtype.String(),
 			Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 				"filter": structpb.NewStringValue(oidc.TestFakeManagedGroupFilter),
 			}},
@@ -483,7 +484,7 @@ func TestCreateOidc(t *testing.T) {
 					AuthMethodId: am.GetPublicId(),
 					Name:         &wrapperspb.StringValue{Value: "name"},
 					Description:  &wrapperspb.StringValue{Value: "desc"},
-					Type:         auth.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attributes:   createAttr(),
 				},
 			},
@@ -495,7 +496,7 @@ func TestCreateOidc(t *testing.T) {
 					Description:  &wrapperspb.StringValue{Value: "desc"},
 					Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Version:      1,
-					Type:         auth.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attributes: func() *structpb.Struct {
 						a := createAttr()
 						a.Fields["filter"] = structpb.NewStringValue(oidc.TestFakeManagedGroupFilter)
@@ -519,7 +520,7 @@ func TestCreateOidc(t *testing.T) {
 					AuthMethodId: am.GetPublicId(),
 					Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Version:      1,
-					Type:         auth.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attributes: func() *structpb.Struct {
 						a := createAttr()
 						a.Fields["filter"] = structpb.NewStringValue(oidc.TestFakeManagedGroupFilter)
@@ -534,7 +535,7 @@ func TestCreateOidc(t *testing.T) {
 			req: &pbs.CreateManagedGroupRequest{
 				Item: &pb.ManagedGroup{
 					AuthMethodId: am.GetPublicId(),
-					Type:         auth.PasswordSubtype.String(),
+					Type:         password.Subtype.String(),
 					Attributes:   createAttr(),
 				},
 			},
@@ -547,7 +548,7 @@ func TestCreateOidc(t *testing.T) {
 				Item: &pb.ManagedGroup{
 					AuthMethodId: am.GetPublicId(),
 					Id:           intglobals.OidcManagedGroupPrefix + "_notallowed",
-					Type:         auth.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attributes:   createAttr(),
 				},
 			},
@@ -560,7 +561,7 @@ func TestCreateOidc(t *testing.T) {
 				Item: &pb.ManagedGroup{
 					AuthMethodId: am.GetPublicId(),
 					CreatedTime:  timestamppb.Now(),
-					Type:         auth.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attributes:   createAttr(),
 				},
 			},
@@ -573,7 +574,7 @@ func TestCreateOidc(t *testing.T) {
 				Item: &pb.ManagedGroup{
 					AuthMethodId: am.GetPublicId(),
 					UpdatedTime:  timestamppb.Now(),
-					Type:         auth.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attributes:   createAttr(),
 				},
 			},
@@ -586,7 +587,7 @@ func TestCreateOidc(t *testing.T) {
 				Item: &pb.ManagedGroup{
 					AuthMethodId: am.GetPublicId(),
 					UpdatedTime:  timestamppb.Now(),
-					Type:         auth.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attributes: func() *structpb.Struct {
 						a := createAttr()
 						a.Fields["filter"] = structpb.NewStringValue("foobar")
@@ -691,7 +692,7 @@ func TestUpdateOidc(t *testing.T) {
 				Item: &pb.ManagedGroup{
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
-					Type:        auth.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 				},
 			},
 			res: &pbs.UpdateManagedGroupResponse{
@@ -699,7 +700,7 @@ func TestUpdateOidc(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "new"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
-					Type:              auth.OidcSubtype.String(),
+					Type:              oidc.Subtype.String(),
 					Attributes:        defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: oidcAuthorizedActions,
@@ -715,7 +716,7 @@ func TestUpdateOidc(t *testing.T) {
 				Item: &pb.ManagedGroup{
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
-					Type:        auth.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 				},
 			},
 			res: &pbs.UpdateManagedGroupResponse{
@@ -723,7 +724,7 @@ func TestUpdateOidc(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "new"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
-					Type:              auth.OidcSubtype.String(),
+					Type:              oidc.Subtype.String(),
 					Attributes:        defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: oidcAuthorizedActions,
@@ -793,7 +794,7 @@ func TestUpdateOidc(t *testing.T) {
 				Item: &pb.ManagedGroup{
 					AuthMethodId:      am.GetPublicId(),
 					Description:       &wrapperspb.StringValue{Value: "default"},
-					Type:              auth.OidcSubtype.String(),
+					Type:              oidc.Subtype.String(),
 					Attributes:        defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: oidcAuthorizedActions,
@@ -817,7 +818,7 @@ func TestUpdateOidc(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "updated"},
 					Description:       &wrapperspb.StringValue{Value: "default"},
-					Type:              auth.OidcSubtype.String(),
+					Type:              oidc.Subtype.String(),
