**As** an OpenProject administrator
**I want to** be made aware of the dangers of automatic self registration
**so that** I realise that unknown users could gain access to my projects.

Begin of the insertion####End of the insertion **Acceptance criteria**

Begin of the insertion**Restructure admin page**

For _Administration → Authentication → Authentication Settings:_

End of the insertion * Begin of the insertionRename 'Authentication settings' to 'General'End of the insertion Begin of the deletion tbdEnd of the deletion

* Begin of the insertionSplit the contents of ther page into two different tabs as follows:End of the insertion Begin of the deletion perhaps put automatic self registration behind a danger zone explaining thatEnd of the deletion

* Begin of the insertion**'Login and SSO'** groups these existing sections:

End of the insertion Begin of the deletion this will allow anyone to self register

End of the deletion * Begin of the insertionSingle sign-on

* Automated user blocking

* Session

* Others

* **'Registration'** groups these existing sections:

* General

* Registration footer

* Passwords


**Add warning banner for self-registration**

In the Login and SSO page, for the 'Self-registration' drop down:

* If 'Account activation by email' or 'Automatic account activation' is selected, show a warning banner below the field:

* Text: "The userEnd of the insertion Begin of the deletion anyone who did so,End of the deletion will be able to Begin of the insertionactivate their own accounts. Please note that this will give them access to allEnd of the insertion Begin of the deletion see anyEnd of the deletion public projects Begin of the insertionand their content. Please make sure that no sensitive or private data is exposed in public projects."


**Project settings**

_In {Project name} → Project settings → Information:_

End of the insertion Begin of the deletion

End of the deletion * Begin of the insertionRemove 'Visibility' section withEnd of the insertion Begin of the deletion perhaps we should, where applicable, switchEnd of the deletion the Begin of the insertion'Public' checkbox

* _The checkbox does not communicate the full gravity of the action. This action should have a similar weightEnd of the insertion Begin of the deletion self registration setting from automaticEnd of the deletion to Begin of the insertionarchiving a project._

* If a project is not public:

* Add option "Make project public"End of the insertion Begin of the deletion manual in an updateEnd of the deletion to Begin of the insertionthe More (⋯) menu

* On click, show DangerConfirmationDialog:

* Title: "Make this project public?"

* Text: Anyone who has accessEnd of the insertion Begin of the deletion then force everyoneEnd of the deletion to Begin of the deletion go throughEnd of the deletion this Begin of the insertioninstance will be ableEnd of the insertion Begin of the deletion danger zoneEnd of the deletion to Begin of the insertionview and interact with this project depending on their role and authentication settings. Sub-projects are not affected and have their own settings.

* Checkbox label: I understand that this will make the previously private content public

* Primary action: Confirm

* Secondary action: Cancel

* If a project is public:

* Add option "Make project private" to the More (⋯) menuEnd of the insertion Begin of the deletion re-enable itEnd of the deletion

* Begin of the insertionOn click, show DangerConfirmationDialog:

* Title: "MakeEnd of the insertion this Begin of the insertionproject private?"

* Text: The project will only be visible to project members depending on their role and associated permissions.

* Checkbox label: I understand that this will make the previously public content private.

* Primary action: Confirm

* Secondary action: Cancel

* Add a warning banner (yellow) to the topEnd of the insertion Begin of the deletion shouldEnd of the deletion of Begin of the insertionthe page:

* Text: This project is public. Anyone who has access to this instance willEnd of the insertion Begin of the deletion courseEnd of the deletion be Begin of the insertionable to view and interact with this project depending on their role and associated permissions. Sub-projects are not affected and have their own settings.

* Primary action: Make private (showsEnd of the insertion Begin of the deletion mentioned inEnd of the deletion the Begin of the insertionDangerConfirmationDialog described above)


####End of the insertion Begin of the deletion release notes


End of the deletion **Technical notes**

* Begin of the insertionTheEnd of the insertion Begin of the deletion theEnd of the deletion default value for the self registration setting is manual activation which is safe

<br>