OpenIDConnect refuses to resolve .onion addresses, according to RFC 7686.
Workaround by modifying the Apache authentication settings for Calibre, or Calibre’s internal access-control settings (except don’t because the passwords are stored in plaintext, IIRC). Either way, you’re getting your hands dirty.