 					Attributes:        defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: oidcAuthorizedActions,
@@ -841,7 +842,7 @@ func TestUpdateOidc(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "default"},
 					Description:       &wrapperspb.StringValue{Value: "notignored"},
-					Type:              auth.OidcSubtype.String(),
+					Type:              oidc.Subtype.String(),
 					Attributes:        defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: oidcAuthorizedActions,
@@ -943,7 +944,7 @@ func TestUpdateOidc(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "default"},
 					Description:       &wrapperspb.StringValue{Value: "default"},
-					Type:              auth.OidcSubtype.String(),
+					Type:              oidc.Subtype.String(),
 					Attributes:        modifiedAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: oidcAuthorizedActions,
diff --git a/internal/servers/controller/handlers/managed_groups/validate_test.go b/internal/servers/controller/handlers/managed_groups/validate_test.go
index c1048cc73..4086c60c8 100644
--- a/internal/servers/controller/handlers/managed_groups/validate_test.go
+++ b/internal/servers/controller/handlers/managed_groups/validate_test.go
@@ -6,8 +6,8 @@ import (
 	"testing"
 
 	"github.com/hashicorp/boundary/globals"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/auth/oidc"
+	"github.com/hashicorp/boundary/internal/auth/password"
 	pb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/managedgroups"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
 	"github.com/hashicorp/boundary/internal/intglobals"
@@ -46,7 +46,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "missing oidc attributes",
 			item: &pb.ManagedGroup{
-				Type:         auth.OidcSubtype.String(),
+				Type:         oidc.Subtype.String(),
 				AuthMethodId: oidc.AuthMethodPrefix + "_1234567890",
 				Attributes:   &structpb.Struct{Fields: map[string]*structpb.Value{}},
 			},
@@ -55,7 +55,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "bad oidc attributes",
 			item: &pb.ManagedGroup{
-				Type:         auth.OidcSubtype.String(),
+				Type:         oidc.Subtype.String(),
 				AuthMethodId: oidc.AuthMethodPrefix + "_1234567890",
 				Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 					"filter": structpb.NewStringValue("foobar"),
@@ -66,7 +66,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "no oidc errors",
 			item: &pb.ManagedGroup{
-				Type:         auth.OidcSubtype.String(),
+				Type:         oidc.Subtype.String(),
 				AuthMethodId: oidc.AuthMethodPrefix + "_1234567890",
 				Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 					"filter": structpb.NewStringValue(`"/foo/bar" == "zipzap"`),
@@ -101,7 +101,7 @@ func TestValidateUpdateRequest(t *testing.T) {
 			req: &pbs.UpdateManagedGroupRequest{
 				Id: intglobals.OidcManagedGroupPrefix + "_1234567890",
 				Item: &pb.ManagedGroup{
-					Type: auth.PasswordSubtype.String(),
+					Type: password.Subtype.String(),
 				},
 			},
 			errContains: fieldError(globals.TypeField, "Cannot modify the resource type."),
diff --git a/internal/servers/controller/handlers/roles/role_service.go b/internal/servers/controller/handlers/roles/role_service.go
index 695b64f59..815e6dc30 100644
--- a/internal/servers/controller/handlers/roles/role_service.go
+++ b/internal/servers/controller/handlers/roles/role_service.go
@@ -5,7 +5,6 @@ import (
 	"fmt"
 
 	"github.com/hashicorp/boundary/globals"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/errors"
 	pb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/roles"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
@@ -14,6 +13,7 @@ import (
 	"github.com/hashicorp/boundary/internal/intglobals"
 	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/requests"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/common/scopeids"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
diff --git a/internal/servers/controller/handlers/roles/role_service_test.go b/internal/servers/controller/handlers/roles/role_service_test.go
index d9cef7986..aa4111f3e 100644
--- a/internal/servers/controller/handlers/roles/role_service_test.go
+++ b/internal/servers/controller/handlers/roles/role_service_test.go
@@ -8,7 +8,6 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/auth/oidc"
 	"github.com/hashicorp/boundary/internal/db"
 	pb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/roles"
@@ -17,6 +16,7 @@ import (
 	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/hashicorp/boundary/internal/kms"
 	"github.com/hashicorp/boundary/internal/perms"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers/roles"
 	"github.com/hashicorp/boundary/internal/types/scope"
diff --git a/internal/servers/controller/handlers/scopes/scope_service.go b/internal/servers/controller/handlers/scopes/scope_service.go
index 9ca1b0b14..4ad2070dc 100644
--- a/internal/servers/controller/handlers/scopes/scope_service.go
+++ b/internal/servers/controller/handlers/scopes/scope_service.go
@@ -7,7 +7,6 @@ import (
 	"strings"
 
 	"github.com/hashicorp/boundary/globals"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/auth/oidc"
 	"github.com/hashicorp/boundary/internal/auth/password"
 	"github.com/hashicorp/boundary/internal/errors"
@@ -17,6 +16,7 @@ import (
 	"github.com/hashicorp/boundary/internal/iam/store"
 	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/requests"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/common/scopeids"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
diff --git a/internal/servers/controller/handlers/scopes/scope_service_test.go b/internal/servers/controller/handlers/scopes/scope_service_test.go
index 09ac1495f..1dadbd549 100644
--- a/internal/servers/controller/handlers/scopes/scope_service_test.go
+++ b/internal/servers/controller/handlers/scopes/scope_service_test.go
@@ -9,12 +9,12 @@ import (
 
 	"github.com/golang/protobuf/ptypes/wrappers"
 	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/db"
 	pb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/scopes"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
 	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/hashicorp/boundary/internal/perms"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers/scopes"
 	"github.com/hashicorp/boundary/internal/types/scope"
diff --git a/internal/servers/controller/handlers/sessions/session_service.go b/internal/servers/controller/handlers/sessions/session_service.go
index 42c60f6e2..afa53a286 100644
--- a/internal/servers/controller/handlers/sessions/session_service.go
+++ b/internal/servers/controller/handlers/sessions/session_service.go
@@ -6,12 +6,12 @@ import (
 	"fmt"
 
 	"github.com/hashicorp/boundary/globals"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/errors"
 	pb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/sessions"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
 	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/requests"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/common/scopeids"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
diff --git a/internal/servers/controller/handlers/sessions/session_service_test.go b/internal/servers/controller/handlers/sessions/session_service_test.go
index d12a26dca..1646714f2 100644
--- a/internal/servers/controller/handlers/sessions/session_service_test.go
+++ b/internal/servers/controller/handlers/sessions/session_service_test.go
@@ -8,7 +8,6 @@ import (
 	"time"
 
 	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/authtoken"
 	"github.com/hashicorp/boundary/internal/db"
 	"github.com/hashicorp/boundary/internal/errors"
@@ -19,6 +18,7 @@ import (
 	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/hashicorp/boundary/internal/kms"
 	"github.com/hashicorp/boundary/internal/servers"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers/sessions"
 	"github.com/hashicorp/boundary/internal/session"
diff --git a/internal/servers/controller/handlers/targets/target_service.go b/internal/servers/controller/handlers/targets/target_service.go
index da6b578f9..e7784d362 100644
--- a/internal/servers/controller/handlers/targets/target_service.go
+++ b/internal/servers/controller/handlers/targets/target_service.go
@@ -12,7 +12,6 @@ import (
 
 	"github.com/golang/protobuf/ptypes/wrappers"
 	"github.com/hashicorp/boundary/globals"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/credential"
 	"github.com/hashicorp/boundary/internal/credential/vault"
 	"github.com/hashicorp/boundary/internal/db/timestamp"
@@ -25,6 +24,7 @@ import (
 	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/requests"
 	"github.com/hashicorp/boundary/internal/servers"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/common/scopeids"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
@@ -844,7 +844,7 @@ HostSetIterationLoop:
 	for _, tSet := range hostSets {
 		hsId := tSet.PublicId
 		switch host.SubtypeFromId(hsId) {
-		case host.StaticSubtype:
+		case static.Subtype:
 			_, hosts, err := staticHostRepo.LookupSet(ctx, hsId)
 			if err != nil {
 				return nil, err
@@ -882,7 +882,7 @@ HostSetIterationLoop:
 	defaultPort := t.GetDefaultPort()
 	var endpointHost string
 	switch host.SubtypeFromId(chosenId.hostId) {
-	case host.StaticSubtype:
+	case static.Subtype:
 		h, err := staticHostRepo.LookupHost(ctx, chosenId.hostId)
 		if err != nil {
 			return nil, errors.New(errors.InvalidParameter, op, "errors looking up host")
@@ -1790,7 +1790,7 @@ func validateAuthorizeSessionRequest(req *pbs.AuthorizeSessionRequest) error {
 	}
 	if req.GetHostId() != "" {
 		switch host.SubtypeFromId(req.GetHostId()) {
-		case host.StaticSubtype:
+		case static.Subtype:
 		default:
 			badFields[globals.HostIdField] = "Incorrectly formatted identifier."
 		}
diff --git a/internal/servers/controller/handlers/targets/target_service_test.go b/internal/servers/controller/handlers/targets/target_service_test.go
index d0e29ed0a..b5456acc2 100644
--- a/internal/servers/controller/handlers/targets/target_service_test.go
+++ b/internal/servers/controller/handlers/targets/target_service_test.go
@@ -13,9 +13,7 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/authtoken"
-	"github.com/hashicorp/boundary/internal/credential"
 	"github.com/hashicorp/boundary/internal/credential/vault"
 	"github.com/hashicorp/boundary/internal/db"
 	credpb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/credentiallibraries"
@@ -30,6 +28,7 @@ import (
 	"github.com/hashicorp/boundary/internal/scheduler"
 	"github.com/hashicorp/boundary/internal/servers"
 	spb "github.com/hashicorp/boundary/internal/servers"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers/credentiallibraries"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers/targets"
@@ -2226,7 +2225,7 @@ func TestAuthorizeSession(t *testing.T) {
 				Name:              clsResp.GetItem().GetName().GetValue(),
 				Description:       clsResp.GetItem().GetDescription().GetValue(),
 				CredentialStoreId: store.GetPublicId(),
-				Type:              credential.VaultSubtype.String(),
+				Type:              vault.Subtype.String(),
 			},
 		}},
 		// TODO: validate the contents of the authorization token is what is expected
diff --git a/internal/servers/controller/handlers/users/user_service.go b/internal/servers/controller/handlers/users/user_service.go
index 9379b87df..fdeb83980 100644
--- a/internal/servers/controller/handlers/users/user_service.go
+++ b/internal/servers/controller/handlers/users/user_service.go
@@ -5,7 +5,6 @@ import (
 	"fmt"
 
 	"github.com/hashicorp/boundary/globals"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/auth/oidc"
 	"github.com/hashicorp/boundary/internal/errors"
 	pb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/users"
@@ -15,6 +14,7 @@ import (
 	"github.com/hashicorp/boundary/internal/intglobals"
 	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/requests"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/common/scopeids"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
diff --git a/internal/servers/controller/handlers/users/user_service_test.go b/internal/servers/controller/handlers/users/user_service_test.go
index 9be878b2a..3cbdb1d47 100644
--- a/internal/servers/controller/handlers/users/user_service_test.go
+++ b/internal/servers/controller/handlers/users/user_service_test.go
@@ -9,7 +9,6 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/auth/oidc"
 	"github.com/hashicorp/boundary/internal/auth/password"
 	"github.com/hashicorp/boundary/internal/db"
@@ -18,6 +17,7 @@ import (
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
 	"github.com/hashicorp/boundary/internal/iam"
 	"github.com/hashicorp/boundary/internal/kms"
+	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers/users"
 	"github.com/hashicorp/boundary/internal/types/scope"
diff --git a/internal/types/subtypes/registry.go b/internal/types/subtypes/registry.go
new file mode 100644
index 000000000..51804bbce
--- /dev/null
+++ b/internal/types/subtypes/registry.go
@@ -0,0 +1,83 @@
+// Package subtypes provides helpers to work with boundary resource subtypes.
+package subtypes
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/hashicorp/boundary/internal/errors"
+)
+
+// Subtype variables identify a boundary resource subtype.
+type Subtype string
+
+const (
+	UnknownSubtype Subtype = "unknown"
+)
+
+// String returns the string representation of a Subtype
+func (t Subtype) String() string {
+	return string(t)
+}
+
+// Registry stores a collection of boundary resource subtypes along with their
+// prefixes and allows for translating prefixes back to registered subtypes.
+// Registry is not thread safe.
+type Registry struct {
+	subtypesPrefixes map[string]Subtype
+	knownSubtypes map[Subtype]interface{}
+}
+
+// New Registry creates a new boundary resource subtype registry.
+func NewRegistry() *Registry {
+	return &Registry{
+		subtypesPrefixes: make(map[string]Subtype),
+		knownSubtypes:    make(map[Subtype]interface{}),
+	}
+}
+
+// SubtypeFromType returns the Subtype from the provided string or if
+// no Subtype was registered with that string Unknown is returned.
+func (r *Registry) SubtypeFromType(t string) Subtype {
+	st := Subtype(t)
+	if _, ok := r.knownSubtypes[st]; !ok {
+		return UnknownSubtype
+	}
+	return st
+}
+
+// SubtypeFromId returns the Subtype from the provided id if the id's prefix
+// was registered with a Subtype. Otherwise Unknown is returned.
+func (r *Registry) SubtypeFromId(id string) Subtype {
+	i := strings.Index(id, "_")
+	if i == -1 {
+		return UnknownSubtype
+	}
+	prefix := id[:i]
+
+	subtype, ok := r.subtypesPrefixes[prefix]
+	if !ok {
+		return UnknownSubtype
+	}
+	return subtype
+}
+
+// Register registers all the prefixes for a provided Subtype. Register returns
+// an error if the subtype has already been registered or if any of the
+// prefixes are associated with another subtype.
+func (r *Registry) Register(subtype Subtype, prefixes ...string) error {
+	const op = "subtypes.(Registry).Register"
+	if _, present := r.knownSubtypes[subtype]; present {
+		return errors.New(errors.SubtypeAlreadyRegistered, op, fmt.Sprintf("subtype %q already registered", subtype))
+	}
+	r.knownSubtypes[subtype] = nil
+
+	for _, prefix := range prefixes {
+		prefix = strings.TrimSpace(prefix)
+		if st, ok := r.subtypesPrefixes[prefix]; ok {
+			return errors.New(errors.SubtypeAlreadyRegistered, op, fmt.Sprintf("prefix %q is already registered to subtype %q", prefix, st))
+		}
+		r.subtypesPrefixes[prefix] = subtype
+	}
+	return nil
+}
diff --git a/internal/types/subtypes/registry_test.go b/internal/types/subtypes/registry_test.go
new file mode 100644
index 000000000..7df2db9cd
--- /dev/null
+++ b/internal/types/subtypes/registry_test.go
@@ -0,0 +1,74 @@
+package subtypes_test
+
+import (
+	"testing"
+
+	"github.com/hashicorp/boundary/internal/types/subtypes"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSubtypeFromId(t *testing.T) {
+	testSubtype := subtypes.Subtype("test")
+	r := subtypes.NewRegistry()
+	r.Register(testSubtype, "tttst")
+	tests := []struct {
+		name  string
+		given string
+		want  subtypes.Subtype
+	}{
+		{"empty-string", "", subtypes.UnknownSubtype},
+		{"no-prefix-delimiter", "tttst1234", subtypes.UnknownSubtype},
+		{"prefix-first", "_tttst_1234", subtypes.UnknownSubtype},
+		{"unknown-prefix", "kaz_1234", subtypes.UnknownSubtype},
+		{"prefix-no-id", "tttst_", testSubtype},
+		{"vault-prefix", "tttst_1234", testSubtype},
+		{"prefix-no-delimiter-no-id", "tttst", subtypes.UnknownSubtype},
+	}
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			got := r.SubtypeFromId(tt.given)
+			assert.Equalf(t, tt.want, got, "given: %s", tt.given)
+			if got != tt.want {
+				t.Errorf("(%s): expected %s, actual %s", tt.given, tt.want, got)
+			}
+		})
+	}
+}
+
+func TestSubtypeFromType(t *testing.T) {
+	testSubtype := subtypes.Subtype("test")
+	r := subtypes.NewRegistry()
+	r.Register(testSubtype, "tttst")
+	tests := []struct {
+		name  string
+		given string
+		want  subtypes.Subtype
+	}{
+		{"empty-string", "", subtypes.UnknownSubtype},
+		{"correct-string", "test", testSubtype},
+		{"captialized", "TEST", subtypes.UnknownSubtype},
+		{"typo", "testt", subtypes.UnknownSubtype},
+	}
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			got := r.SubtypeFromType(tt.given)
+			assert.Equalf(t, tt.want, got, "given: %s", tt.given)
+			if got != tt.want {
+				t.Errorf("(%s): expected %s, actual %s", tt.given, tt.want, got)
+			}
+		})
+	}
+}
+
+func TestRegister(t *testing.T) {
+	r := subtypes.NewRegistry()
+	assert.NoError(t, r.Register("test", "testprefix"))
+	// registering multiple subtypes should be fine.
+	assert.NoError(t, r.Register("second", "secondprefix"))
+	// registering another prefix with a different subtype errors.
+	assert.Error(t, r.Register("third", "testprefix"))
+	// Registering the same subtype twice errors.
+	assert.Error(t, r.Register("test", "repeatedprefix"))
+}